We would like to enforce the 'app lock' setting on the Microsoft Authenticator app to force users to either enter their device passcode or use biometric authentication before opening the app.

This could be through an Intune app config or a built in setting.

Currently if an unlocked device was compromised, the attacker would be able to circumvent account MFA security.

Right now the audit log search allows for searching user sign-ins but not failed login attempts. This can be accessed by exporting the events but having that feature available in the search would make it more convenient to get an at-a-glance view of failed attempts and the IP addresses that are attempting to get access. This is not to say I don't trust Microsoft's ability to detect suspicious logins; it's more for our own situational awareness of where *********** attempts are coming from.

I would like to Create and alert if there are failed login attempts or successful login attempts from IP addresses originating outside of my City/State/Country.

Allow us to either white list IP addresses and alert for any not on the white list. Blacklist IP addresses and alert based off of just black list. Select Country regions and alert if selected countries IP addresses are the originating IP. Allow us to alert for only failures, only successes, or both.

Need to have the limit of 100 site collections increased for inclusion/exclusion in a retention policy. To meet business requirements where they may be thousands of site collections but not all require the same retention policy, this is very limiting limit.

Retention Policies for Office 365 Groups currently treat all resources the same (i.e. Exchange and SharePoint). We need the ability to configure email items to delete after X years, but not delete documents stored on SharePoint.

Junkmail filtering has been a constant pain point for me with O365 business and Outlook. The spam filters have an awfully high number of false positives, and only rarely capture real spam (I don't get much on these accounts). Most of the mail that gets filtered is from the same set of senders even though I constantly tell Outlook that these messages are not Junk. O365 needs to leverage this data to improve filtering reliability.

Please add the ability to delegate read-access to audit logs by Activity type. For example, access to just "Power BI activities" audit logs, or "Microsoft Teams activities" audit logs.

This would be useful as different groups within IT manage the usage of different O365 services, yet they have to be given access to all or nothing.

This is a simple feature to implement and my users were used to it with Appriver. My users get a report of their quarantined emails daily, that emailed report should have a link (https://admin.protection.outlook.com/quarantine) for the users to click to view their quarantined email at any time, so they don't have to wait a day.

I'd very much like to see support for CAA records in the future =).
See https://support.dnsimple.com/articles/caa-record/

The check for this record is going to be mandatory with September 2017. The security of all our certificates and domains would be greatly improved if we could set this record :)

please enable tls 1.3 support.
This will improve rtt times and improve privacy.

When creating the policy, the * means all, but it still forces you to select users to add to the retention policy.

Currently Directory Based Edge Blocking Feature in EOP does not support Mail Enabled Public Folders and Dynamic Distribution Groups. If customer have any of these recipient types then they have to disabled DBEB for receiving external emails routed to tenant through EOP. It will be great if we can provide an interface to manage DBEB to which customer can explicitly add recipients which are picked up by EOP. This will be very helpful for standalone EOP customer who would want to use DBEB feature to thwart Directory based harvest attacks

When an account compromise happens, the majority of times the threat actor will create a new-inboxrule to hide their activity. Currently when new-inboxrules are created there is no logging for the Creation Date via powershell cmdlet. If we could get this logged, it would help tremendously with account compromises. Also adding a historical rule creation view for past 90 days would be beneficial as well.

Third party spam filters, such as the offerings from Barracuda, MXLogic, and many others, have the ability to allow administrators to force re-delivery of messages that may have failed due to either a restrictive rule or a SMTP alias that did not exist for a recipient (typically true with migrations from non-Exchange based systems).

It would be highly beneficial to admins to have this control and allow for forced re-delivery of messages as necessary.