Update - As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device have coverage and alerts are being processed.
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench). Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 28, 2025 - 09:38 EDT
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench). Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 28, 2025 - 09:38 EDT
Monitoring - We have confirmed all Microsoft Defender XDR devices are enabled and ingesting data, and we are working to reprocess alerts.
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench) Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 18:40 EDT
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench) Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 18:40 EDT
Identified - As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device will have coverage restored shortly and begin reprocessing alerts.
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. We will provide a status update once we have enabled all onboarded Defender XDR devices.
In the meantime, please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 17:29 EDT
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. We will provide a status update once we have enabled all onboarded Defender XDR devices.
In the meantime, please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 17:29 EDT
Identified - Microsoft is rolling out deprecation of legacy Exchange tokens that may prevent your users from being able to report emails using the Expel custom Office 365 Phishing button.
Expel is working on development and testing of an updated Expel O365/M365 Phishing button for web and desktop applications that will work with the NAA authentication scheme.
Until Expel is able to deploy the newly developed Phishing button, you should follow the instructions from Microsoft (https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off) to enable legacy tokens for your tenant. It can take up to 24 hours for this change to take effect.
Contact support if you need assistance with this process.
Mar 17, 2025 - 10:03 EDT
Expel is working on development and testing of an updated Expel O365/M365 Phishing button for web and desktop applications that will work with the NAA authentication scheme.
Until Expel is able to deploy the newly developed Phishing button, you should follow the instructions from Microsoft (https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off) to enable legacy tokens for your tenant. It can take up to 24 hours for this change to take effect.
Contact support if you need assistance with this process.
Mar 17, 2025 - 10:03 EDT
Workbench availability
Operational
Workbench global network connectivity
Operational
Workbench login
Operational
Workbench features
Operational
Investigative actions
Operational
File uploads
Operational
Notifications
Operational
Email
Operational
Slack
Operational
Teams
Operational
Ticketing systems (via email, such as Jira)
Operational
PagerDuty
Operational
Opsgenie
Operational
ServiceNow
Operational
Assembler connectivity
Operational
Alert ingestion
Operational
Slack channels for customers
Operational
Phishing submissions
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Scheduled Maintenance
Scheduled Infrastructure Maintenance Apr 9, 2025 05:00-06:00 EDT
We will be undergoing routine maintenance between 05:00 - 06:00am ET on April 9th. During the maintenance window, Workbench may be intermittently unavailable or slow.
All notifications and alerts will be processed during the maintenance window, but may be affected by intermittent delays.
Posted on Apr 01, 2025 - 12:54 EDT
All notifications and alerts will be processed during the maintenance window, but may be affected by intermittent delays.
Posted on Apr 01, 2025 - 12:54 EDT