Monitoring and remediating with Microsoft Defender for Office 365 reports

With Microsoft Defender for Office 365, you can access a selection of security-related reports. To view and use these reports, you need to be a member of one of the following role groups:

• Organization Management
• Security Administrator
• Security Reader
• Global Reader

You can then view and download the reports from the Microsoft 365 Defender portal as follows:

1. Go to https://security.microsoft.com and navigate to Reports | Email & collaboration | Email & collaboration reports or access it directly via https://security.microsoft.com/emailandcollabreport:

Figure 8.28: Email & collaboration reports

2. Click on View details to view any report, as per the example of the Mailflow status summary report that follows:

Figure 8.29: Mailflow status report

From here, you can export the details to a .csv file...