Published Jul 19, 2024
Four legacy override alerts in Microsoft Defender for Office 365 will be retired in September 2024 due to redundancy from the Secure by default feature. Affected users with specific subscriptions will not need to take any action as this change will occur automatically.
Updated August 28, 2024: We have updated the rollout timeline and content below. Thank you for your patience.
Microsoft Defender for Office 365 is retiring four legacy override alerts that are now mostly redundant due to Secure by default. With Secure by default, ZAP (zero-hour auto purge) blocks high confidence phishing emails by default despite the legacy overrides. The four alerts are:
As part of the deprecation and rollout,
When is the change?
We plan to turn off these alerts starting August 18, 2024 and ending September 15, 2024.
Who is impacted?
What should I do if I am impacted?
This change will happen automatically by the specified date. No admin action is required. Since these alerts are mostly redundant, we do not expect any impact. Defender XDR Customers using Defender for O365 as a secondary filter (MX record pointed to 3rd party service) and still want the alerts can create a custom detection rule on EmailEvents table with filters on OrgLevelAction & OrgLevelPolicy.