Defend Users — Email is the email side of Defend. It lives under Defend → Sense → Phishing (open Phishing).
What you can do
-
Triage phishing your users report. When a user reports a suspicious email to your organisation's Defend phishing-report address (it ends in
@inbound.theonestack.com), Defend creates a phishing report. It appears on Defend → Sense → Phishing with the status Reported so you can review it. - Manage mailbox connections. Connect or disconnect Microsoft 365 on the Mailbox connections card on the same page.
If you don't know your organisation's phishing-report address, contact support.
Mailbox connections
Mailbox connections live only on Defend → Sense → Phishing, not under Defend Settings.
| Platform | How it connects | Article |
|---|---|---|
| Microsoft 365 | Microsoft admin consent; the card shows Connected when done | Connect Microsoft 365 to Defend Phishing |
What Defend Phishing does not do
- It does not scan attachments for malware or check file hashes.
- It is not antivirus for email.