The Evolution of Microsoft Defender for Office: A Comprehensive Overview

The Evolution of Microsoft Defender for Office: A Comprehensive Overview

Microsoft Defender for Office (MDO) has often been criticized for lacking functionality and not catching all malicious emails. However, recent innovations have significantly improved its capabilities, making it a robust tool for email security. This blog post aims to summarize these advancements and highlight why MDO is a formidable option for protecting your email infrastructure and awareness trainings.

It’s also quite important to remember that MDO is built into Extended Detection and Response (XDR) and is an essential piece in a defense-in-depth strategy. Using third-party solutions can create silos, leading to suboptimal response times and coordination.

Enhanced Email Detection and Reduced False Positives

Recent reports indicate that tools detecting more malicious emails often also produce more false positives, incorrectly flagging harmless messages. This increases users’ workload as they review quarantined emails and may result in missed information.

Moreover, other vendors often classify marketing and bulk emails in a specific category, which MDO does not. I believe that incorporating this functionality into MDO in the future would be highly beneficial, as it has the potential to reduce the volume of emails in my inbox. Currently solved by consequently unsubscribe the newsletters or creating mailbox rules.

Investigations often reveal that MDO policies or system settings are not configured according to best practices; for instance, leaving the Outlook Junk Filter on can add unnecessary confusion.

Source: Microsoft Transparency on Microsoft Defender for Office 365 email security effectiveness | Microsoft Security Blog

Read the full reports here, especially the ICES vendor integrations shows detailed insights: Transparency on Microsoft Defender for Office 365 email security effectiveness | Microsoft Security Blog

Attack Simulation and User Training

There are varying opinions on the effectiveness of awareness training in enhancing overall cyber security compared to the effort required from users. In my view, awareness training is essential but should be approached with a balanced mindset to avoid overengineering and excessive investment, as the results can vary.

With this in mind, Microsoft Defender for Office (MDO) offers built-in attack simulation tools at no additional cost, as they are included in the M365 E5, E5 Security, or Defender for Office P2 plans. Attack Simulation requires no special configuration like allow listening specific URL’s. The built-in tool provides mail reporting functionality for users, creating a dedicated pipeline for handling reported emails. Many customers who switch to other solutions often miss the seamless integration that MDO offers. While third-party tools may have extensive training catalogs, they lack the integration capabilities that MDO provides.

As an example, if the awareness platform is recommending you deploy their message report button, it breaks the whole Machine Learning and Analysis flow of the MDO protection stack. Which requires your analysts to work with a separate tool as well. Microsoft has also made significant strides in improving the remediation of user reported messages through artificial intelligence. When an email is flagged as malicious, MDO performs a cluster analysis over the entire infrastructure. It can automatically remediate and soft delete these emails in all other mailboxes, offering a significant advantage over other solutions.

Source: Microsoft

It is important to note that while third-party awareness tools can submit emails to MDO, they cannot provide analysis results back to the system. This lack of integration means that user-reported email analysis in the third party tools can’t be used and are no longer an additional benefit and Microsoft is still doing the analysis as well which could even lead to different results. The only benefit of routing mail through the other platform would be that mails originating from a phishing simulation are detected. Therefore, the attack simulation tool in MDO is highly recommended for its effectiveness and ease of use as with others we also lower the effectiveness on protection side.

Improved Integration Capabilities with ICES vendor ecosystem

Additionally, MDO now allows for the integration of third-party protection tools like KnowBe4 and Darktrace instead of using them as a gateway. This means that if you prefer not to use MDO for protection, you can still benefit from a unified quarantine and the protection mechanisms of a third party. MDO can connect to third-party solutions, retrieve analysis results, and integrate them into its system. This level of integration is a game-changer, making MDO a versatile and comprehensive email security solution also if you trust for mail analysis in another vendor.

Source: Microsoft

Conclusion

In summary, Microsoft Defender for Office has evolved significantly, addressing many of the criticisms it previously faced. With enhanced email detection, reduced false positives, advanced attack simulation, improved remediation, and robust integration capabilities, MDO is a highly effective tool for email security. If you haven’t considered MDO recently, now is the time to take a closer look at its impressive new features and capabilities.

My key takeaways are:

1. Marketing and Bulk Emails: Microsoft Defender for Office (MDO) has good ability to catch malicious emails while minimizing false positives. Unlike other vendors, MDO does not classify marketing and bulk emails and therefore the mailbox gets more mails which probably a user don’t want but they are not phis or malicious.
2. Advanced Attack Simulation and User Training: MDO includes built-in attack simulation tools that require no additional configuration and are included in the M365 E5, E5 Security, or Defender for Office P2 plans. These tools offer seamless integration and mail reporting functionality, which many third-party solutions lack.
3. Improved Remediation and Integration Capabilities: MDO has enhanced its remediation of malicious messages through artificial intelligence, allowing for automatic remediation and soft deletion of emails across all mailboxes. Additionally, MDO now supports integration with third-party protection tools, providing a unified quarantine and comprehensive email security solution.
4. Importance of MDO in XDR and Defense-in-Depth Strategy: MDO is an essential component of Extended Detection and Response (XDR) and plays a crucial role in a defense-in-depth strategy. Using third-party solutions can create silos, leading to suboptimal response times and coordination.
5. Balanced Approach to Awareness Training: Awareness training is important but should be approached with a balanced mindset to avoid overengineering and excessive investment. MDO’s built-in attack simulation tools offer an effective and cost-efficient solution for user training and email security.