ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
MC971037 Plan for changeMajor changeUpdated messageUser impactAdmin impactRetirement

Exposure Management Recommendations Retirement

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Defender XDR
Message Center archive Open in your tenant

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions we saw
  • Seen 28 Mar 2025 mid-March 2025 → mid-April 2025

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated March 27, 2025: We have updated the rollout timeline below. Thank you for your patience.

We will be retiring certain SaaS security posture management (SSPM) recommendations from Exposure Management in the Defender portal. This update is to help ensure a more accurate representation of security posture.

When this will happen

This will begin rollout in mid-February 2025 and is expected to be complete by mid-April 2025 (previously mid-March).

How this will affect your organization

You are receiving this message because our reporting indicates your organization may be using this feature.

As part of our efforts to keep recommendations updated and relevant, we will be retiring the following recommendations due to either low security value or change of settings in the applications.

Recommendations names:

  • AAD: Ensure that collaboration invitations are sent to allowed domains only
  • EXO: Ensure notifications for internal users sending malware is enabled
  • EXO: Audit Exchange online Organization Sharing
  • Defender for Office: Ensure that DKIM is enabled for all Exchange Online Domains
  • Purview: Ensure external domains are not allowed in Skype or Teams
  • SPO: Guests must sign in using the same account to which sharing invitations are sent
  • Intune: Ensure devices lock after a period of inactivity to prevent unauthorized access
  • Intune: Ensure mobile device management policies are required for email profiles - iOS/iPadOS only
  • Intune: Ensure mobile device management policies are set to require advanced security configurations
  • Intune: Ensure mobile devices are set to wipe on multiple sign-in failures to prevent brute force compromise
  • Intune: Ensure mobile devices require the use of a password
  • Intune: Ensure that devices connecting have AV and a local firewall enabled
  • Intune: Ensure that mobile device encryption is enabled to prevent unauthorized access to mobile data
  • Intune: Ensure that mobile device password reuse is prohibited
  • Intune: Ensure that mobile devices are set to never expire passwords
  • Intune: Ensure that mobile devices require a minimum password length to prevent brute force attacks
  • Intune: Ensure that mobile devices require complex passwords (Simple Passwords = Blocked)
  • Intune: Ensure that mobile devices require complex passwords (Type = Alphanumeric)
  • Intune: Ensure that users cannot connect from devices that are jail broken or rooted
  • Defender for Cloud Apps: Create an OAuth app policy to notify you about new OAuth applications
  • Defender for Cloud Apps: Create an app discovery policy to identify new and trending cloud apps in your org
  • Defender for Cloud Apps: Create a custom activity policy to get alerts about suspicious usage patterns

What you need to do to prepare

There's no action needed to prepare for this change. Your score will be updated accordingly.

What changed

Between archive captures, newest first

  1. Updated January 9,March 27, 2025: We have updated the content.rollout timeline below. Thank you for your patience. We will be retiring certain SaaS security … begin rollout in mid-February 2025 and is expected to be complete by mid-March 2025.mid-April 2025 (previously mid-March). How this will affect your organization: You are receiving this message because …

    • Tags User impact, Admin impact, Retirement → Updated message, User impact, Admin impact, Retirement

    Updated January 9, 2025: We have updated the content. Thank you for your patience. We will be retiring certain SaaS security posture management (SSPM) recommendations from Exposure … low security value or change of settings in the applications. Recommendations names: AAD: Ensure that collaboration invitations are sent to allowed domains only EXO: Ensure notifications for internal users sending malware is enabled EXO: Audit Exchange online Organization Sharing Enable strong password policies Enable Dropbox Multi-Factor Authentication (MFA) Enable Single Sing On (SSO) Enable session timeout Defender for web users Enable strong password policies Enable multi-factor authentication (MFA) Enable Single Sing On (SSO) with SAML Enable Password expiration policies Enable strong password policies Enable session timeout for web users Enable session timeout for web users Enable and adopt two-factor authentication (2FA) Office: Ensure that DKIM is enabled for all Exchange Online Domains Purview: Ensure external domains are not allowed in Skype or Teams SPO: Guests must sign in using the same account to which sharing invitations are sent Intune: Ensure devices lock after a period of inactivity to prevent unauthorized access Intune: Ensure mobile device management policies are required for email profiles - iOS/iPadOS only Intune: Ensure mobile device management policies are set to require advanced security configurations Intune: Ensure mobile devices are set to wipe on multiple sign-in failures to prevent brute force compromise Intune: Ensure mobile devices require the use of a password Intune: Ensure that devices connecting have AV and a local firewall enabled Intune: Ensure that mobile device encryption is enabled to prevent unauthorized access to mobile data Intune: Ensure that mobile device password reuse is prohibited Intune: Ensure that mobile devices are set to never expire passwords Intune: Ensure that mobile devices require a minimum password length to prevent brute force attacks Intune: Ensure that mobile devices require complex passwords (Simple Passwords = Blocked) Intune: Ensure that mobile devices require complex passwords (Type = Alphanumeric) Intune: Ensure that users cannot connect from devices that are jail broken or rooted Defender for Cloud Apps: Create an OAuth app policy to notify you about new OAuth applications Defender for Cloud Apps: Create an app discovery policy to identify new and trending cloud apps in your org Defender for Cloud Apps: Create a custom activity policy to get alerts about suspicious usage patterns …

  3. · first version seen

No related announcements were found in the saved public history. Check the source for newer announcements.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 03:49 UTC · 252 of 275 readable · 247 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.