Office 365 for work: We need Office 365 for Work support a FIDO Universal Second Factor (U2F) protocol standard Security Key.

As many organisation would like to shift to Office 365 but they concern about the security standard which request Office 365 to support Universal Second Factor (U2F) protocol standard security key as Microsoft is a member of FIDO.

We are getting numerous malware attacks with zero hour Office files containing malicious Macro's, these are often blocked within 60-90 minutes but some are still being received by users. The signature is changing regularly so they aren't picked up by your scanners despite the original virus being around 12 months old.

We do educate the users not to open them and Macro's are disabled, but blocking the content at the gateway would be better.

Some of this functionality was available in Forefront for Exchange.

Why is there a limit of 60 users that can be added to the new Anti-Phishing Policy? I would expect to have this very important feature available to ALL of our O365 users. Please remove this limitation so that we can add ALL of our O365 users to this new Anti-Phishing Policy

As a Partner I have access to the tenant of my clients. I'm not able to see the score of my clients tenant and check easily what changes need to be done and discuss this with my clients.
I can only do this when I have an separate admin account of the clients tenant.
Now with the integration of secure score into the compliance center shows a widget of the score but not the actions that needs to be taken. Please integrate the full secure score

I'd very much like to see support for CAA records in the future =).
See https://support.dnsimple.com/articles/caa-record/

The check for this record is going to be mandatory with September 2017. The security of all our certificates and domains would be greatly improved if we could set this record :)

Fix DMARC implementation to match the RFC 7489 defined behaviour for p=reject and p=quarantine.
Current behaviour p=reject messages are quarantined???

Want to bring network location-based conditional access policy to not only SharePoint but also the whole of office365.

I have a requirement from a large customer (85K users) that needs to be able to perform eDiscovery collections for specific Outlook folders. We can do date range and Full Mbx collections, but not specific folders. This was possible on-premises, but not in Exchange Online ????

When a retention label duration is based on the date the label is applied, the retention period may not be changed. It can be changed if the Created or last modified is chosen. This is impacting our ability to use the retention policies as they need to be active from the date of application with the capability to change duration in the future.

Our Office 365 tenant is generating 20+ of these alerts to our admins every day and every time we investigate, it is always the same story, the user is cleaning out old files or moving them from OneDrive to SharePoint. This alert needs some serious attention or organizations affected will just disable it.

Third party spam filters, such as the offerings from Barracuda, MXLogic, and many others, have the ability to allow administrators to force re-delivery of messages that may have failed due to either a restrictive rule or a SMTP alias that did not exist for a recipient (typically true with migrations from non-Exchange based systems).

It would be highly beneficial to admins to have this control and allow for forced re-delivery of messages as necessary.

Safelinks currently requires you enter each url you'd like to allow through. I'd like to have safelinks allow a wildcard domain. for instance we get many emails from our own systems pointing to internal urls. sometimes those emails get distorted because the url's are listed in plain text and replaced with the safelink.

I'd like to allow wildcard https://.mydomain.com/ to allow domains such as web.mydomain.com/page and test.mydomain.com/stuff to go through with by making one simple rule vs theoretically hundreds.

Currently Directory Based Edge Blocking Feature in EOP does not support Mail Enabled Public Folders and Dynamic Distribution Groups. If customer have any of these recipient types then they have to disabled DBEB for receiving external emails routed to tenant through EOP. It will be great if we can provide an interface to manage DBEB to which customer can explicitly add recipients which are picked up by EOP. This will be very helpful for standalone EOP customer who would want to use DBEB feature to thwart Directory based harvest attacks

Seems pretty odd that the report message add-in doesn't work in government tenants. It is definitely something that should be enabled.

When an account compromise happens, the majority of times the threat actor will create a new-inboxrule to hide their activity. Currently when new-inboxrules are created there is no logging for the Creation Date via powershell cmdlet. If we could get this logged, it would help tremendously with account compromises. Also adding a historical rule creation view for past 90 days would be beneficial as well.