MC1098943 – Microsoft Defender for Office 365: AI-powered submissions response for improved result explainability (archived)

Product:

Defender, Defender for Office 365, Defender XDR, Teams

Platform:

Online, Web, World tenant

Status:

Launched

Change type:

New feature, User impact, Admin impact

Links:

488098

Details:

Summary:
Microsoft Defender for Office 365 is introducing AI-powered explanations for email submission results, enhancing clarity on why messages are classified as spam, phishing, or clean. This feature will roll out globally from late June to mid-July 2025 and is available by default. No admin action is required.

Details:
We're introducing a new AI-powered capability in Microsoft Defender for Office 365 that enhances the explainability of email submission results. This feature uses large language models (LLMs) to generate clear, human-readable rationales for why a submitted message was classified as spam, phishing, or clean.
This message is associated with Microsoft 365 Roadmap ID 488098.
[When this will happen:]
General Availability (Worldwide): We will begin rolling out late June 2025 and expect to complete by mid-July 2025.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2025-06-20

updated:
2025-06-20

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

AI-Powered Explanations for Email Classifications
Users may experience confusion or frustration if they are not aware of the new AI-generated explanations for email classifications, leading to potential misinterpretation of spam and phishing alerts.
   - roles: End Users, IT Support Staff
   - references: https://learn.microsoft.com/defender-office-365/submissions-result-definitions" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/defender-office-365/submissions-result-definitions, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=488098

Changes in Submission Workflows
Without preparation, users may not utilize the new AI explanations effectively, resulting in inefficient handling of email submissions and potential delays in addressing security threats.
   - roles: End Users, Security Analysts
   - references: https://security.microsoft.com/reportsubmission, https://learn.microsoft.com/defender-office-365/submissions-result-definitions" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/defender-office-365/submissions-result-definitions

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft Defender for Office 365 is enhancing its email security features by introducing AI-powered explanations for why emails are classified as spam, phishing, or clean. Imagine you have a smart assistant that helps you sort your mail. Sometimes, you might wonder why a particular letter was put in the junk pile or marked as important. Now, this assistant can give you a clear, understandable reason for each decision it makes, thanks to advanced technology.

This new feature uses large language models, a type of artificial intelligence, to provide explanations that are easy to understand. It's like having a knowledgeable friend who can explain why a certain email was flagged as suspicious or why another was deemed safe. This helps users and administrators better understand the decisions made by the system, making it easier to trust and manage email security.

The rollout of this feature will happen automatically between late June and mid-July 2025, and it doesn't require any action from administrators. The explanations will be available for email submissions in the Microsoft Defender portal, but not yet for other types of content like files or messages in Teams.

For those who manage email security, this means you can now see not just the outcome of an email analysis but also the reasoning behind it. It's similar to getting a detailed report from a detective who explains how they solved a case, providing insights into the clues and evidence that led to their conclusion.

Overall, this update aims to make email security more transparent and understandable, allowing users to feel more confident in the system's ability to protect them from threats.