> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/microsoft-365-remove-malicious-email.md). # Microsoft 365: Remove Malicious Email *This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.* ## How It Works If our SOC identifies an email that must be removed, Workbench completes the action automatically unless it is specifically called out as a "Never remove" asset (the inboxes must first be added as context and then configured in Workbench; see [Step 3](#step-3-update-your-context)). Quarantine inboxes are often called out as "Never remove" assets. ## Prerequisites * You must install and activate Microsoft 365 Message Trace so that we can automatically remove the malicious email from other inboxes. For instructions, see [Microsoft 365 Message Trace Setup](/more-features/expel-managed-phishing/setup-guides/microsoft-365-message-trace-setup.md). * You must have admin access in Workbench, as auto remediations are enabled at the organization level. ## Step 1: Assign the SecurityReader Role The SecurityReader role allows us to perform a message trace or search your instance when we identify an email that needs remediation. This role provides read-only access. 1. Log in to the [Azure portal.](https://portal.azure.com/) 2. Navigate to the **Microsoft Entra ID** service. 3. Go to **Manage > Roles and administrators**. 4. Use the search bar to locate the **Security Reader** role, then select it to view its assignments. 5. Select **Add assignments**. 6. Use the search box under **Select member(s)** to locate your custom app. You are searching for the app's service principal, which usually has the same name as the app registration. 7. Select your app, then choose **Add**. You should now see the app's service principal listed as an active member of the Security Reader role. ## Step 2: Add an Additional API Permission The `Exchange.ManageAsApp` permission allows us to connect to PowerShell to run the necessary commands to remove an email. {% hint style="info" %} If you used the **Expel O365 Integration** when onboarding the Microsoft 365 device: * If you onboarded **after March 12, 2026**, the `Exchange.ManageAsApp` permission has already been granted and you may skip to [Update Your Context](#step-3-update-your-context). * If you onboarded **prior to March 12, 2026**, skip to [Manually Grant Admin Consent](#manually-grant-admin-consent-legacy-customers-only). If you used a **custom app** when onboarding the Microsoft 365 device, follow the below instructions to add the `Exchange.ManageAsApp` permission. {% endhint %} 1. Navigate to the **App registrations** page in the Azure portal: 2. Find and select the custom app you created when you set up your security device. 3. In the left menu, go to **Manage > API permissions**. 4. Select **Add a permission**. 5. Locate the **Office 365 Exchange Online** API, and add the `Exchange.ManageAsApp`\ permission as an application permission (not as a delegated permission). 6. Select **Grant admin consent** and **Yes** at the prompt. ## Step 3: Update Your Context **If you do not want to specify any inboxes for a "do not remove" list, skip to** [**Step 4**](#step-4-return-to-the-main-setup-guide)**. Quarantine inboxes are often called out as "Never remove" assets.** Working with your Customer Success Manager (CSM), add any inboxes that should be on the "do not remove" list as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment. You will then be able to select those inboxes as "Never remove" assets when you enable the auto remediation in Workbench. {% hint style="info" %} If our SOC identifies an email that must be removed, any emails from inboxes added as "Never remove" assets are assigned to you as actions rather than being removed automatically. {% endhint %} ## Step 4: Return to the Main Setup Guide Your Microsoft 365 device is now ready for the Remove Malicious Email auto remediation. You should now do one of the following: * **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. * **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.* *** ### Manually Grant Admin Consent (Legacy Customers Only) If you onboarded your Microsoft 365 security device **prior to March 12, 2026**, and you also used the **Expel O365 integration (not a custom app)** to create your API connection, you must go back into Azure to **grant us admin consent** in order for the Microsoft Remove Malicious Email auto remediation to work. This permission was not included in the Expel O365 integration prior to that date. 1. Log in to . 2. Select **Enterprise Applications**. 3. Select the Expel application. 4. In the left menu, go to **Security > Permissions**. 5. Select the **Grant admin consent for Expel** button. 6. Select the **Refresh** option to verify that the permissions have been updated. 7. Go to [Step 3: Update Your Context](#step-3-update-your-context). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/microsoft-365-remove-malicious-email.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.