For more advanced reporting scenarios you can also create your own mail protection mashups using the Office 365 reporting APIs and Power BI. Here is sample report that can assist in tracking email trends and to gather data in incident response investigations https://aka.ms/mailprotectionbi.

The sample report includes views of: Traffic Summary, Traffic Type, Spam Detail, Malware by Address, Malware by Type, ATP SafeLinks, ATP SafeAttachments, and ATP SafeAttachment Actions.

A report view that has been particularly helpful in Phishing incident response scenarios is looking at the last 10,000 SafeLinks clicks searchable by recipient or URL (ATP is required). For example, if multiple compromised users have clicked on the same URL it could be a good candidate for being added to an organization SafeLinks URL block policy to prevent additional users from being compromised by that URLs from that URL or domain. The report also includes a link to the Exchange Online Message Trace for gathering more details about the original message that contained the URL.

Here are the steps to get the sample report up and running:

1. Download the sample report: https://aka.ms/mailprotectionbi

2. Install PowerBI Desktop: https://go.microsoft.com/fwlink/?LinkId=521662&clcid=0x409

3. Open the MailProtectionReportPowerBITemplate.pbix file in Power BI and select “Refresh”.

4. Enter Office 365 credentials (Basic) to connect to the Reports API (needed on the first refresh only):

5. (optional) Modify days of detail in the detail reports edit the DaysOfDetail parameter to go back further on malware and spam detail reports. **Warning** - increasing this value could cause the report to take a long time to refresh depending on the amount of mail in the tenant. For large tenants it is recommend to run the report with a scheduled refresh in a Power BI online workspace which enables the use of larger DaysOfDetail values than are reasonable to run in the client since it can refresh in the background ensuring that the most recent data is always ready to view):

The first option is found in the Office 365 Admin Center under Home > Active Users. Select a user and expand the OneDrive Settings section for that user. Select “Initiate” to perform a one-time sign-out for that user that revokes active sessions across Office 365 services including Exchange Online.

The second option to force logoff during an active user session in Office 365 to use Revoke-SPOUserSession cmdlet from the SharePoint Online PowerShell Module. This method is helpful for automating security incident response flows or when there is a need to revoke multiple users’ sessions.

The third option to force a user sign-out extends beyond Office 365 services to all active user sessions in any Azure AD application (thanks to Micah Linehan for recommending to include this option in the list). The Revoke-AzureADUserAllRefreshToken cmdlet is available in the AzureAD V2 PowerShell Module and expires a user's refresh token by modifying the user's token validity period.

Set-SPOSite -Identity https://contoso-my/sharepoint.com/personal/sampleuser_contoso_com -StorageQuota 5242880

Understanding some basics of KQL can help you solve complex search refinement scenarios. Using a bit of KQL in the keyword list can save a lot of time combing through results. For example, a common scenario for Content Search or eDiscovery is looking only for mail messages exchanged between two or more users. The KQL generator included at the end of this post generates KQL specifically for this scenario since including more than a few users can otherwise involve quite a bit of typing. Start by scoping the queried mailboxes to just the users in the investigation which will result in much faster search times in very large environments. Then add each user’s email address or alias to the tool (adding additional fields as needed) and then select “Get KQL” and use the generated result in the “keywords” field of the search. Using a filter in this scenario can easily reduce the number of results by 100x or more. This is a KQL sample that was generated for messages between three users.

For more advanced queries, de-duplication, machine learning, and predictive coding, use Office 365 Advanced eDiscovery. Advanced eDiscovery provides significant time and cost savings by adding data and textual analytics to the eDiscovery process.

KQL tool for discovering messages between users

This walkthrough provides an example of inviting external users into Azure AD as guest users and granting access to resources in a different Azure AD Tenant. While it is beyond the scope of this post, Application or Group GUIDs can also be included in the CSV file to provide initial authorization or automated license provisioning for the users.

Log into https://manage.windowsazure.com as an administrator. Select Active Directory and then the directory that you want to invite external users to. 

Navigate to the “USERS” tab and then select “ADD USER”.

Create a CSV file with the external users. (https://azure.microsoft.com/en-us/documentation/articles/active-directory-b2b-references-csv-file-format)

Select “User in partner companies” from the dropdown and then save and close the CSV and select for upload.

The batch job details will show the current status for the users.

If the invite email doesn’t match an Azure AD User’s User Principal Name then the Microsoft Account (Microsoft ID) setup flow will begin when they click the invite link, otherwise if it does match the user will be prompted to sign in with their School or Work credentials. Let’s take a look at the flow for the end user when they already have School or Work credentials (Org ID).

After authentication, the user will then see multiple directories listed in https://portal.azure.com.

The administrator of the resource directory will then see the external user listed as sourced from “Microsoft Azure AD (other directory)”.

We will be adding new B2B features and options in the coming months. You can read the most up to date details about B2B functionality directly in the Azure documentation. https://aka.ms/AzureB2BOverview

To get started with a trial of ATP follow this process:

1. In the Office 365 Admin Center  click on  “Purchase Services” in the left Navigation of the Admin Portal

2. Expand the “Add-On Subscriptions” section and click “Start Free Trial” for “Exchange Online Advanced Threat Protection for Faculty”

3. NOTE- if the “Add-On Subscriptions” section is missing you must first “purchase” a $0 base license. Add a minimum of one “Office 365 Education for Faculty/Students” OR “Exchange Online plan 2” license first. Choose the annual commitment option to avoid being prompted for a credit card.

4. Once you’ve added the licenses to you tenant, you can set up ATP Safe Links and Safe Attachments policies.     

Scenario #1 Limit Group Creators

Scenarios #2 & #3 Hide Groups and Audit Ownership