These reports are intended to highlight information regarding overall mail flow, including detected threats and mitigated risks (such as risky URLs identified and blocked by Defender for Office 365, spoof detections, and malware detections):
• Email & collaboration reports: This option is actually a dashboard featuring a set of data cards, each displaying an overview graph of a different mail-related report. The dashboard widgets link to the Mailflow status summary, Threat protection status, Post-delivery activities, URL protection, Top malware, Spoof detections, Compromised users, Mail latency, User reported messages, Submissions, and Top senders and recipients reports, see Figure 7.28:
Figure 7.28 – Viewing the Email & collaboration reports dashboard
Exam Tip
If you’ve started a trial tenant as part of your exam study process, you should take time to examine each of the reports. While they may not show a lot of actual data in your trial scenario, it’s good to get a feel for how the data cards take you through the various reports of the Microsoft 365 Defender portal. The reports linked on this page are all in the Microsoft 365 Defender portal, but they aren’t easy to find outside of the Email & collaboration reports dashboard.
If you have access to a Microsoft 365 tenant with a lot of traffic, it may be worthwhile to see some of these reports with more data (possibly by viewing under the supervision of a SOC analyst) explaining that you are studying for the MS-102 exam), as long as you’re staying within your organization’s security policy.
For more information on each of the reports presented, you can learn more at https:// learn.microsoft.com/en-us/microsoft-365/security/office-365-security/reports-defender-for-office-365.
Many of the reports linked through the various cards on this page can be scheduled by clicking the Create schedule button on the details page, as shown in Figure 7.29:
Figure 7.29 – Creating a scheduled Mailflow status report
Clicking on Create schedule will initiate a wizard where you can choose the frequency, start and end dates, and recipients for scheduled reports.
• Manage schedules: On this page, you can manage the schedules for reports that you have configured.
• Reports for download: This page features reports that are available to download – namely, mail reports that are generated from the legacy Exchange admin center reporting console.
• Exchange mail flow reports: This is a link to theMail flow reports section of the Exchange admin center, as shown in Figure 7.30:
Figure 7.30 – Viewing the Mailflow reports in the Exchange admin center
When working with the reports on this page, you generally have two options – download the dataset that is displayed to a CSV by clicking Export, or use the request report to specify a custom report to be generated and delivered, see Figure 7.31:
Figure 7.31 – Requesting a custom report
After specifying the details for the report, a copy will be sent to the recipient listed, and it will also be available on the Reports for download page of the Microsoft 365 Defender portal.
Leave a Reply