The sender section displays the sender's domain and reports whether the sender is in the tenant or cross-org. It also includes the Teams Message ID, which can be used as an indentifer of a Teams message in Microsoft Defender for Office 365.

This is also the location where admins can view the sender address, the time the message was recieved and the detection technology. The message details section contains the threats suspected, confidence level, and the message location. The current verdict of the message can also be found there, as well as a count of URLs present in the message. The header section contains the subject of the message (if there is one) or it displays the first 100 characters of the body of the message. Teams Message Entity Panel WalkthroughĬlicking on a Teams message across any Microsoft Defender for Office 365 experience opens the Teams Message Entity Panel.

For more information, see Permissions in the Microsoft 365 Defender portal. SecOps users must also be a member of Global Admin or Global Reader, or Security Admin or Security Reader. The permissions needed to view and use this page are the same as to view Quarantine and Submissions. The Teams Message Entity Panel for that message will open.

Select the subject of an email you're investigating.

Or, to go directly to the Quarantine page, use this link.

Select Email & collaboration > Quarantine.

Navigate to the Microsoft 365 Defender portal.

The steps to use the Teams Message Entity Panel remain the same wherever you find Teams message details. The Teams Message Entity Panel will be available for customers with E5 and P2 subscriptions across all experiences, including: Using the Teams Message Entity Panel in Microsoft Defender for Office 365 In other words, any threat coming from:Ĭan be seen and reviewed in one place. The Teams Message Entity Panel is the single source of Teams message metadata for Security Operations team (SecOps) review. The Teams Message Entity Panel in Microsoft Defender for Office 365 puts all Microsoft Teams data about suspicious or malicious chats and channels on a single, actionable panel.

Microsoft Defender for Office 365 plan 2.

Microsoft makes no warranties, express or implied, with respect to the information provided here.

Some information in this article relates to prereleased product which may be substantially modified before it's commercially released.

Microsoft teams how does it work