StudyToCert

All certifications / SC-200 / Lessons

Microsoft Certified: Security Operations Analyst Associate SC-200 · Domain 2: Respond to security incidents

Defender for Office 365: Threat Explorer, removing delivered phishing, user-reported messages and Submissions

▶ Watch the overview video

Last reviewed September 30, 2026 · Leer en español

When a phishing campaign lands, the first questions are who received it, who clicked, and how to get it out of mailboxes. Microsoft Defender for Office 365 (MDO) answers these in the Defender portal. Speed matters, because every minute a phishing email sits in inboxes is another chance for someone to click, and a single credential entered can turn an email incident into an identity compromise.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study SC-200 for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the SC-200 study plan