(Updated) Microsoft Defender for Office 365: Enhancing how we handle promotional mail

🚨 The Signal: Microsoft Defender for Office 365 will now tag promotional emails as 'promotion' and automatically move them to a new Promotions folder. This aims to reduce inbox clutter, but requires security teams to validate mail flow rules and user training.

The Impact

All organizations using Defender for Office 365 are affected; the security risk is low but requires validation of mail flow and user awareness.

• Security Teams: Risk of legitimate emails being misclassified, requiring mail flow rule review.
• End Users: Risk of missing desired promotional content if not trained on the new folder.
• Admins: Risk of increased support tickets if users are confused by the new mail handling.
• Compliance Teams: Risk of non-compliance if email retention or discovery policies are not reviewed for the new folder.

The Action

1. Review existing mail flow rules and transport rules in Exchange Online to ensure compatibility with the new 'promotion' tag.
2. Communicate to end-users about the new 'Promotions' folder and how to manage its contents.
3. Monitor user feedback and mail flow logs for misclassified legitimate emails.
4. Update security awareness training to include guidance on managing promotional emails and the new folder.
5. Assess the impact on eDiscovery and retention policies for the new 'Promotions' folder.

Domain: Defender · Impact: low · Workload: Microsoft Defender