Question 1

What is email threat response?

Accepted Answer

Email threat response is the work that starts after a malicious message has been detected or delivered. It covers correlating the message into a campaign, blocking the sender, domain, URLs and attachments to help stop related messages, and containing the identity consequences of a click. Email Threat Response is UnifiedONE's response layer for that work. Removing copies that were already delivered is not available yet.

Question 2

Does this replace my email gateway or filter?

Accepted Answer

No. Keep the email security you bought; it keeps doing its detection. For connected Microsoft 365 tenants, Email Threat Response adds campaign correlation, governed blocks through Exchange Online and the handover to identity response. It is a response layer alongside your email security, not a second email-security product.

Question 3

Can it remove every malicious email from every mailbox?

Accepted Answer

No. Removing delivered messages is not available today, because the Microsoft interface it depends on is still in beta. Today Email Threat Response blocks the sender, domain, URLs and attachments through Exchange Online, which helps stop further messages from the same campaign. Each block depends on the tenant's Microsoft services, permissions and configuration. Where an action is unavailable, the limitation is shown and named instead of being presented as a completed action.

Question 4

If a user clicks a phishing link, does it reset their password automatically?

Accepted Answer

No. A confirmed malicious click preserves the campaign, message and user context and passes it to Identity Protection and SOC Commander. Where your policy, your authority and the available capability permit, UnifiedONE can then coordinate actions such as session revocation or a password workflow. Nothing runs automatically unless you configured that action type to run, and in Assist mode an authorised operator approves it.

Question 5

Does a confirmed campaign expose our mailboxes to other customers?

Accepted Answer

No. What can travel is attacker knowledge: malicious sender addresses, sending domains, links, attachment hashes, validated campaign identifiers, and the confidence and expiry metadata that goes with them. Mailbox content, message bodies, attachments, recipient names, customer and tenant identities, investigation evidence and raw message records are not shared between participants.

Question 6

What does this change for an MSP or MSSP?

Accepted Answer

One campaign is investigated once, with a view across the affected customers rather than a fresh start in each environment. Investigation, blocks and reporting run from one workflow. You can see which environments are protected, which are waiting for an approval and which lack the capability or licence an action needs. Analyst findings can extend to other eligible participating environments, and the customer gets evidence of what was detected and blocked.

Question 7

Is it useful for a smaller organisation with no SOC?

Accepted Answer

That is the case it is designed for. A smaller organisation gets stronger operational email response without building an internal SOC workflow, because the campaign correlation and the governed blocks are the product rather than a runbook somebody has to write. Larger organisations get the coordination instead: connected email signals, campaign context, identity response and governed action in one story.

Question 8

Is it available today?

Accepted Answer

Yes. Email Threat Response is included from the Threat Protection plan upwards. Its email actions block senders, domains, URLs and attachments through Exchange Online. Which actions run in your environment still depends on your Microsoft services, permissions and configuration. Ask us what your environment supports today.

One phishing email is rarely the only one.

One alert. A whole campaign behind it.

Every copy becomes a new investigation.

One campaign. One coordinated block.

One message is not the whole campaign.

Choose the response for the whole campaign.

Less repeated phishing work. For every team.

SMBs

MSPs & MSSPs

Enterprises

SOC teams

Email threat response, answered.

Do not stop at the email alert.