Question

During an incident investigation in Microsoft Defender XDR, you determine that several users received a phishing email containing a URL that was initially rated as clean but was later confirmed malicious after delivery. You need to confirm whether any user actually clicked the link and, if so, block future clicks on that URL organization-wide without waiting for a new email campaign. Which action best meets both requirements?

Accepted Answer

Use the URL clicks / URL page in Threat Explorer to review click verdicts, then add the URL to the Tenant Allow/Block List as a block entry.

Answer

Run a Purview eDiscovery content search for the URL string across all mailboxes and place the results on hold.

Answer

Create a mail flow rule that deletes any message containing the URL and enable zero-hour auto purge (ZAP).

Answer

Isolate the affected devices with Defender for Endpoint live response and collect an investigation package.