Issue:

If we have new users added to our Microsoft Azure tentant, how to have Elements Collaboration Protection protect newly-added mailboxes, SharePoint and Teams assets and OneDrive drives?

Resolution:

To have newly added users assets automatically protected by Elements Collaboration Protection, follow these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Collaboration Protection > Cloud services page
3. Click on the cloud service 
   1. From the Exchange tab, enable Automatically protect newly-added mailboxes
   2. From the SharePoint tab, enable Automatically protect newly-added SharePoint and Teams assets
   3. From the OneDrive tab, enable 

Note that Teams shares this setting with SharePoint. 

Issue:

Can Elements Collaboration Protection be set to automatically protect newly-added Sharepoint, OneDrive and Teams assets? 

Resolution:

Yes, Elements Collaboration Protection can be set to automatically protect newly-added Sharepoint, OneDrive and Teams assets similarly as with the Exchange mailboxes:

1. Log in to the Elements Security Center portal
2. Go to the Collaboration Protection > Cloud services page
3. Click on the cloud service name
4. On the Sharepoint tab, you can enable Automatically protect newly-added Sharepoint and Teams assets
   1. Note: Teams has no separate toggle for protecting newly added assets, since it is combined with Sharepoint
5. On the OneDrive tab, you can enable Automatically protect newly-added drives
    

Now any time new assets are added to the cloud service, they will be automatically protected if there are remaining licenses on the subscription. 

Issue:

We have deleted some mailboxes from our Exchange / Microsoft Office 365 / Azure, but even after deleting the mailboxes the Elements Collaboration Protection Subscription usage still shows that the license is used. Why is the license not released immediately after deleting a mailbox? 

Resolution:

When a mailbox is deleted on the Azure side, it will take 24 hours before Elements Collaboration Protection marks it as "Unavailable". These Unavailable mailboxes don't get removed from the view immediately but they also do not reserve any licenses.

Issue:

We would like to add more licenses to our Elements Collaboration Protection subscription by adding a second subscription key to our existing cloud service. How to add an additional subscription key to a Elements Collaboration Protection cloud service? When configuring a cloud service, the Subscription Key drop-down menu only allows to select one subscription key for the cloud service tenant.

Resolution:

In Elements Collaboration Protection, one cloud service can only be assigned one subscription key. You cannot combine two subscription key's licenses to one single cloud service. If you have received two or more Elements Collaboration Protection subscription keys from your WithSecure reseller partner, we recommend to contact your WithSecure reseller partner so that they can cancel the second subscription key and increase the amount of licenses on the first subscription key. 

Issue:

We have tried enabling Elements Collaboration protection for OneDrive, SharePoint and Teams on the Cloud services page in the Elements Security Center portal, but the protection status for them goes to disabled or disconnected state repeatedly even if we try to re-enable the proction.

Why is the protection status for OneDrive, SharePoint and Teams randomly disabled?

Resolution:

This can happen in two cases:

Permission issue: You need to make sure from Azure that the permissions for the Elements Collaboration Protection app have not been revoked. 

Microsoft issue (invalid token): Reauthentication is required. The should be a connect button under SharePoint tab when you are in the cloud services view and you have clicked the cloud service. Press that, and follow the on-screen instructions.

Issue:

Can we integrate Microsoft Sentinel (SIEM) with Elements Collaboration Protection?

Resolution:

WithSecure provides a “serverless” integration that Sentinel users can use to get Elements event data into Sentinel.

You can find further information about this at our dedicated Community article

Those not using serverless integration, please read the following Community article.

Issue:

We have certain email attachments that are blocked or quarantined by Elements Collaboration Protection due to disallowed content. The files are clean and how do we solve it?

Resolution:

To resolve the blocked attachment due to the "Disallowed content" verdict, you can either allow the file extension or add the trusted sender email address/domain to the tenant's Elements Collaboration Protection policy.

To allow the file extension:

1. Log on to the Elements portal (https://elements.withsecure.com/)
2. Go to Collaboration Protection > Policies
3. Select the tenant's policy
4. Go to Exchaneg > General > Malware scanning
5. In the Disallowed file types section, click on the Configure file types, and untick the target file type
6. Click Save
   

Add the sender address/domain to exclude attachment scanning:

1. Log on to the Elements portal (https://elements.withsecure.com/)
2. Go to Collaboration Protection > Policies
3. Select the tenant's policy
4. Go to Exchange > General
5. Turn on the 'Trusted senders' option
6. Add the sender email:
   1. email address to the Trusted email sender addresses list if you want to allow a specific email address
   2. domain to the Trusted sender domains list if you want to allow a whole domain
7. Click Save

Issue:

Admin get the message "No more licenses available. To protect additional mailboxes, you need to get more licenses or turn off protection for others" when trying to protect a new mailbox with Elements Collaboration Protection 

Resolution:

The license usage for Elements Collaboration Protection is based on the amount of mailboxes that are being protected. If a Cloud Service tenant has more mailboxes than there are licenses, with the default Protect all mailboxes setting, it will protect the mailboxes in alphabetical order until no licenses are remaining.

To view the amount of licenses in use:

1. Log in to Elements Collaboration Protection portal
2. Go to the Cloud services page
3. Select the Subscription view tab from the top right corner
4. View the subscription usage column for each subscription key (you can open the drop-down menu to view which Cloud service is using the licenses)

If you want to select specifically which mailboxes to protect, you can use the Customize my protection setting. 

Instructions on how to set up protection for the mailboxes in a configured domain. To set up protection for the mailboxes:

1. Log in to the Elements Collaboration Protection portal
2. Select Cloud services on the sidebar
3. Select Configure protection in the row of the new connection in the Exchange column (or click on the protected / unprotected number)
4. In the page that opens, do the following:
   • Select Protect all mailboxes if you want to protect all the existing mailboxes in your account in Microsoft Exchange.
   • Select Customize my protection if you want to select the mailboxes that you want to protect.
     • Note: You can turn on Protect new mailboxes if you want to automatically protect all the new mailboxes. If this setting is off, you must manually select the new mailboxes to add them to the list of protected mailboxes.
   • To add protection for an existing unprotected mailbox on your account, select the mailbox from the mailbox list and at the bottom of the page, select Turn on protection. The status of the mailbox changes to "Protected".

Issue:

When logging in to Elements Security Center, the Collaboration Protection product subscription section shows "no access rights – You do not have rights to Collaboration Protection content of this organization" for it. 

Resolution:

If you are a customer who just bought Elements Collaboration Protection or a partner who has received Not for Resale (NFR) licenses, you need to create the first administrator account from the self-register page. When you use the same email address as your current WithSecure Elements account uses, it will simply add the user rights to your account. 

You can find the instruction steps and the link to the self-register page here: Quick Start – Elements Collaboration Protection | WithSecure™ 

If you already have a colleague with Elements Collaboration Protection access rights to your company's account, that colleague can add administrator user rights for you by following these steps: 

1. Log in to the Elements Security Center 
2. Navigate to Management > Organization Settings 
3. Go to the Security Administrators tab
4. Click Add administrator 
5. Enable Collaboration protection access
6. Click Next 
7. Click Add 

If you are a partner user (solution provider) who does not see the Elements Collaboration Protection product when you log in to the Elements Security Center, you can ask one of your colleagues who has the Management access rights to the Collaboration Protection solution to add the rights by following the earlier mentioned steps.

If no one in your reseller partner  Elements account has Elements Collaboration Protection rights and you do not have any users with Elements Collaboration Protection access rights, open a User Management Assistance support case using the Partner Portal. 

Issue:

Does compromised account feature cover all users in Microsoft365 regardless of number of license on Elements Collaboration Protection? Or does it cover only users who have mailbox?

Resolution:

It will be the latter.
Only users that have mailbox, PLUS it is protected by ECP, can be use this feature.
So for example, if the user mailbox can't be protected by ECP because exceed license size for example, it cannot use this feature.