MC906488 – Microsoft Defender for Office 365: Microsoft Secure Score recommendation update for Spam confidence level (archived)

Product:

Defender, Defender for Office 365, Defender XDR

Platform:

Online, US Instances, World tenant

Status:

Change type:

Feature update, Admin impact

Links:

Details:

Summary:
The Microsoft Secure Score recommendation for Spam confidence level (SCL) in Microsoft Defender for Office 365 will be updated. Post-update, the recommendation will only trigger if a transport rule explicitly sets SCL to -1. The rollout will start in early November 2024 and complete by early December 2024, potentially increasing the Secure Score for some organizations. No admin action is required before the rollout.

Details:
Before this rollout: Microsoft Defender for Office 365 | Microsoft Secure Score triggers the recommendation Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains in organizations with transport rules that use condition on sender domains even when not explicitly using SetSCL. The intent of the recommendation is to only flag rules that bypass spam filtering by setting SCL to -1.
After this rollout, this recommendation will only appear if the organization has transport rule specifically set SCL to -1. The recommendation will not appear when using rules that do not set SCL (where SCL is null).
[When this will happen:]
General Availability (Worldwide, GCC): We will begin rolling out early November 2024 and expect to complete by early December 2024.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2024-10-08

updated:
2024-10-08

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Change in Spam Confidence Level Recommendations
Post-update, the recommendation for configuring Spam confidence level (SCL) will only trigger if SCL is explicitly set to -1, potentially leading to confusion among users who may not understand why certain recommendations are no longer appearing.
   - roles: IT Administrators, End Users
   - references: https://learn.microsoft.com/defender-xdr/microsoft-secure-score

Impact on Secure Score Metrics
The update may result in a slight increase in the Secure Score for some organizations, which could mislead users into thinking their security posture has improved without any actual changes to their configurations.
   - roles: IT Administrators, Security Analysts
   - references: https://learn.microsoft.com/defender-xdr/microsoft-secure-score

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only