CloudMail Info Center https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/feed.xml Tools, Tips, and Tricks troubleshooting Office 365 Exchange Issues Tue, 16 Apr 2019 06:00:30 GMT en-US hourly 1 Who has an ATP License assignment in your tenant and who does not? https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/who-has-an-atp-license-assignment-in-your-tenant-and-who-does-not Sat, 07 May 2016 07:55:15 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=275 I have developed a script to check for who has a ATP license assigned and who does not in your tenant.   What you will need to do is connect PowerShell to O365  and run the following.   O365 PowerShell connection information: https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx  
  1. Start-transcript
 
  1. $PIUsers = Get-MsolUser -All | Where { ($_.isLicensed -eq $True) } | Select UserPrincipalName,Licenses
 
  1. ForEach ($User in $PIUsers) { ForEach ($License in $User.Licenses) { ForEach ($Service in $License.ServiceStatus) { If ($Service.ServicePlan.ServiceName -like 'ATP_ENTERPRISE') { $User.UserPrincipalName}}}}
 
  1. Stop-Transcript
    Once completed the users that have the license assigned will be displayed in the output on screen and the transcript will output the results to a text file.]]> Customer Service Key Points to Rememeber https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/customer-service-key-points Fri, 08 Apr 2016 13:57:32 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=193 What makes me feel satisfied as a Customer?
    We need to focus on a few Key points that I experienced recently. Bottom-Box surveys are always going to happen, but there is a way for us to make sure we don’t end up with a bad score by just taking a few extra steps. The steps are what made me as a customer change my experience from bad to excellent.   For Example. Here are a few questions to ask yourself.  
  • Would I have sent bad feedback if I felt like I was being heard?
  • Even if I didn’t get the results I was looking for, what if I felt like the individual understood my situation?
  • What if they tried to be personal in dealing with me?
  • What if I was told info that was incorrect, and the person took responsibility?
  • What if I was made to feel important?
  • What if the representative not giving up and trying to answer my questions?
  • What if they didn’t talk down to me as a person?
  • What if the representative told me things I wanted to hear, and didn’t promise over delivery?
  AVY1w   Below are a few steps that can be taken to overcome a bad survey score no matter how hard or difficult the situation may be.   communication-free-bing-image   Communicate and listen: Communication is the most important element of any successful customer service experience. Make sure you communicate any important or relevant information to your customer so that they have all the details at hand to make informed decisions when it comes to your service. And as important as it is know exactly what to tell the customer, it’s just as important to stop and listen. Understanding the customer’s needs and complaints is the first step to making sure that you can address them.   Redmond   Anticipate what the customer needs or wants: Sometimes listening isn’t enough. Knowing what your customer wants before they themselves know it can lead to an excellent reputation as an attentive and personable brand. This comes down to truly understanding your customer and what they’re all about.  
  Untitled   Make it personal: Make them feel like they’re talking to a person, not a company. Adding a bit of a personal touch to the conversation will instantly put the customer at ease. VIP treatment for every single customer will distinguish your brand from any other brand. Countless customer service hotlines use a script when addressing a problem, and while it’s acceptable, and in most cases necessary to do so, don’t make it sound like your following a script. No one wants to talk to a robotic customer service representative who sounds like they’re reading off a page, rather than speaking to a human being. 581119_565822540136537_737528606_n   Know when to admit you made a mistake: If you or someone else did something wrong, a sincere apology can often go a long way. This is the first step to making up for it. I’m sorry can make all the difference.   The customer is always right: The cliché, "The customer is always right" is a cliché for a reason. Even if the customer isn’t right, making them feel like they are is an essential part of Customer Service 101. problem_unsolved   If there’s a problem, fix it: I don’t know should not be in your vocabulary. Chances are at one point or another, a customer will ask you a question you don’t know the answer to. Instead of saying, I don’t know, offer an alternative. Think of another way you can address their problem. If there’s an issue that needs solving, do all that you can to get it solved as quickly as possible, but be honest about how long it will take to resolve the issue. 121   Under promise, Over deliver: Never tell the customer you’re going to do something unless you’re absolutely sure that you’re going to be able to fulfil the request. It’s better to exceed their expectations than to leave them feeling disappointed and dissatisfied with the service, because they’ll probably end up going elsewhere.

 stop-628x363

  Don’t talk down to your customer: Customers don’t want to feel like you’re talking to them as though they’re children. Even if your customer doesn’t necessarily understand the intricate details of how your business works – make them feel like they do. l-164074   Use words your customer wants to hear: Always think positive. Use words like Yes and Of course and Straight away. Positive words with a sense of immediacy will go a long way to make the customer feel like their every need is being attended to. Certain words are thought to have a positive effect on a person’s mood, and can often make them feel more upbeat. There’s no denying the power of choosing the right words when it comes to customer service.   Take Away: It is often more important to recognize these steps than how you execute specific process skills. If these steps are followed the rest should come naturally in your communication.]]> Mailbox Move Request Diagnostics XML https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/mailbox-move-request-diagnostics Thu, 07 Apr 2016 09:03:20 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=173                 Get-MoveRequest <user> | Get-MoveRequestStatistics -IncludeReport | Export-CliXML <user.xml>   Now that we have the data how to we view it? We simply need to open PowerShell and input the XML as follows. PS C:\Temp> $move = Import-Clixml "C:\Users\Desktop\MoveRequest.xml" Next we simple use the above referenced Report commands to get a full list of the issues that can be found with the move request.$move.Report
  • $move |FL
    • This gets the entire list of what occurred during the move.
  • $move.Report.Failures
    • This pulls all the failures, which showed that we had issues with bad items, which caused the move to restart.
  • $move.Report.BadItems
    • This shows the bad items that caused the failures.
  • $move.BadItemLimit
    • Shows that the move was configured to have a 0 bad item limit. Depending on what you are looking for - you can get a LOT more out of the move report than just the .txt output from the Migration Console. You just need to know what to dig into in order to really see what is going on - which just comes with playing around and seeing what is available. I highly advise on getting the Report on ANY move request case that you get, as it is generally the best piece of information to start off with and will give you some key evidence on where to go next if
This will point you in the right direction of where the errors are encountered and what should be done to get them resolved. It is always a good idea to run the following to capture the results in order to sae the data for future reference. Start-Transcript  - This command will start and save the data output to a location on your computer. Stop-Transcript  - This command will stop recording the session and will finalize the file that was created.    ]]> Outlook and OWA App for iOS devices https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/outlook-and-owa-for-ios Fri, 18 Mar 2016 09:12:53 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=162 https://blogs.office.com/2015/01/29/deeper-look-outlook-ios-android/   Fun Fact: What happens to the current Outlook Web Access (OWA) for iPhone/iPad/Android apps? The new Outlook app replaces OWA for iPhone/iPad/Android. We are leaving the OWA for iPhone/iPad/Android apps in market for the time being because there are some advanced Office 365 and Exchange Server features that are not yet available in Outlook. Customers who require these advanced features (e.g. viewing Information Rights Management protected mails, support for Apps for Outlook) can continue to use OWA for iPhone/iPad/Android until those features are available in Outlook.  

Support Policy

Technical support is only entitled through the in-app support experience. The in-app support experience goes directly to the Outlook for iOS and Outlook Preview for Android support teams that work directly with the acquired Acompli development team. As part of the acquisition of Acompli, we are only providing support through this direct channel. All Broad Commercial customers must be directed to the in-app support experience.   Outlook for iOS and Outlook Preview for Android are not entitled products for Premier customers. Premier customers should also submit their questions about the app through the in-app experience.

Support Boundaries

The Exchange Online Support Boundaries article was updated to cover Outlook for iOS and Outlook for Android scenarios: KB 2723482

Escalations

Premier TAMs can escalate questions about Outlook for iOS and Outlook Preview for Android to the Outlook-iOS-Android alias. Non-premier customers must be referred to the in-app support. The following graphic outlines the Premier support process.  
Outlook for iOS and Outlook for Android features Supported Outlook for iOS (mobile app) and Outlook for Android (mobile app) Support, which can be contacted from within the app.Go to Settings , Help , and then tap Contact Support . For more info, see  3035535 . 100 Self-service https://support.office.com/en-us/learn/outlook-for-ios-and-android-faq The Outlook for iOS (mobile app) and Outlook for Android (mobile app) Support Team will handle related escalations, including bugs, which can be submitted from within the app.Go to Settings , Help , and then tap Contact Support . For more info, see  3035535 .
  What Exchange ActiveSync policies are supported by the new Outlook app?  Outlook on iOS & Android supports the following Exchange ActiveSync policies:
  • Remote Wipe – Removes local email data from the device.
  The following Exchange ActiveSync policies are in development and will be available Outlook soon.
  • PIN lock – enforce PIN at the device or application level
  • Maximum failed password attempts – wipe device or app after a set number of failed password attempts
  • Activity time-out – if user has not loaded the app a pre-determined period of time, the app will prompt the user for PIN.
]]> Case ownership / Responsible Person for the Health of the SR. https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/case-ownership-responsible-person-for-the-health-of-the-sr Wed, 24 Feb 2016 16:47:34 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=91 　Case ownership / Responsible Person for the Health of the SR.

  Revenue is lost every year in the technical support industry due to unnecessary repeat calls caused by engineer error. Below are the most common errors that lead to low time-to-resolution scores – and all can be corrected with the right customer service training.  

Top Engineer Errors That Increase Time-To-Resolution (TTR) and (TMPI)

In these common errors, engineers can run into the issue of
  1. Having a call or ticket transferred incorrectly.
  2. Needlessly telling the customer to call back or waiting to call them back.
  3. Don’t listen to and/or understand the customer’s request/issue.
  4. Supply customer inaccurate information.
  5. Decline to set expectations sufficiently
  6. Failure to inform customer about self-service options
  7. Don’t follow through on commitments/procedures
  8. Communicate poorly causing customer to be apprehensive about a solution
Ok I do these things already? Now what? What other ways can I use the same know how to further lower these costs? Be proactive! Always look for new tools and procedures that can help you lower these costs.   Streamline Processes with further Customer Service Training: Providing internal customer service is just as important as providing top-notch support for customers. Investing in training does much more than improve communication skills to benefit external customers. Customer service training also improves internal communications. Improving internal communication skills increases employee satisfaction and productivity which aids in reducing TTR. When employees have great communication skills, use a common service language, and adhere to predetermined issue resolution processes, reducing TTR becomes an attainable goal. Gathering all employees together for classroom training provides an ideal opportunity for open discussion and for employees from different departments to constructively discuss process issues. To further maximize the benefits of customer service training, it is a good idea if all support supervisors and managers also participate in training. Taking part in training alongside your support team shows that you are not only a strong advocate for training, but that continuous improvement is important for employees of all management levels. Reduce TTR with Employee Training Investing in customer service training for technical support engineers will provide them with the necessary skills to competently and efficiently resolve customer issues. When customers interact with a confident engineer who expertly guides them through the call, provides accurate information and appropriately sets expectations, they are likely to be satisfied at the end of the call and have no reason to call back. When the opposite occurs, customers may call for support again to ask additional questions and/or seek resolution validation from a different engineer.   Finally, ask yourself these important questions: Wait or schedule things? What is needed from you? What is needed from someone else? What can you do? No idle customer?     Case ownership is a very important answer to these questions that needs focus to keep TMPI low. One thing we can look at is what is the total cost of ownership for you on this case? 1. Even though a problem has been cut to another team it is still your responsibility to keep the customer happy and overall satisfaction positive to keep survey scores up. 2. No one wants and Idle case in your bin. We want to remain in contact with the new problem owners as well as the customer to keep the ticket moving at all times. 3. If you can’t reach the customer by email call them. If you can’t reach the customer by phone call them as well. 4. Ask the customer is there anything else I can do to help speed things up with the case. 5. Collaborate with the Problem 2 owner. Answer questions for them. Offer support to those engineers via IM or phone call. It’s always better to talk to someone on a case then have to read your notes. It is not always clear on what you have done versus what needs to be done. 6. Create a template for the customer when sending the scope email that sets expectations for yourself as well as expectations for the customer. Set deadlines. 7. Collaborate with other engineers if you are stuck. Just talking the issue through with someone else always leads to a possible solution. 8. Don’t let the customer drag the issue forward. Speak up if an issue is by design and only focus on one problem at a time. A customer will go off on a tangent that will only cloud solution to the problem. 9. Always include the TAM on conversations to the customer. Keeping the TAM involved well help the TAM be aware of questions centered around the situation. As stated it is not always clear and or they do not take the time to read the case. 10. Even if what you do on a case is pretty straight forward it is always a good idea to make sure you always take the time to keep your notes structured and organized throughout a case. 11. What do I do if I cannot reach the customer? The customer will be aware of what is needed by them to keep the ticket active. 12. Do not let the customer push you into keeping a case open if there is no need. Let them know archiving a case is no different than keeping it in your bin. It can be re-activated at any time. 13. Pull in your peers to help you on questions you might have. Not everyone is a SME in all areas. Having a backup for yourself to run thoughts or ideas back and forth will help TMPI. Example: EOP engineer needing help with an EXO case and an EXO engineer needing help with an EOP case. Share knowledge even if it is not for a case that you own. That help you provided last week will help you resolve your problem next week. 14. Be straight up with a customer. It is ok to admit you do not know the answer. Letting them know you can find that answer will help a customer’s temperature and keep issues moving. 15. If you are on a bridge with the new problem owner listen in on what they are doing. No one said ever that you have to cut problems to another team. If you get familiar with issues more, then you can take that knowledge for future cases that might be able to be resolved without creating a problem to being with thus lowering TMPI even more. 16. Do not be afraid to tell the customer no. If an issues is not supported let them know and offer them a possible solution. Don’t waste time trying to configure something that will only cause them headaches at a later time. 17. Always fix the issue and don’t patch it. It will create more time for that initial ticket, but it will lower TMPI in the long run to keep duplicate issues from coming up. 18. Do not take on more than you can chew… This is very important with keeping TMPI low. Just because you can have 20 tickets in your queue does not mean you should. Balance your work load enough to keep focus on the customers at hand that need you.  ]]> How to submit a request for MMPC review for SPAM/Virus emails that come through your tenant. https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/how-to-submit-a-request-for-mmpc-review-for-spamvirus-emails-that-come-through-your-tenant Fri, 29 Jan 2016 11:06:18 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=51 https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx for an additional anti-spam protection from this message (the spam analysts could then mark it as spam). Protect yourself. 1)      Make sure you have a rule in EOP that blocks executable content. https://support.microsoft.com/kb/2959596 2)      Keep your Operating Systems and 3rd party software (such as Adobe Acrobat Reader, Flash, Java etc.) updated with the latest security updates.   How to prevent this in the future? ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Advanced Threat Protection – feature available now Additional cost? Yes, unless you purchase an E5 Office365 plan, where it is included. What does it do? We recommend adopting ATP as an add-on to EOP. It provides three key benefits:
  1. Protection against unknown malware and viruses by providing robust zero-day protection using the safe attachments capability. These are threats that are not always detected by traditional anti-malware engines.
  2. Real-time, time-of-click protection against malicious URLs that protect your users in real-time against harmful links using the Safe links capability.
  3. Rich reporting and URL trace capabilities that give admins insights into the kind of attacks happening in the organization.
As malware can be found in some phishing mails, this feature is another effective tool in the fight against spam. Here are links to some key ATP articles. The first includes a video that walks through the ATP features and features a discussion with a product manager.  ]]> Exchange Online Protection Troubleshooting Guide https://docs.microsoft.com/archive/blogs/cloudmailinfocenter/exchange-online-protection-troubleshooting-guide Thu, 28 Jan 2016 14:41:26 GMT https://blogs.technet.microsoft.com/cloudmailinfocenter/?p=41 Below you will find various links necessary to troubleshoot Exchange Online Protection issues. The list has been compiled to go over various areas of expertise that you will run into when dealing with Exchange online Protection.   Exchange Online Protection Complete Guide:   1. Customize your SPF record https://technet.microsoft.com/en-us/library/dn789058(v=exchg.150).aspx   2. Find and release quarantined messages as an end user https://technet.microsoft.com/en-us/library/dn683870%28v=exchg.150%29.aspx (Access: https://admin.protection.outook.com/quarantine)   3. SPF Hard Fail On https://technet.microsoft.com/en-us/library/jj200750(v=exchg.150).aspx   4. High Risk Delivery Pool https://technet.microsoft.com/en-us/library/jj200746(v=exchg.150).aspx   5. Outbound spam https://technet.microsoft.com/en-us/library/dn600434(v=exchg.150).aspx   6. Connect to PowerShell https://technet.microsoft.com/en-us/library/jj984289(v=exchg.150).aspx   7. Get Transport Rules https://technet.microsoft.com/en-us/library/aa998585(v=exchg.150).aspx   8. Export Content Filtering Policy https://technet.microsoft.com/en-us/library/jj200764(v=exchg.150).aspx   9. Rules to block executable files https://support.microsoft.com/kb/2959596   10. Information on EOP improvements. https://blogs.office.com/2014/10/15/evolving-exchange-online-protection-eop-protect-tomorrows-threats/ https://blogs.office.com/2015/01/20/enhanced-email-protection-dkim-dmarc-office-365/   11. Submitting false positives to Microsoft + Outlook Junk Add-in https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx   12. Blocked Sender / Safe Senders in Office 365 https://support.microsoft.com/kb/2545137?wa=wsignin1.0   13. Virus 1)     Submit it here: https://www.microsoft.com/security/portal/submission/submit.aspx. 2)     Submit the samples AS A PASSWORD-PROTECTED ATTACHMENT (and send the password in the body of your email) to our junk@office365.microsoft.com alias per the spam submission process here: https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx for an additional anti-spam protection from this message (the spam analysts could then mark it as spam). 3)      Make sure you have a rule in EOP that blocks executable content. https://support.microsoft.com/kb/2959596 4)      Keep your Operating Systems and 3rd party software (such as Adobe Acrobat Reader, Flash, Java etc.) updated with the latest security updates.     14. DMARC: Introduction: https://blogs.msdn.com/b/tzink/archive/2014/11/04/a-brief-introduction-to-dmarc.aspx Use DMARC in Office 365: https://blogs.msdn.com/b/tzink/archive/2014/12/03/using-dmarc-in-office-365.aspx Use DKIM + DMARC in O365: https://blogs.office.com/2015/01/20/enhanced-email-protection-dkim-dmarc-office-365/ Use DMARC to Prevent Spoofing: https://blogs.technet.com/b/eopfieldnotes/archive/2015/02/26/using-dmarc-to-prevent-spoofing.aspx Strategies to mitigate Phishing attempts (video): https://blogs.technet.com/b/eopfieldnotes/archive/2015/05/29/support-hot-topics-strategies-to-mitigate-phishing-attempts.aspx   15. Malware and ATP: Enable notifications when malware is detected and deleted: https://technet.microsoft.com/en-us/library/jj200745(v=exchg.150).aspx. Find answer to common anti-malware questions on the FAQ: https://technet.microsoft.com/en-us/library/jj200664(v=exchg.150).aspx. Go over these tips to prevent Zero-Day malware: https://blogs.technet.com/b/eopfieldnotes/archive/2015/06/08/tips-to-prevent-zero-day-malware-with-eop.aspx and reduce Zero-Day threats (video): https://blogs.technet.com/b/eopfieldnotes/archive/2015/06/26/support-hot-topics-reducing-the-threat-of-zero-day-malware.aspx. Advanced Threat Protection is now GA: https://blogs.office.com/2015/04/08/introducing-exchange-online-advanced-threat-protection/, and to add Safe Links and Safe Attachments layers ATP offers. Once you’re set up with ATP, here’s the technical reference on ATP you should find useful: https://technet.microsoft.com/en-us/library/mt148491(v=exchg.150).aspx. When submitting zero-day malware samples to Microsoft, it’s important to do it as soon as possible to the time of detection to get anti-virus definitions up-to-date. Use your Microsoft (Live ID) Account to be notified once the definition updates are in place. https://www.microsoft.com/security/portal/submission/submit.aspx. The vast majority of known malware can be stopped using Transport Rules using content and attachment scanning: we suggested that you move your existing attachment blocking and executable blocking rules to top priority (0 and 1): https://support.microsoft.com/kb/2959596. Review how to create a transport rule to evaluate and take action on DMARC failures: https://blogs.msdn.com/b/tzink/archive/2014/12/03/using-dmarc-in-office-365.aspx , check which transport rules triggered: https://blogs.technet.com/b/eopfieldnotes/archive/2015/04/22/need-details-on-who-and-what-are-triggering-your-transport-rules-there-39-s-a-cmdlet-for-that.aspx. Use PowerShell to find or export the ID or other details of your existing rules: https://technet.microsoft.com/en-us/library/aa998585(v=exchg.150).aspx.   16. Spam+Bulk Filtering: Spam filter policies: https://technet.microsoft.com/en-us/library/jj200684%28v=exchg.150%29.aspx. The new Spam Filter Allow and Block Lists are explained here: https://blogs.technet.com/b/eopfieldnotes/archive/2015/06/19/an-introduction-to-the-new-spam-filter-allow-and-block-lists.aspx. Bulk Mail filtering and how lowering the threshold from 7 to 6 or 5 can help you catch more bulk mail spam https://blogs.office.com/2014/11/24/block-spam-holiday-season-new-enhanced-bulk-mail-experience-eop/.   17. Connection filtering: We saw a number of Allowed IP ranges, that can probably be reduced to the bare minimum. Also note, that in case those IP’s are compromised and start sending spam, you might want to reconsider whether you want to bypass spam scanning from them. https://technet.microsoft.com/en-us/library/jj200718(v=exchg.150).aspx   18. Customize your SPF record: We discussed how you should change the current SPF configuration you have that includes “outlook.com” to include “spf.protection.outlook.com” per the article to minimize the number of DNS queries on your records: https://technet.microsoft.com/en-us/library/dn789058(v=exchg.150).aspx. We touched on the Advanced Spam Filtering options, and that the essential option of SPF Hard Fail (inbound SPF checks) to protect against spoofed messages is already turned ON: https://technet.microsoft.com/en-us/library/jj200750(v=exchg.150).aspx   19. Outbound spam: The current outbound spam policies, although defined to send to an address, are probably underutilized. We advised to separate the HRDP notifications from the blocked senders notifications, to be alerted real-time of more critical outbound spam issues. https://technet.microsoft.com/en-us/library/dn600434(v=exchg.150).aspx   20. False Positives / False Negatives: Submit junk and non-junk to Microsoft (see updated addresses in the article). You noted that the Outlook Junk Add-in that’s installed on end-user machines is probably underutilized. In that regard, user education plays an important role, for getting submissions timely. https://technet.microsoft.com/en-us/library/jj200769(v=exchg.150).aspx ======================================================================================================================================== More information: Blocked Sender / Safe Senders in Office 365 https://support.microsoft.com/kb/2545137?wa=wsignin1.0   PowerShell: Connect to PowerShell https://technet.microsoft.com/en-us/library/jj984289(v=exchg.150).aspx   List of all available cmdlets, including reporting and mail flow: https://technet.microsoft.com/en-us/library/jj200780(v=exchg.150).aspx   Reporting: https://technet.microsoft.com/en-us/library/jj200725(v=exchg.150).aspx https://blogs.technet.com/b/eopfieldnotes/archive/2015/06/12/scheduling-mail-reports-in-office-365.aspx     Macro viruses:   The purpose of a macro is to automate frequently used tasks. Although some macros are simply a recording of your keystrokes or mouse clicks, more powerful VBA macros are authored by developers who use code that can run many commands on your computer. For this reason, VBA macros pose a potential security risk because a hacker can introduce a malicious macro through a document that, if opened, allows the macro to run and potentially spread a virus on your computer. Safe attachments is a feature in ATP that opens every unknown supported file type attachment in a special hypervisor environment and helps detect malicious activity. It is designed to help detect malicious attachments even before anti-virus signatures are available. File types that the safe attachments feature can detonate: Safe attachments will detonate attachments that are common targets for malicious content, such as Office documents, PDFs, executable file types, and Flash files.
    • Block executable content by creating an Exchange Transport Rule, https://support.microsoft.com/en-us/kb/2959596
    • Block particular malicious attachments. For increased protection, we also recommend using Transport rules to block some or all of the following extensions: ade, adp, ani, bas, bat, chm, cmd, com, cpl, crt, hlp, ht, hta, inf, ins, isp, job, js, jse, lnk, mda, mdb, mde, mdz, msc, msi, msp, mst, pcd, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh. This can be done by using the Any attachment file extension includes these words condition. Refer to EOP Best Practices documentation: https://technet.microsoft.com/EN-US/library/jj723164(v=exchg.150).aspx
    • Customize your company’s SPF record to change it to Hard Fail.
https://technet.microsoft.com/en-us/library/dn789058(v=exchg.150).aspx
    • Turn SPF Hard Fail On to mark all messages that fail SPF checks as spam, to quarantine them.
https://technet.microsoft.com/en-us/library/jj200750(v=exchg.150).aspx
    • See how DMARC can help against spoofing:
Introduction: https://blogs.msdn.com/b/tzink/archive/2014/11/04/a-brief-introduction-to-dmarc.aspx Use DMARC in Office 365: https://blogs.msdn.com/b/tzink/archive/2014/12/03/using-dmarc-in-office-365.aspx Use DKIM + DMARC in O365: https://blogs.office.com/2015/01/20/enhanced-email-protection-dkim-dmarc-office-365/ Use DMARC to Prevent Spoofing: https://blogs.technet.com/b/eopfieldnotes/archive/2015/02/26/using-dmarc-to-prevent-spoofing.aspx Strategies to mitigate Phishing attempts (video): https://blogs.technet.com/b/eopfieldnotes/archive/2015/05/29/support-hot-topics-strategies-to-mitigate-phishing-attempts.aspx  ]]>