Yes, CAS DLP scans the file properties and attributes. It will help prevent leaking data, especially the PII from the file sharing. If customers don't want such data to be scanned by CAS, they may either exclude such files from DLP scanning or adjust DLP scanning templates to disable triggering such confidential data.

Yes. You can find it by querying log with Type set to Virtual Analyzer. The trigger is when there is a risk in sandbox detected and not via engine/pattern/Machine Learning.

^{Click the image to enlarge.}

Below is an example of how the report would look like:

^{Click the image to enlarge.}

Please enable Retro Scan & Auto Remediate option in Web Reputation, as shown below:

^{Click the image to enlarge.}

The feature collects email metadata through the Threat Investigation API, and retroactively scans the past 3 day's URLs using newer web reputation patterns every 2 hours. Based on the latest scan result, CAS automatically takes remedial action on the affected email messages. Please refer to Web Reputation Services for more information.

For safe sites, the cache TTL is 24 hours.

For malicious sites, the cache TTL is 35 minutes.

The results of re-written URLs and shorten URLs are not cached.

CAS implements this features NOT just based on display name consistency, but goes through the following process:

• First, CAS checks if a mail has an external sender address but has a display name the same as a name in the company. For example: "CEO display name"<attacker@attackers.domain>.
• If the above rule is matched, CAS sends the mail to TMASE engine to check other mail attributes like headers and bodies for other suspicious indicators.
• CAS then takes action based on the final result.

Yes. Writing Style Analysis is also supported for Gmail.

Yes. Office365 dynamic groups also have Object ID which can be fetched via Graph API request, therefore CAS can support Office 365 dynamic groups. Dynamic groups can be seen in Azure AD, O365 Admin Center and Exchange Admin Center, CAS can synchronize them properly.

No. CAS utilizes Microsoft API to retrieve email from users' mailbox, so it works not in transport level but in mailbox level.

For more information, refer to Understanding how Cloud App Security works.

No. The limit on the number is the result of a balance choice between scan performance & scan capability.

On the other hand, the Display Name Spoofing Detection applies to all users.

CAS doesn't have “in the cloud” quarantine. For spam mails, CAS by default moves them to Outlook spam folder. So end users can review and handle all spam mails by accessing Outlook spam folder. On the other hand, for malicious mails, CAS implement quarantine action by moving them to a hidden folder in Exchange online. The quarantined malicious mails must be controlled by the CAS admins to prevent malware leak.

No. The limit is put to protect CAS system from being overloaded. But you can select different 31 days’ time range for manual scan, not necessarily the latest 31 days

^{Click the image to enlarge.}

The Blocked Lists for Exchange Online specify the blocked senders, URLs, and SHA-1 hash values for your organization through the Threat Remediation API. Email messages that match any item in the lists will be automatically quarantined by Cloud App Security.

For more information, refer to Viewing Blocked Lists for Exchange Online.

The maximum number is 1024.

^{Click the image to enlarge.}

Writing Style is a subset of the overall BEC detection. An incoming email message that hits the writing style analysis criteria is subject to Action setting under Writing Style, regardless of the setting for BEC in Action. For more details, refer to Advanced Spam Protection.

CAS Computer Vision supports Amazon, Apple, Box, Dropbox, Facebook, Google, HSBC, Linkedin, Microsoft, OneDrive, Paypal, and Rakuten.

With token provision, the required account for provision needs to be a global admin. But once provisioned, CAS will use token to communicate with M365, so CAS capability will not be impacted even if the global admin account used for provisioning were deleted or its password were changed.

The required permission for CAS are listed as below:

When multiple ATP policies apply to the same user, the policy on the top will take effect. 

If the policy was copied from an existing Monitor Only policy, e.g. "Default Exchange Online Policy ATP (Monitor Only)", it will also be Monitor Only, so the actions are also not changeable.

To verify it, please try to create a new one by copying Default Exchange Policy ATP policy.

It is a limitation of Microsoft API. Office365 will not send a notification for an outgoing mail to CAS until the mail was sent and put into Sent folder. Therefore, when CAS retrieve the mail for scan, it has been already sent out and there is no chance for CAS to intercept it.

Refer to the following links for more information regarding the Microsoft Notification Subscription feature:

• Notification subscriptions, mailbox events, and EWS in Exchange
• Use the Microsoft Graph API to get change notifications

Adding disclaimer to all mails would consume too many API calls and trigger the API usage limit very quickly. So even we add the feature to CAS, it won't work properly due to the API usage limit.

In addition, for outgoing mails, the mails are delivered before CAS can scan them, so there is no way for CAS to add disclaimer to outgoing mails.

^{Click the image to enlarge.}

The items shown under Scan Source are dynamic and comes from the existing detection logs. If there is no detection on certain application, say SharePoint, it will not show under Scan Source. This is the same on other sections like Security Filter. It will show up once CAS get detections on the application.

The one-time click URLs in the Mimecast notification mails were accessed/"clicked" by CAS WRS T0 or Computer Vision feature.

To resolve the issue, please find the pattern of the URL and then add the URL with wildcard to approved URL list.

^{Click the image to enlarge.}

When "Apply to" option is set to "Incoming messages" in Malware Scanning rules, the "Apply to" option in Virtual Analyzer rules will be greyed out.

Virtual Analyzer analysis is dependent on Malware scanning results, so the Virtual Analyzer policy is also dependent on Malware Scanning policy.

When running a manual scan, CAS hooks every email from the target mailboxes via API then scans it. The large volume of scanning will result in massive API calls so it could easily trigger throttling at Microsoft side. Another reason is to balance the resource & cost in the cloud. The huge volume of full scanning, obviously, could eat up the reserved resources of CPU, Memory as well as network bandwidth.

Read more about Microsoft Graph throttling guidance.

On the other hand, the 31-day limit doesn't mean you can only scan the past 31 days mails, but you scan specify any 31 days period. So you may scan more than 31 days mails by doing manual scan multiple times.

Confirm if you have granted Cloud App Security permissions to receive notifications from Microsoft, upon any change to the files on your SharePoint online, OneDrive and Microsoft Teams.

Refer to page 17-18 of the Best Practice Guide.

The reason why Spam Detection by Category does not show the ransomware detection could be that the email (the ransomware) was detected by Malware Scanning instead of Advanced Spam Protection. And if you would like to verify if Advanced Spam Protection can detect the ransomware, you may need to disable Malware Scanning while enabling Advanced Spam Protection. If the email gets detected by Malware Scanning, it won’t be scanned by Advanced Spam Protection.

Here is the scan flow in CAS for reference: File Blocking -> Malware Scanning -> Web Reputation -> Anti-Spam -> BEC/Writing Style DNA -> DLP -> Sandbox.

No. CAS just uses Microsoft Graph API to do actions for detected mails, such as “move mail from inbox to quarantine folder”, but will NOT remove any Microsoft365 or Office365 log.

Yes. CAS is an auto-scalable SaaS solution. CAS is protecting some customers with 1 million+ users today. So 300,000 size would still be supported.

Yes, all mails under the same user will be scanned by CAS because CAS retrieves user information under a tenant, rather than domains.

The action will be taken based on the following priority:
Delete > Quarantine > Move to Junk Email folder > Replace > Tag subject > Pass

For example, when a mail is detected as both Phishing and Other spam (Phishing-Other spam), the final action will be Quarantine. This follows the priority shown above, because the default action for Phishing is quarantine, while the default action for Other spam is Move to Junk Email folder.

After a policy is created or modified, policy match needs to be re-calculated. The time of the re-calculation depends on the policy target setting. For example, if the policy target contains many groups, the re-calculation time could take several minutes.

Usually the time should be within minutes. Therefore, we suggest to do the test and verification 10 minutes after the policy is created or modified.

For the same service (e.g. Exchange), when a user matches multiple policies, only the policy with highest priority will be applied.