Two MDO field reports every IT security lead should read

This post summarizes two field reports on Microsoft Defender for Office (Explorer and Quarantine), calling out operational transparency failures—limited query operators and odd Unicode matching in Explorer, opaque quarantine workflows, hidden RBAC menus, 30-day log/quarantine retention, and silent preset-policy overrides—and advises operators to audit policy stacks, forward logs for longer retention, sharpen KQL skills, and include transparency as an evaluation criterion when selecting email security tools.