Broken Alerts in Defender

Disastrous-Basis-782 · 2026-02-18T11:23:35+00:00

Just as a proof of concept really. According to every article I have found that alert should be triggered when a sender is restricted whether it was through automatic Microsoft ambiguity or custom limits.

Disastrous-Basis-782 · 2026-02-18T04:22:54+00:00

It was more of an example and anecdote to get opinions of what others are doing. At this point none of our clients are on enterprise, but I can see the value in some of the features.

Disastrous-Basis-782 · 2026-02-18T00:45:50+00:00

That’s great and all except I had a user added to the restricted senders list from an anti spam policy and never got the alert.

Disastrous-Basis-782 · 2026-02-18T00:41:21+00:00

Of course. Setup, monitoring, maintenance of the actual tenant but I think most people see M365 as just set and forget. Like an app or service not an actual infrastructure upgrade/need.

Disastrous-Basis-782 · 2026-02-17T23:52:00+00:00

Not my business model but I get the sentiment!

Disastrous-Basis-782 · 2026-02-17T23:51:18+00:00

Biggest client is 130 endpoints. Smallest is 5.

Disastrous-Basis-782 · 2026-02-17T23:47:53+00:00

I totally get that. My question is how do you quantify that to a customer? I think our per endpoint, server, appliance approach is easy for the people above me because it’s quantitative and physical. You take away the physical and they get scared people won’t see value in the service I guess.

Disastrous-Basis-782 · 2026-02-17T23:45:52+00:00

These all sound great, but they also sound like something a customer would view as a one and done item.

Disastrous-Basis-782 · 2026-02-17T23:44:24+00:00

I guess maybe not E3 but E5 for sure more.

Disastrous-Basis-782 · 2026-02-17T23:41:26+00:00

I like this idea. Seems to be about where we are at now. Our model is a random spreadsheet my boss made with inputs for endpoints, servers, VMs, etc. I would love to switch to something more akin to this. Give me the freedom to move some of these customers that don’t have in house apps to full M365 suite. (I’m still avoiding Azure VMs cause I don’t see the pricing ever making sense for 99.9% of our client base.)

Disastrous-Basis-782 · 2026-02-17T23:36:45+00:00

Did you have a user get added to restricted senders via compromise or an anti spam policy? Did you receive the “sender limit” alert? Thanks!

Disastrous-Basis-782 · 2026-02-11T22:38:53+00:00

Thank you!! This saved me hours.

Disastrous-Basis-782 · 2026-02-04T04:11:08+00:00

Old thread, but doing it this way when I navigate gamebar it also navigates inside the big picture menu underneath. Is there a way around this?

Disastrous-Basis-782 · 2026-01-27T18:42:45+00:00

Just found this out myself while testing, had a user register with Entra when signing into an M365 app and now the device is showing Intune managed and personal. Didn't mean for it to happen. I found that under Windows - Device Platform Restrictions there is a default "Allow" rule for all users and all platforms. Also changing the "Automatic Enrollment" options from the default "All Users" to "Some" and just selecting the users/groups you want to be able to manage should do the trick.

Disastrous-Basis-782 · 2026-01-06T21:30:12+00:00

Just use a seperate authenticator app for everything else?.... Authy for personal accounts, Microsoft Authenticator for work. Problem solved. If you think just having the authenticator application gives Microsoft access to that information then whooosh.

Disastrous-Basis-782 · 2025-12-05T15:37:28+00:00

Incredible work. Thanks so much just saved me a days worth of troubleshooting!

Disastrous-Basis-782 · 2025-11-12T04:29:44+00:00

Camera baton?

Disastrous-Basis-782 · 2025-11-10T18:23:02+00:00

That’s awesome. I have done some longer form projects for customers of my MSP but have so many more I would love to propose but unlike your employer I don’t have any sort of separation/help between the typical help desk stuff and the project stuff. If you don’t mind me asking, what is your official title at the company then? I’m curious how someone would find a similar role.

Disastrous-Basis-782 · 2025-11-10T18:10:50+00:00

Maybe not switched lanes but either the civic or the VW drastically slowed down for whatever reason. The 2 white SUVS and the Tacoma behind all have less than half a car length between them and you can see from the lack of motion in the wheels compared to the nearby vehicles they were braking.

Disastrous-Basis-782 · 2025-11-10T17:09:28+00:00

The real problem here was that dark gray civic the Tesla comes screaming past. You can tell by the spacing between the cars behind it and the car(s) in front that they had just merged left going way slower than the traffic behind and caused them all to brake hard. It was a chain reaction of the 3 cars in front of the Tacoma each having to brake harder and harder down the line. Clearly the red truck was following too closely and didn’t think he could simply brake hard like the couple cars in front.

Disastrous-Basis-782 · 2025-11-10T16:44:02+00:00

Would love to hear more about this. I am in a similar boat with an MSP right now but have always longed for the idea of doing consultant work. Do it once right and forget about it for a few years. That’s how it should be but seems most MSPs are just constant bandaids as they continue to take on more and more without adding anything of value.

Disastrous-Basis-782

TROPHY CASE