Skip to main content
日本語 简体中文 繁體中文

[Cloud Protection] Reviewing Operational Policies

Overview

  • This explains the items that administrators of Cloud Protection should consider in advance in preparation for responding when a threat is discovered.

Notes

  1. The content of this article is based on the product specifications as of August 2026 and may be subject to change without notice.

Types of Threats That Can Be Detected

Cloud Protection monitors the following threats that may occur on Microsoft 365 in real time and can automatically take action when a threat is detected.

  1. Exchange Online
    ・Files containing malware (viruses, Trojan horses, ransomware, etc.) attached to items (※) on Exchange Online
    ・Malicious URLs on Exchange Online items
    ・Leakage of Microsoft 365 accounts to third parties (account compromise)
    ・Malicious inbox rules
    ※ Microsoft Office 365 user mailbox items such as emails, attachments, and groups
  2. SharePoint
    ・Files containing malware (viruses, Trojan horses, ransomware, etc.) or malicious URLs uploaded to created sites
  3. OneDrive
    ・Uploaded files containing malware (viruses, Trojan horses, ransomware, etc.) or malicious URLs
  4. Teams
    ・Uploaded files containing malware (viruses, Trojan horses, ransomware, etc.) or malicious URLs

※ The file types on SharePoint / OneDrive / Teams for which malicious URLs can be detected are as follows.

  • Microsoft Excel / Microsoft Word / Microsoft PowerPoint / PDF / OpenDocumentPresentation / OpenDocumentSpreadsheet / OpenDocumentText
  • For PDF files, only hyperlinked URLs are Target.

Responding to Threats

When a threat is detected, the following responses are available.

Exchange Online

1. Malware Files Attached to Exchange Online Items+

・Automatically delete the entire Exchange Online item, or only the malware file
・Automatically quarantine the entire Exchange Online item, or only the malware file
・Take no particular action

Description:
If you choose to delete, the Exchange Online item or malware file cannot be restored and will be completely deleted.
If you choose to quarantine, the Exchange Online item or malware file will be temporarily hidden from Microsoft 365, preventing it from spreading to end user devices.
Files that have been quarantined can be checked by the administrator on the Cloud Protection management screen, and can be restored (released) later.
When a quarantined item is released, the item is restored to its original location and can be viewed and operated by users.
Even after a file has been released once, if it is detected again, it will be quarantined.

2. Malicious URLs on Exchange Online Items+

・Automatically delete the Exchange Online item
・Automatically quarantine the Exchange Online item
・Change the subject line and remove the URL link
・Take no particular action

Description:
If you choose to delete, the Exchange Online item cannot be restored and will be completely deleted.
If you choose to quarantine, the Exchange Online item will be temporarily hidden from Microsoft 365, preventing it from spreading to end user devices.
Items that have been quarantined can be checked by the administrator on the Cloud Protection management screen, and can be restored (released) later.
When a quarantined item is released, the item is restored to its original location and can be viewed and operated by users.

3. Malicious Inbox Rules+

・Detect suspicious rules in inbox rules

Description:
If a suspicious inbox rule is detected, such as one that moves, forwards, or deletes emails, notifications can be sent to the administrator or user.

4. Compromised Accounts+

・Detect whether the connected Microsoft 365 account matches a leaked ID

If a match is detected between the connected Microsoft 365 account and a leaked ID, notifications can be sent to the administrator or user.

5. Notifications+

When each of the above items is detected, you can define the notification destination.
・Email notification to the user
・Email notification to the administrator's email address
・Both of the above 2 items

SharePoint

1. Malware Files Uploaded to SharePoint Sites+

・Automatically quarantine malware files
・Automatically delete malware files
・Take no particular action

Description:
If you select delete, malware files uploaded to the SharePoint site cannot be restored and will be completely deleted.
If you select quarantine, malware files will be temporarily quarantined, which can prevent them from spreading to end user devices.
Files that have been quarantined can be checked by the administrator on the Cloud Protection management screen, and can be restored (released) later.
When a quarantined item is released, the item is restored to its original location and can be viewed and operated by the user.
Furthermore, it will be recorded in Cloud Protection as a safe file from then on, and even if the same file is uploaded again in the future, [Detection] will be performed but [Quarantine] will not be performed. (In Exchange protection, files are quarantined even if they have been released once)
Also, this behavior cannot be reversed (returned to being quarantined again).
※ The quarantine method differs depending on the connection status with Teams.
・Team sites and communication sites not connected to Teams: Malware files will be temporarily hidden from Microsoft 365.
・Team sites connected to Teams: Malware files will be moved to the quarantine area, and the file will be replaced with one that has [HARMFUL_CONTENT_REMOVED] appended.

2. Notifications+

When each of the above items is detected, you can define the notification destination.
・Email notification to the administrator's email address

OneDrive

1. Malware Files Uploaded to OneDrive+

・Automatically quarantine malware files
・Automatically delete malware files
・Take no particular action

Description:
If you select delete, malware files uploaded to OneDrive cannot be restored and will be completely deleted.
If you select quarantine, malware files will be temporarily hidden from Microsoft 365, which can prevent them from spreading to end user devices.
Files that have been quarantined can be checked by the administrator on the Cloud Protection management screen, and can be restored (released) later.
When a quarantined item is released, the item is restored to its original location and can be viewed and operated by the user.
Furthermore, it will be recorded in Cloud Protection as a safe file from then on, and even if the same file is uploaded again in the future, [Detection] will be performed but [Quarantine] will not be performed. (In Exchange protection, files are quarantined even if they have been released once)
Also, this behavior cannot be reversed (returned to being quarantined again).

2. Notifications+

When each of the above items is detected, you can define the notification destination.
・Email notification to the administrator's email address

Teams

1. Malware Files Uploaded to Teams Sites+

・Automatically quarantine malware files
・Automatically delete malware files
・Take no particular action

If you choose deletion, files containing malware uploaded to Teams cannot be restored and are completely deleted.
If you choose quarantine, malware files are temporarily quarantined, preventing them from spreading to end user devices.
※ The behavior during quarantine differs between Teams chat and Teams channels.
・Teams chat: Files remain visible in both the [Chat] tab and [Shared] tab, but the actual file is quarantined.
※ Please note that only PDF files can be previewed in chats with other users.
・Teams channel: Files remain visible in the [Posts] tab, but the actual file is quarantined.
In the [Files] tab, the file name is replaced with one that has [HARMFUL_CONTENT_REMOVED] appended to it, and the file is quarantined.
Administrators can check quarantined files on the Cloud Protection management screen and restore (release) them later.
When a quarantined item is released, the item is restored to its original location and becomes viewable and operable by users.
Furthermore, it is subsequently recorded within Cloud Protection as a safe file, and even if the same file is uploaded again in the future, [Detection] will occur but [Quarantine] will not be performed. (In Exchange protection, files are quarantined even if they have been released once)
This behavior cannot be reversed (returned to being quarantined again).

2. Notifications+

When each of the above items is detected, you can define the notification destination.
・Email notification to the administrator

Points to Consider for Policy Configuration

Cloud Protection allows you to configure policy settings using the following three methods and start operations.

  • Take no action and only configure notifications
  • Protect only some users
  • Start detection / quarantine for all users

※ Please refer to the following for how to create a policy
Creating a New Policy

▼ Take no action and only configure notifications+

Configure the following settings in the policy.

【Configuration Method】

Set the malware scan and URL scan actions as follows.
Action: Do nothing
Reference article: Creating a New Policy

【Details】

With this setting, malware and malicious URLs, etc. are detected, but no actual action is taken.
By checking the detection status, you can confirm the extent to which malware, etc. is detected within your organization.
This allows you to consider the man-hours required for future operations.
You can also notify users as needed.
Since quarantine is not performed, this setting is easy to introduce and is recommended for initial configuration.

▼ Connect only some users+

Specify the Target users to protect for each service.
Reference article: Procedure for Connecting Protected Mailboxes

【Configuration Method】

From Cloud Services, select the target service (Exchange, SharePoint, etc.).
Exchange: Select Customize mailbox protection
SharePoint / OneDrive / Teams: Turn off Automatically protect newly added SharePoint, Teams, and OneDrive assets

【Details】

With this setting, if quarantine or other actions are actually defined in the policy, you can roll out the behavior when quarantined and the notification behavior to only some users.
By narrowing down the Target, you can consider the timing for creating manuals and informing users in line with production operations before full-scale rollout.
Please verify the actions that can be defined in various policies and start operations in stages.

▼ Start applying to all users+

You can immediately roll this out company-wide and begin operation.
Please note that if quarantine processing is applied by policy, users' emails will be quarantined, so caution is required when starting operation.

[Configuration Method]

From Cloud Services, select the target service (Exchange, SharePoint, etc.).
Exchange: Protect all mailboxes
For other services, protect all items.
Reference article: Procedure for Connecting Protected Mailboxes

[Details]

This setting will be applied to all users.
If a quarantine policy has been configured, files will be quarantined.
If there are no concerns, you can immediately begin security measures.

Reference

Response When a Threat Is Detected
How to Check Details of Detected Threats
Checking the Dashboard

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.