MC832512 – Microsoft Defender for Office 365: Updated submission results in ThreatSubmissionAPI (archived)

Product:

Defender, Defender for Office 365, Defender XDR, Exchange, Teams

Platform:

Online, World tenant

Status:

Change type:

Feature update, Admin impact

Links:

Details:

Summary:
The message details updates to Microsoft Defender for Office 365's ThreatSubmissionAPI, enhancing submission results for better clarity and actionability. These updates apply to email, Teams messages, attachments, URLs, and user reports. The API remains in beta, with a global release date to be announced. Rollout starts early August 2024. Users should check their API setup for necessary changes.

Details:
Administrators and security operators have been seeing enhanced results within submissions across email, Microsoft Teams messages, email attachments, URLs, and user-reported messages in security.microsoft.com since May 2024. These updates aim to eliminate any ambiguity associated with the current submission results. The results will be refined to ensure clarity, consistency, and conciseness, making the submission results more actionable for you.

We are bringing these updates to ThreatSubmissionAPI, so these enhanced result details are available, regardless of where they are reviewed.
For more information, see the submissionResult resource type documentation.
The API will remain in beta, and we'll announce a Global Availability date separately.
[When this will happen:]
Standard Release (Worldwide): We will begin rolling out early August 2024 and expect to complete by late August 2024.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-07-24

updated:
2024-07-24

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Direct effects for Operations**

- Direct Impact on IT Operations
- Changes in API behavior may require updates to existing integrations and workflows.
- Roles impacted: IT Administrators, Security Operators
- Potential downtime or performance issues during the rollout period, affecting the availability of security features.
- Roles impacted: IT Operations Team, Help Desk Staff
- Increased monitoring and troubleshooting efforts may be necessary to address any unforeseen issues arising from the update.
- Roles impacted: IT Support Staff, Security Analysts

- Direct Impact on IT Services
- Enhanced submission results may lead to changes in how security incidents are prioritized and managed.
- Roles impacted: Security Operations Center (SOC) Analysts, Incident Response Teams
- The need for updated documentation and training materials for users and administrators to understand the new submission results.
- Roles impacted: IT Trainers, Documentation Specialists
- Dependencies on other services (e.g., Exchange, Teams) may require coordination to ensure compatibility with the updated API.
- Roles impacted: Service Owners, Application Managers

- Direct Impact on IT Users
- Users may experience changes in the way they report threats or view submission results, potentially leading to confusion.
- Roles impacted: End Users, Business Unit Leaders
- Increased reliance on IT support for guidance on the new features and how to utilize them effectively.
- Roles impacted: Help Desk Staff, IT Support Teams
- Possible delays in threat resolution if users are not adequately informed about the changes and how to adapt.
- Roles impacted: All Employees, Department Managers

References:
- Microsoft Documentation on ThreatSubmissionAPI: [Microsoft Graph API](https://learn.microsoft.com/graph/api/resources/security-submissionresult?view=graph-rest-beta)
- Microsoft Security Submission Overview: [Security Microsoft](https://security.microsoft.com/reportsubmission)

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only