admin.microsoft.com/Adminportal/...

This will speed up a LOT of investigative efforts, I imagine. Awesome stuff to see from MSFT!

EXO ETR to quarantine DirectSend emails (sample, use with care/caution/and lighter handed actions than the picture!

TIL - those times when it says block but the message inboxed is answered right here.

Bravo - Allowing admins to add allows to their allow list. Finally.

Ditching that Felon

Any recommendations aside from this one? Sort of abandoning some media and looking for advice.

Why does MSFT not use DANE?

KQL EmailEvents by country - improved!

EmailEvents
| where geo_info_from_ip_address(SenderIPv4) != ""
| extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4)
| extend country = tostring(parse_json(GeoIPInfo).country)
| project country
| summarize count()by country

Haaaaaaahahaha, who got knocked out? #netflix