EMILY 365 Microsoft Defender for Office User Guide

: October 30, 2023
: EMILY

Table of Contents

365 Microsoft Defender for Office
Outlook Junk Mail
Email Quarantine Folder
Shared mailboxes
FAQs
References
Read User Manual Online (PDF format)
Download This Manual (PDF format)

EMAIL QUARANTINE
Microsoft Defender for Office 365

365 Microsoft Defender for Office

University Emily Carr Art+Design has implemented Microsoft Defender for Office 365, Microsoft’s solution for email protection.
Defender will help protect ECUADusers and systems from malicious emails that could harm computers and infrastructure or compromise system data. In addition to messages coming to your inbox, you will have a junk and quarantine folder.

Outlook Junk Mail

Junk email messages can be a nuisance in your inbox, also known as spam. The junk email filter in Outlook identifies messages that are likely junk and moves them to the junk email folder.
Example: Junk Email folder

Change the level of junk mail protection:
You can easily change the level of junk email protection. If an email is in Junk Email which should not have been marked as ‘junk’, please right-click on it, and from the pop-up menu, select:

block sender
never block sender
never block sender’s domain
never block this group or mailing list.

Please check the contents of the Junk Mail folder regularly.

Email Quarantine Folder

The quarantine folder holds potentially dangerous or unwanted email messages. Depending on why the message was quarantined, you can view, release, delete messages or block sender. However, please note that emails classified as high- confidence phishing and malware cannot be released.
Quarantine Email Notifications:
Once a day, you will receive an email quarantine notification via email. If no emails were quarantined you would not receive this notification. Please follow the instructions to review the messages and the classification reason why it was quarantined (e.g., spam, phishing).
You can release emails that have been misclassed, but please note that emails classified deemed as high-confidence phishing or Malware by Microsoft cannot be released.
This might happen in an instance when even if you know and trust the sender, Microsoft may have deemed the message as malicious or high-confidence because the sender’s account may have been compromised.
Please note that ECUAD has no direct control over this process.
Example: Quarantine Email Notification

EMILY 365 Microsoft Defender for Office - Email
Notification

To view emails in the quarantine folder:
If staff wish to see their quarantine folder in real-time, as they may suspect an expected email may be quarantined ahead of the next scheduled email summary, you can do this here.
You can take the following actions on quarantined email:

Quarantine email	Action
Release message	Releases one or multiple selected emails
Delete messages	Deletes single or multiple selected emails from quarantine
Preview message	Allows email to be viewed with all links disabled or in plain

text
View message header| Allows viewing of the email header for analysis
Block Sender| Add the sender to the Blocked Senders list in your mailbox

To release emails in the quarantine folder
Messages that are quarantined have been classified as malware, phishing, spoof, impersonation, or bulk mail. You can review the messages and decide whether you want to release them.
Staff wishing to release a specific email from a sender can do this. However, please note that emails classified as high-confidence phishing and malware cannot be released.
You can check your quarantine here.

Shared mailboxes

Shared mailboxes are where multiple users have access. Staff can release quarantined objects if they have been given full access and send as or send on behalf of permissions.
Please select review on the individual message and not on the email notification.
Example:

EMILY 365 Microsoft Defender for Office - Shared
mailboxes

FAQs

How is it determined what is junk or quarantine?

Since it is not good email security practice for Microsoft to publicise the rules that control their 'spam and phishing scoring', we will not always establish why specific emails are quarantined since this information is not public knowledge. We know that the scoring is influenced by criteria such as the email content and the volume of emails sent by the sender. Please note that ECUAD has no direct control over this process.

How do I add a safe sender to my junk email?

Releasing the message doesn't add the sender to your safe senders. You will still need to add as a safe sender manually. If these senders are trusted, you can add them as Safe Senders via the guidance here.

Safe senders' criteria

For safe senders to be classed as trusted with the Microsoft detection technology, the senders would need to be following best industry practices here.

What is high-confidence classification?

Please note that if the sender does not follow the safe senders' criteria, then the emails will be sent to your quarantine folder as Microsoft has classed this as high-confidence phishing or malware. Such emails, if deemed as high-confidence phishing or malware, cannot be released.

I released an email from quarantine but can't locate it

Released quarantine emails should go to your Inbox in real time. If you can't see it, and have your Focussed and Other tabs set on your Outlook Inbox, check your 'Other' tab.

Can anti-phishing policies be removed from my ECUAD M365 account?

Please note we are unable to make changes to any of the implemented policies for security reasons. The University has implemented specialised security measures to proactively protect ECUAD and its user base. We take the safety of our staff and students seriously, and our policies are set by the best industry standards and are continually updated to be in line with these.

Can the SafetyTips banner be removed from my ECUAD M365 email account?

Outlook includes SafetyTips. This capability adds an extra layer of protection against potential impersonation attacks. You may see a banner the first time you receive a message from a sender, or when you don’t often get messages from the sender. At ECUAD we keep this capability turned on for security reasons.

Where can I get more help?

If you need help, you can call the IT Service Desk on 604-630-4565, or go to around the IT Service Office B1116 8:30 am – 4:30 pm, Monday to Friday

Our ECUAD cyber security page contains helpful tips and tricks and guidance on spotting a scam.
Please keep vigilant, and if you do ever spot anything suspicious, make sure you tell us straight away via report-phishing@ecuad.ca .