From d6b380c53fcee3f3a1ec4984d9b298c672d0985d Mon Sep 17 00:00:00 2001 From: Dhairyya Agarwal <12413099+dhairyya@users.noreply.github.com> Date: Mon, 3 Mar 2025 14:32:57 -0800 Subject: [PATCH 1/3] Microsoft can analyze third-party user report Updated cmdlet to incorporate settings for microsoft can analyze third-party user report --- .../exchange/Set-ReportSubmissionPolicy.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md index ed3adf565b..746f2765c6 100644 --- a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md +++ b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md @@ -300,8 +300,9 @@ The EnableReportToMicrosoft parameter specifies whether Microsoft integrated rep The value $true for this parameter enables reporting in Outlook. The following configurations are possible: -- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft only (the reporting mailbox isn't used)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. This is the default result. -- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft and reported messages are sent to the specified reporting mailbox**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $true. To create the policy, use the same email address in the ReportJunkAddresses, ReportNotJunkAddresses, and ReportPhisAddresses parameters, and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlet. +- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft only (the reporting mailbox isn't used)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. +- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft and reporting mailbox (reported messages are sent to the specified mailbox)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $true. To create the policy, use the same email address in the ReportJunkAddresses, ReportNotJunkAddresses, and ReportPhisAddresses parameters, and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlet. This is the default configuration. +- **Using a third party add-in in Outlook for users to report to Microsoft and reporting mailbox**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. The EnableThirdPartyAddress is $true. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. The value $false for this parameter disables reporting in Outlook. The following configurations are possible: @@ -322,10 +323,15 @@ Accept wildcard characters: False ``` ### -EnableThirdPartyAddress -The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online. Valid values are: +The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online. Valid values are $true or $false. -- $true: Reporting in Outlook is enabled, but third-party tools in Outlook send reported messages to the reporting mailbox in Exchange Online. You also need to set the EnableReportToMicrosoft parameter value to $false. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. -- $false: Third-party reporting tools in Outlook aren't used. + +The value $true for this parameter enables Microsoft to start pulling from the third-party reporting mailbox. The following configurations are possible: + +- **Reported messages are sent only to the reporting mailbox****: Microsoft pulls the metadata from the Exchange Online reporting mailbox third-party tools in Outlook are sending reported messages to. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. You also need to set the EnableReportToMicrosoft parameter value to $false. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. +- - **Reported messages are sent to both Microsoft and reporting mailbox****: Microsoft pulls the metadata and submitted email from the Exchange Online reporting mailbox third-party tools in Outlook are sending reported messages to. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. The email is used to generate result for the submissions. You also need to set the EnableReportToMicrosoft parameter value to $true. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. + +The value $false means Third-party reporting tools in Outlook aren't used. ```yaml Type: Boolean From e1710a05797fee2a5d66dc00989eedc824d62c88 Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Mon, 3 Mar 2025 14:42:25 -0800 Subject: [PATCH 2/3] Fix typos and improve parameter descriptions --- .../exchange/Set-ReportSubmissionPolicy.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md index 746f2765c6..1e7d3ac207 100644 --- a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md +++ b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md @@ -300,9 +300,9 @@ The EnableReportToMicrosoft parameter specifies whether Microsoft integrated rep The value $true for this parameter enables reporting in Outlook. The following configurations are possible: -- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft only (the reporting mailbox isn't used)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. +- **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft only (the reporting mailbox isn't used)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. - **Microsoft reporting tools are available in Outlook for users to report messages to Microsoft and reporting mailbox (reported messages are sent to the specified mailbox)**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $true. To create the policy, use the same email address in the ReportJunkAddresses, ReportNotJunkAddresses, and ReportPhisAddresses parameters, and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlet. This is the default configuration. -- **Using a third party add-in in Outlook for users to report to Microsoft and reporting mailbox**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. The EnableThirdPartyAddress is $true. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. +- **Using a third party add-in in Outlook for users to report to Microsoft and reporting mailbox**: The ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, and ReportPhishToCustomizedAddress parameter values are $false. The EnableThirdPartyAddress parameter value is $true. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. The value $false for this parameter disables reporting in Outlook. The following configurations are possible: @@ -326,12 +326,12 @@ Accept wildcard characters: False The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online. Valid values are $true or $false. -The value $true for this parameter enables Microsoft to start pulling from the third-party reporting mailbox. The following configurations are possible: +The value $true enables Microsoft to capture email information from the third-party reporting mailbox. The following configurations are possible: -- **Reported messages are sent only to the reporting mailbox****: Microsoft pulls the metadata from the Exchange Online reporting mailbox third-party tools in Outlook are sending reported messages to. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. You also need to set the EnableReportToMicrosoft parameter value to $false. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. -- - **Reported messages are sent to both Microsoft and reporting mailbox****: Microsoft pulls the metadata and submitted email from the Exchange Online reporting mailbox third-party tools in Outlook are sending reported messages to. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. The email is used to generate result for the submissions. You also need to set the EnableReportToMicrosoft parameter value to $true. To create the policy, use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. +- **Reported messages are sent only to the reporting mailbox**: Microsoft pulls metadata from messages sent to the Exchange Online reporting mailbox by third-party tools. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. You also need to set the EnableReportToMicrosoft parameter value to $false. Use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. +- **Reported messages are sent to both Microsoft and reporting mailbox**: Microsoft pulls the metadata and message content from messages sent to the Exchange Online reporting mailbox by third-party tools. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. The email is used to generate result for the submissions. You also need to set the EnableReportToMicrosoft parameter value to $true. Use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. -The value $false means Third-party reporting tools in Outlook aren't used. +The value $false means third-party reporting tools in Outlook aren't used. ```yaml Type: Boolean From 9924ae81f2451e8120cb2bd8bc2bdc89f0d9a479 Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Mon, 3 Mar 2025 14:43:45 -0800 Subject: [PATCH 3/3] Clarify EnableThirdPartyAddress parameter description --- exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md index 1e7d3ac207..9e9b525a46 100644 --- a/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md +++ b/exchange/exchange-ps/exchange/Set-ReportSubmissionPolicy.md @@ -325,8 +325,7 @@ Accept wildcard characters: False ### -EnableThirdPartyAddress The EnableThirdPartyAddress parameter specifies whether you're using third-party reporting tools in Outlook instead of Microsoft tools to send messages to the reporting mailbox in Exchange Online. Valid values are $true or $false. - -The value $true enables Microsoft to capture email information from the third-party reporting mailbox. The following configurations are possible: +The value $true enables Microsoft to capture information about email sent to the third-party reporting mailbox. The following configurations are possible: - **Reported messages are sent only to the reporting mailbox**: Microsoft pulls metadata from messages sent to the Exchange Online reporting mailbox by third-party tools. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. You also need to set the EnableReportToMicrosoft parameter value to $false. Use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets. - **Reported messages are sent to both Microsoft and reporting mailbox**: Microsoft pulls the metadata and message content from messages sent to the Exchange Online reporting mailbox by third-party tools. Microsoft uses the metadata to populate the submissions page in the Microsoft Defender Portal and fire alerts. The email is used to generate result for the submissions. You also need to set the EnableReportToMicrosoft parameter value to $true. Use the same email address in the ThirdPartyReportAddresses parameter and also in the SentTo parameter on the New-ReportSubmissionRule or Set-ReportSubmissionRule cmdlets.