Question

A SOC analyst is investigating a Microsoft Defender XDR incident triggered by Defender for Office 365. A phishing email with a malicious link was delivered to 40 users' inboxes 30 minutes ago. The verdict has since been updated to malicious, but the messages are still sitting in users' mailboxes. The analyst needs to remove the delivered messages from all affected mailboxes with the least manual effort while preserving a copy for later investigation. Which action should the analyst take?

Accepted Answer

Run a soft delete on the messages using Threat Explorer's remediation (Take action), which moves them to Deleted Items where they remain recoverable

Answer

Create a mail flow (transport) rule that blocks the sender domain so future messages are rejected

Answer

Instruct each of the 40 users to manually delete the email and empty their Deleted Items folder

Answer

Add the URL to the Tenant Allow/Block List and wait for zero-hour auto purge (ZAP) to reprocess older messages