This article outlines the new configuration options and user features introduced to enable the post-delivery teachable moments flow. It also details the steps for existing customers to migrate to these new settings.

Post Delivery Settings 

The post-delivery settings page is divided into the following sections:

• Teachable moments 
• Dangerous emails 
• Suspicious emails 
• Threat tags
• Auto remediation 
• Email productivity 

Teachable Moments and Threat Tags

This section covers controls for teachable moment emails and Microsoft Outlook threat tags for different categories of emails.

Dangerous and Suspicious Emails 

The configuration options for dangerous and suspicious emails include:

• Teachable Moment Email: Controls whether a teachable moment email should be sent when Defend analyzes an email as dangerous or suspicious. The options for this setting are Enabled or Disabled.
• Threat Tag: Controls whether a Microsoft Outlook category tag is added to an email if analysis detects a potentially dangerous or suspicious email. The options for this setting are Enabled or Disabled.
  • For dangerous emails, a Dangerous tag is displayed. 
  • For suspicious emails, a Suspicious tag is displayed. 
• Phishing Simulation Tests: Controls how Defend classifies emails it identifies as phishing simulation tests. The options for this setting are Disabled (default), Benign, Suspicious, and Dangerous.
   

Threat Tags

Control which threat tags are added to emails when Defend detects an email that is categorized as a threat. The following threat tags are available:

• External (SMTP only)
• First Time Sender
• Financial
• Sensitive
• Impersonation 

For these tags, you can select one of the following delivery options:

• Disabled: Defend doesn't add the tag to any emails.
• Always Send: Defend adds the tag to every email that matches the tag's criteria, regardless of the email's threat verdict.
• Send Only if Suspicious: Defend adds the tag only to emails that Defend also assesses as Suspicious or Dangerous.
   

Phishing Simulation Tests

This setting doesn't change how Defend detects phishing simulation tests. It only changes how a detected test is classified.
Choose how Defend classifies phishing simulation emails:

• Disabled (default): Defend classifies the email as it normally would.
• Benign: Applies external-level banners and actions to the email. 
• Suspicious: Applies suspicious-level banners and actions to the email.
• Dangerous: Applies dangerous-level banners and actions to the email.

Auto Remediation

Auto remediation controls what happens to an email when Defend analyzes and classifies the email as dangerous or suspicious. The following options are available for dangerous and suspicious auto remediation:

• Select Disabled
• Move to the _Suspicious folder
• Move to the Junk folder
• Move to the Deleted Items folder
• Move to the Recoverable Deleted Items folder
• Move to the Recoverable Purges folder
• Send to Microsoft Set Verdict API with a verdict of “Phish”
• Send to Microsoft Set Verdict API with a verdict of “High Confidence Phish”

Email Productivity

Email productivity controls are comprised of graymail and spam management. Email productivity settings allow admins to control the level of disturbance users receive from graymail or spam emails. 

Folder-Move Preferences

When Productivity is enabled, users can register their graymail and spam preferences by moving emails between folders in Microsoft Outlook without visiting the Email Summary page.

Folder-move preferences are registered below:

Preferences are applied at the sender level and are treated the same as preferences set via the Email Summary page or the Phish Alert Button (PAB). Registering a graymail preference for a sender clears any existing spam preference for that sender, and registering a spam preference clears any existing graymail preference.

Graymail

Graymail refers to non-malicious bulk emails sent from legitimate sources. Examples of graymail include newsletters, announcements, or advertisements that users may have previously opted in for. Defend can detect and action graymail with the following functionality:

• Adding a graymail threat tag
• Moving mail to a _Graymail folder

Spam Management 

Spam is unsolicited bulk email, also known as junk email. It's any kind of unwanted and unsolicited digital communication that gets sent out in bulk. Spam is usually sent for commercial purposes and can be dangerous when it contains malicious links or attachments. Defend can detect and action spam emails with the following functionality:

• Adding a spam threat tag
• Moving mail classified as spam to the Junk folder

Abuse Mailbox 

Defend will monitor your organization’s specified abuse mailbox to identify reports from users and automatically remediate malicious and persistent phishing threats. Event notifications can also be configured to notify admins when specific actions have occurred regarding the abuse mailbox, as well as provide a feedback loop to users, ensuring they understand they are helping keep your organization secure.

The following options can be configured for the abuse mailbox:

• Create an Abuse mailbox address
• Select whether emails classified as dangerous after reanalysis are automatically remediated
• Select which status notifications are sent to users
• Specify the email signature to be displayed at the bottom of the user notification emails

Operation Mode Settings

These settings define the configuration scope and determine which user mailboxes are protected by Defend for phishing analysis and user security features.

Scanning Scope

This setting determines which mailboxes are monitored post-delivery via the Microsoft Graph API. The available options are as follows:

• Disabled: Post delivery scanning is deactivated for all users. 
• Microsoft Group: Microsoft Post delivery scanning is restricted to members of a specific Microsoft 365 group. 
• Entire Tenancy: Post-delivery scanning is enabled for all licensed users across your organization 

Group Email Address

This setting is only visible when Scanning Scope is set to Microsoft Group. Enter the email address of the target Microsoft 365 group that will have post-delivery scanning enabled.

User Experience 

This section outlines all the new user-facing features added as part of the post-delivery teachable moments flow.

Outlook Category Tags

Defend supports multiple new post-delivery configuration options to control the application of Microsoft Outlook category tags to emails.

These provide a quick way to identify the Defend classification of an email before it is even opened by a user. Category tags can also be clicked to view all emails that have been categorized in the same category.

The following categories are available: 

• First-time sender
• Dangerous
• Suspicious
• Impersonation
• Financial
• Sensitive
• Graymail
• Spam

Example category tags are shown in the screenshot below. 

Threat Notification

Defend can send threat notification emails to help your users recognize phishing attempts. These emails arrive after Defend identifies an email as suspicious or dangerous. Threat Notifications replace the original suspicious or dangerous email with information about what Defend detected.

Threat notification emails contain the following information and options: 

• Original email details
  • Subject
  • From address
  • Sent time
  • Sender location
  • Sender relationship history
• Email Analysis Summary
  • Details up to five reasons why Defend thought the email could be a phishing attack
• Report buttons
  • Report the original email as “Phish”. This is only available for emails identified as suspicious
  • Report the original email as “Not Phish”

An example threat notification email is shown in the screenshot below.