We are excited to announce the release of new Microsoft Defender for Office 365 API’s which enable security teams to leverage threat information and response capabilities of Microsoft Defender for Office 365 inside automation and security orchestration tools of their choice.

These new API’s enable your security teams to achieve more within their existing toolsets by leveraging the power of Microsoft Defender for Office 365!

Our new API methods extend our existing Microsoft Graph API functionality with additional key benefits, such as:

Integration with a range of security tools and services such as SOAR platforms, enabling you to build custom automation and playbooks for security scenarios that can natively integrate with Microsoft Defender for Office 365.
Retrieval of detailed threat information, such as filter verdicts, related underlying entities (such as attachments, linked URLs), Safe Attachments and Safe Links detonation details. This ensures that all email threat information can be leveraged for more complete and comprehensive automation capabilities.
Ability to perform response actions on emails (such as soft delete, hard delete, move to junk, move to inbox) natively within your security tools and automation platforms, enabling you to create end to end playbooks with response capabilities.

We believe that these new API’s will enable us to meet the SOC where they are, enable your teams and third-party security vendors to natively interact with Microsoft Defender for Office 365.

Our new API’s are built around least-privilege with its own permission scopes, complete with auditing capabilities, allowing you to perform automation and integration securely in your organization.

It does not matter if you are using Sentinel, a third-party SOAR platform, logic apps, PowerShell automation, python scripts, or any other tool – these API’s are about meeting you where you are so you can leverage the power of Microsoft Defender for Office 365 to help secure your organization.

Scenario Examples

Whilst the opportunities are endless, here are just a few great ideas that we have heard from our customers. Because these new APIs are open, you could achieve these (and more) within Sentinel, or your platform of choice:

Automated Detection & Response: What about triggering a playbook off some threat condition within your environment? Maybe you received a new threat indicator? Leveraging Microsoft Defender XDR Advanced hunting API to find emails based on your IOCs (Indicators of Compromise), view detonation details about the IOCs and then remediating them using these new API methods? All now possible with our new Microsoft Defender for Office 365 APIs!

Reported message triage: Triage reported phish messages inside your orchestration tool of choice, pull in Microsoft Defender for Office 365 threat detection information (such as Safe Links detonation results), mix that with your automation logic and threat indicators, and then perform response actions, all within your orchestration platform of choice powered by these new APIs.

Showing it in action through the unified SOC experience.

Here’s an example of this all together. In this scenario, we will use a Microsoft Defender XDR incident as a trigger, that will start a Sentinel logic app playbook that uses our new response API’s for fetching email indicators, compare those indicators against our own threat intelligence, and then act on the message if meets our threat conditions:

Starting at the incident, using the Unified Security Operations Platform experience with Microsoft Sentinel and Defender XDR, we can trigger the playbook. In reality, you might choose to have this playbook triggered automatically based on the creation of a new incident rather than manually run it. For the purpose of the demonstration, we will run it manually:

The playbook leverages Defender Advanced Hunting API’s for discovering additional emails, and mixes with our internal threat intelligence sources. If we detect our known indicators within the message from the advanced hunting query, our playbook knows that this message should be removed and triggers the removal with our new API:

Our new MDO Response API’s are called against these suspect emails, which creates a trackable alert for response in the Microsoft Defender portal:

After the action has been completed, we can see the email associated with the playbook was deleted by our Response APIs by looking at the timeline view of the email:

Showing it in action through Splunk SOAR

Our new API’s are open, standard REST calls provided by Microsoft Graph, and as such they can be leveraged by any automation or security tool supporting standard API calls.

We are releasing actions to act on messages, but also to pull detailed verdict & indicator information from them.

In this example we will bring additional threat indicators from Microsoft Defender for Office 365 (using our new API’s) into our third-party SOAR system as native artifacts!

Microsoft Defender for Office 365 has advanced detonation capabilities that use machine learning and behavioural patterns to detect threats within emails. Historically, the information extracted from our detonation chambers has been visible only via our Defender Portal as shown below:

With our new API’s, we are able to pull our detonation deep analysis in to third-party systems, such as Splunk SOAR:

Our above playbook can be triggered on an email artifact in Splunk SOAR. When the API playbook is triggered, we pull the URL artifacts and respective detonations on that email using our new API’s, exposing them as artifacts in Splunk SOAR!

Screenshot from Splunk SOAR showing our detonation information.

API Documentation References

As with all Graph API’s, we have detailed documentation, and example code available in the Graph Reference Guide to get you started:

Analyzed Email – List

List emails in a certain timeframe

– similar to what is available within the Threat Explorer API

You can also use filters like network message ids and recipient ids to search for specific emails.

Analyzed Email – Get

Get detailed threat information on an individual email message. This contains verdict information, detailed Safe Links/Safe Attachments detonation IOCs, and verdict results – similar to what is available within the Email entity API.

Analyzed Email – Remediate

Perform remediation activities on an email, such as soft delete, hard delete, move to inbox, quarantine release, delete sender’s copy and move to deleted items.

Let us know what your ideas are! How will you leverage these new API’s within your platform and processes?

Learn More: 

For additional information visit: analyzed Email: remediate – Microsoft Graph beta | Microsoft Learn
Engage with the community and Microsoft experts in the Defender for Office 365 forum questions or feedback

​Microsoft Tech Community – Latest Blogs –Read More 

When I maximize the edge window, I can’t see the color for individual tabs in the tab group. (2nd image). Though is shows perfectly when I minimize. I tried recording it just now but I saw that the color is showing both in videos & screenshots too. So I took capture it on my phone instead (2nd image). It used to show a few months ago so think it might be a problem with my monitor? I have no idea. 

1.jpg2.jpg

​When I maximize the edge window, I can’t see the color for individual tabs in the tab group. (2nd image). Though is shows perfectly when I minimize. I tried recording it just now but I saw that the color is showing both in videos & screenshots too. So I took capture it on my phone instead (2nd image). It used to show a few months ago so think it might be a problem with my monitor? I have no idea.   1.jpg2.jpg  Read More

​

Hello everyone. 

I have a Excel macro that seems to work perfect at home however at my work PC I get a run time error 13. When I look at the VBA it highlights an error with my:  rng/Value   ….

MY goal of this sheet is to enter a begin and end date, this will provide a series of 1 to 7 values based on those dates. Only the values would be shown and the others not applicable would be hidden, which this also applies to the tabs . 

I will also note, my old workstation worked flawlessly though that needed an update from our tech support. Now that I have transferred, I am worried if my employer wants to use this Excel sheet, the entire department will need an update. 

Any advice? Thank you in advance for your time and support. 

​Hello everyone.  I have a Excel macro that seems to work perfect at home however at my work PC I get a run time error 13. When I look at the VBA it highlights an error with my:  rng/Value   …. MY goal of this sheet is to enter a begin and end date, this will provide a series of 1 to 7 values based on those dates. Only the values would be shown and the others not applicable would be hidden, which this also applies to the tabs .  I will also note, my old workstation worked flawlessly though that needed an update from our tech support. Now that I have transferred, I am worried if my employer wants to use this Excel sheet, the entire department will need an update.  Any advice? Thank you in advance for your time and support.      Read More

​

Welcome to July’s update on Microsoft Teams, where we share some of the new features and improvements that are making collaboration easier and more enjoyable. This month, we have exciting enhancements for your meetings, chats, and communications that will help you personalize your experience, stay organized, and express yourself better. For example, you can now use custom emojis and reactions to express yourself and reflect your team’s culture. You can also enjoy a more engaging and inclusive meeting experience with the new meeting gallery, which places all participants in equal-sized tiles and can automatically highlight certain participants to enhance the meeting experience. And for Teams Rooms on Windows, you can benefit from speaker attribution enhancements, enabling Copilot and meeting recaps to understand who said what in recaps and insights. These are just some of the highlights that I’m most excited about, but there’s much more to explore in this update.

Chat and Collaboration

Meetings, Mesh in Teams, Webinars, and Town Halls

Teams Rooms and Devices

Teams Phone

Chat and Collaboration

Custom emojis and reactions
Bring more creativity and expression into your conversations with custom emojis and reactions. Upload your own custom emojis or reactions to personalize the conversation, reflect your team’s culture, efficiently share status, or share a lighthearted reaction. Once uploaded, custom emojis can only be used within the user’s tenant, but once they are sent, they are visible to all members of the chat. IT admins can decide who has permission to create custom emojis, delete custom emojis, or turn off the capability altogether. Learn more.

Search result suggestions
Enhance your search experience with message suggestions. As you type in the search bar, you’ll see recent chat message suggestions pop up along with other type of search results, helping you find relevant messages quickly. These suggestions include details such as the sender’s name and profile picture, the context of the message, the date it was sent, and icons indicating the presence of web-links or file attachments. This new feature streamlines your search, making it easier to locate the exact message you need.

Enhanced sound notification controls

Stay focused, prioritize quickly, and avoid distractions by customizing the sound of your notifications. Go to Settings-> Notifications and activity tab, and under Sound assign different sounds to different kinds of notifications, such as urgent messages and priority contacts. Or mute notification sounds when you are busy or in a meeting. Tailor your notification experience to help you stay on top of what matters most.

Turn on/off notifications for a channel post

Stay in control of your Teams notifications by turning on or off notifications for a specific channel post. Tailor your notification preferences, ensuring that you stay informed on topics important to you. To manage notifications, click on the ellipsis (three-dot menu) in the top right corner of a post. If you are following the post, you will see “Turn off notifications.” If you are not following, you will see “Turn on notifications.”

Teams cross-cloud guest access on web

We are extending existing guest access functionality to the web, allowing guests between tenants across Microsoft clouds who access the Teams app from the browser to participate in rich collaboration experiences in chat, meetings, channels, and teams. Guests can participate in a full collaboration experience including audio/video, screen share, file share and both 1:1 and 1:many chat. Admins can establish trust between tenants and across the Microsoft clouds via Entra B2B and Cross Tenant Access Settings.

Meetings, Mesh in Teams, Webinars, and Town Halls

Meetings: New meeting gallery in Teams meetings

The new meeting gallery provides you with a simpler, more predictable meeting presence, while enabling you to personalize the view to suit your needs. The new gallery places everyone in tiles of equal size whether their camera is turned on or off. While the default gallery size is 16 participants, you can customize the number of participants visible on your screen (up to 49) to best fit your preference. The new meeting gallery will automatically optimize the visibility of certain participants to improve meeting engagement, like those with a raised hand and active speakers. You can also choose to prioritize participants who are on camera to better connect with your teams. Additional customizable views available in the new meeting gallery include the ability to hide yourself from the main gallery or remove yourself from the main gallery (only visible to you). The new gallery experience in Teams meetings is now available.

When a Teams Room joins a Teams meeting, the video tile of the room automatically enlarges, offering a more inclusive experience for participants who are joining online. Remote attendees now have a clearer view into the room and can more easily spot who is speaking. To adjust the tile size, simply choose your preference from the more options (…) menu by hovering on the room name.

Events: Presenter orderability on event page in webinars

Event organizers can now customize the list of presenters in the webinar event page via drag and drop functionality to mirror the intended order of presenters within a given event. This option can be found under the “Presenter Bio” section of the webinar set-up dialog box and can be customized until the start of the event.

Events: Manage what attendees see updates for town hall and webinars

It is now easier for event organizers to toggle presenters on and off during town hall events and webinars in the Manage screen. Presenters will now have a “live” indicator on their video feed when they have been brought on screen. Toggle the indicator off to remove their video from the event. This feature can accommodate up to seven presenters at a time. “Manage what attendees see” functionality and control is included in all Teams licenses for town hall and requires a Teams Premium license for webinars.

Events: Town hall events in Government Community Cloud (GCC)
Government users can now set up and host large scale events across a GCC organization with the familiar Teams app using town hall. Town hall capabilities in GCC include a new meeting template, capacity for up to 20,000 attendees, third-party eCDN support, green room access, the ability to “manage what attendees see,” RTMP-in, live translated captions, and more. Moderated Q&A will also be available in the near future. GCC will be available in Teams and Teams Premium.

Microsoft Mesh: Event templates in Teams Premium
Events organizers no longer need to create each new event from scratch. Organizers can now use turnkey event templates to quickly create an event with the capabilities they need already configured. The first two templates available are the Meadow and Oasis environments with the screenshare object included in both. The Meadow environment is a larger, more open environment for experiences like few-to-many events, while Oasis is a good fit for small to medium meetings and presentations. Both environments come with a screenshare panel already placed and ready to display content.Further customization is always possible via the Mesh app to add additional content like videos, images, or text too. Event templates are available in Teams Premium.

Microsoft Mesh: Revisit event links in Teams Premium
A much-awaited feature for events is now available. Use past links you’ve received when you created your event, or share the link with others, to rejoin old events. Simply select the link to open the Mesh application and rejoin your past events. The ability to revisit previous event links is available in Teams Premium.

Microsoft Mesh: More avatar reactions

New avatar reactions allow users to be more expressive. Avatar reactions allow attendees and presenters to gauge how events and meetings, and their content, are being received by participants. The additional avatar reactions can be played in immersive space (3D) view in Teams and in Mesh events.

Microsoft Mesh: Avatar personal boundary

Avatars now have a personal boundary to prevent other people from walking through avatars or standing too close. This helps to increase comfort and safety while in immersive spaces. Avatar personal boundary is available in all Mesh experiences.

Teams Rooms and Devices

Find certified for Teams devices for all types of spaces and uses at aka.ms/teamsdevices.

Speaker recognition and Copilot benefits for all Teams Rooms on Windows

Now, everyone, regardless of microphone types in the room, can benefit from precise speaker attribution in transcripts in Teams Rooms on Windows. With this update, everyone can benefit from detailed meeting recaps and use Copilot, so they can find out who said what and get insightful responses to queries. Microsoft’s cloud-based intelligent speaker recognition analyzes the distinct vocal characteristics of each speaker, such as pitch, tone, and speaking style. First brought to Teams Rooms on Windows, the feature will expand to Teams Rooms on Android devices and the Teams desktop for bring your own device (BYOD) meeting spaces later this year.

IT admins can learn more on activating voice profiles and enhancing the Teams meetings experience with Copilot at aka.ms/speakerecblog. Users can quickly create their voice profile at aka.ms.voiceprofile.

Sennheiser TeamConnect Bar M

Newly certified for Teams, the TeamConnect Bar M is a feature-rich, all-in-one device for mid-sized meeting rooms and collaboration spaces. The TC Bar M includes six microphones and four speakers to deliver Sennheiser audio quality to every meeting. Integrated beamforming technology enables freedom of movement and seamless transitions between presenters, and is complemented by advanced AI video features such as auto-framing and person tiling. The flexibility and audio clarity of TeamConnect Bar Solutions facilitate high-quality experiences for everyone, whether they are in-room or remote. Learn more.

Jabra PanaCast 50
Newly certified for Teams, the Jabra PanaCast 50 intelligent camera supports Microsoft Multi-stream IntelliFrame and features a unique 180° field of view. This provides a panoramic view and close-ups of recent speakers. People recognition technology creates a more inclusive environment by identifying individuals, displaying their names in the meeting roster, and name tagging them on the Teams meeting stage. Combined with intelligent speaker capabilities, the Jabra PanaCast 50 delivers the best AI integration for both end users and IT admins. Learn more.

Yealink WH64 Headset
Newly certified for Teams, the Yealink WH64 Headset is designed for modern professionals who need flexibility and comfort. This headset features wireless technology, catering to flexible working styles, and its ergonomic design provides all-day comfort.

Teams Phone

Explicit consent recording meeting policy support on Teams phone devices
A pop-up notification will appear on your certified Teams phone device when someone starts a recording or transcription, allowing you to accept or decline. This feature is turned off by default but can be enabled by admins in the Team admin center. No content will be captured without consent. Learn more.

Private line on Teams phone devices
Have a dedicated secondary phone number for incoming calls that only select callers can use to reach you directly, without going through delegates, administrators, or assistants. Calls received to your private line can now be received on either the Teams desktop app or a certified phone device. Configure private lines with PowerShell, and easily distinguish the call with a unique notification. Learn more.

Updated People app on Teams phone devices
Manage your contacts more easily and quickly on Teams phone devices with the People app. This update allows you to seamlessly switch between different contact lists and create contact groups. Learn more.

Detailed call history on Teams phone devices
Easily keep track of your calls and see how they are handled. You can see if a call was ignored, missed, or forwarded, and what type of call it was, with clear labeling for different call types. To access your call history, navigate to the Calls tab on your Teams phone device. Learn more.

Call transfer improvements on Teams phone devices
Transfer calls more easily and efficiently. You can access your speed dials during transfer, avoid keyboard overlap on touch phones, and use hard keys on non-touch phones to complete the transfer. Learn more.

Move ongoing calls from the Teams app to the native dialer on your mobile device

Teams Phone Mobile enables you to have a single number as your Teams number and mobile number for flexible, reliable, and secure calling, across locations and devices. As a Teams Phone Mobile user, you can now effortlessly switch an active call from the Teams app to your mobile device’s native dialer, ensuring a smooth and uninterrupted call experience.

​Microsoft Tech Community – Latest Blogs –Read More 

Hi,

I need 3 connected variables which I need to use in my databricks notebook. 

This is the context of the variables that I need:

filepath: root/sid=test1/foldername=folder1/

sid: path identifier, this is needed so only correct files in the folder will be loaded

foldername: every “sid” may have multiple folder so I need to identify the foldername. I will also use this to partition my data for duplicates

tablename: this is the target table where I need to load the files

Basically, the two variables are predefined which is stored in a csv file.

sidtablenametest1test1_tbltest2test2_tbl

My source which is in blob storage looks like this:

And this is what I want for my variable

Looking forward to your help.

​Hi, I need 3 connected variables which I need to use in my databricks notebook. This is the context of the variables that I need:filepath: root/sid=test1/foldername=folder1/ sid: path identifier, this is needed so only correct files in the folder will be loadedfoldername: every “sid” may have multiple folder so I need to identify the foldername. I will also use this to partition my data for duplicatestablename: this is the target table where I need to load the files Basically, the two variables are predefined which is stored in a csv file.sidtablenametest1test1_tbltest2test2_tbl My source which is in blob storage looks like this: And this is what I want for my variable Looking forward to your help.  Read More

​