Microsoft Defender | Threat Management | Explorer | Email preview

Question

Hello,

Using Microsoft Defender, it is possible to use Explorer to preview emails if a specific role is granted.

We would like to monitor such activity, preferably via Sentinel, and trigger an email alert if someone is previewing the emails of the end users.

Where is this activity being logged? How to integrate this log with Sentinel?

Best regards,

Oscar

Answer 1

@Oscar Thank you for reaching out to us, came across this tech community blog - https://techcommunity.microsoft.com/t5/microsoft-defender-xdr/email-entity-preview-email/m-p/3662612 where similar ask has been discussed, just check if the approach discussed here helps you or not.

Let me know if you have any further questions, feel free to post back.