Issue:

How to releasing quarantined items on Elements Collaboration Protection

Resolution:

To release quarantined items:

1. Select Quarantine on the sidebar.
2. On the Quarantine page, select the items that you want to release from the quarantine.
     Note: You can release up to 200 items at a time.
3. At the bottom of the page, select Release. The selected items are gradually released from the quarantine.

Documentation here Releasing quarantined items | Elements Collaboration Protection | Latest | WithSecure User Guides

Issue:

How do I retrieve quarantined emails from the Collaboration Protection Portal?

Resolution:

Issue:

How to add trusted email sender in Elements Collaboration Protection?

Resolution:

Follow these steps to add an email address as a trusted sender:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Navigate to the Collaboration Protection > Policies page
3. On the Policies page, select the policy you want to modify.
   • Note: Default WithSecure owned policies cannot be modified. 
4. Select the Exchange tab.
5. Under Trusted senders, do the following to add trusted senders.
   1. Select ON
   2. Select Scan and alert (low severity) when harmful content detected if you want the system to alert if harmful content is detected.

      Note: When this option is selected, emails are still scanned but no action is taken and the email items are still passed through.

   3. In the Trusted email sender addresses field, add the email addresses of those senders whose email messages are not quarantined or deleted.
   4. In the Trusted sender domains field, add those sender domains that you consider trusted. Email messages coming from those domains are not quarantined or deleted.

Visit the product admin guide for more information:

https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/task_7177D009B59245F38D9051D201AF825E-latest-en

Issue:

How to change Elements Collaboration Protection Exchange online mailbox type between user and non-user? 

Resolution:

The mailbox type listed in the Elements Collaboration Protection portal has to do with the type of Microsoft 365 tenant / account itself. There are no settings in Elements Collaboration Protection portal to change the mailbox account type.

The mailbox type will be recognized accordingly by Elements Collaboration Protection portal when a new Microsoft for Office 365 tenant / account has been added to the cloud service, so if the type is wrong currently in the Elements Collaboration Protection portal's Exchange view, you will need to check your mailbox settings from the Microsoft for Office 365 side. 

Some Microsoft for Office 365 accounts are meant for meetings or other shared uses, thus they are considered as non-user mailboxes.
 

Issue:

How is severity of detection determined on Elements Collaboration Protection?

Resolution:

Severity level indicates whether an administrator action is needed to mitigate the immediate risk.

Low: No action is needed because the item is coming from a trusted source.
Medium: No action is needed. The item was automatically either quarantined or deleted.
High: Action required. No automatic action is specified in the policy.
Critical: Immediate action is required to mitigate the risk.

Issue:

How to add Elements Collaboration Protection access rights for admins with existing WithSecure Business accounts (administrators who already have Elements Endpoint Protection, Endpoint Detection and Response, or Vulnerability Management access rights)?

Resolution:

You can add Elements Collaboration Protection access rights for administrators with existing WithSecure user accounts by following these steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Management > Organization Settings > Security Administrators page
3. Click on the user's email address
4. Enable Collaboration protection roles:
   1. Management role is for admin users who will be able to grant Collaboration Protection access to other users
   2. Collaboration protection role is for the daily admin user who needs to be able to for example create and modify policies, release from quarantine and enable protection for exchange mailboxes.
5. Click Save 

Visit this guide for more information.
https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/task_58D5F1D5EB0B4FEF9F40C94FF84AAD03-latest-en
 

Issue:

Getting a message of "Refresh permissions to Exchange to support the latest features and improvements" on Elements Collaboration Protection portal. What needs to be done to solve this?

Resolution:

You need to revisit the Microsoft consent popup by disconnecting and reconnecting Exchange on our Collaboration Protection portal. 

This is only required for Exchange, not for SharePoint, OneDrive, or Teams.

Issue:

Is there a way to allow a website or add a website URL to be always trusted in the Elements Collaboration Protection configuration policy so that an email containing the website URL is not blocked or quarantined?

Resolution:

It is possible to add a website URL to the trusted websites list within the Elements Collaboration Protection policy settings. This way the URL address is whitelisted so that emails including the URL will not be quarantined or blocked. 

Follow these steps:

1. Log in to the WithSecure Elements portal: https://elements.withsecure.com
2. Go to the Collaboration Protection > Policies page
3. Select the policy that is in use on the cloud service
4. Go to Exchange > URL scanning > Trusted websites
5. Turn on the 'Trusted websites' feature
6. Add the URL in the websites field
7. Click Save

Issue:

How does Elements Collaboration Protection subscription usage work? How does Collaboration Protection allocate licenses when there are more mailboxes than licenses available?

Resolution:

How license allocation works

Initial setup or protection settings change

Protect all mailboxes

When "Protect all mailboxes" is enabled, the system attempts to protect every mailbox in the tenant. If the number of mailboxes exceeds the available licenses — including licenses already consumed by other tenants sharing the same subscription — mailboxes are protected in alphabetical order by email address until no licenses remain. Any mailboxes that do not fit are automatically switched off.

Customize protection for mailboxes

When "Customize protection for mailboxes" is enabled, the customer manually selects which mailboxes to protect from the mailbox list. Licenses are assigned only to the mailboxes explicitly selected. If the number of selected mailboxes exceeds the available licenses, the selection cannot be completed until enough licenses are free. Optionally, the "Automatically protect newly-added mailboxes" toggle can be turned on to automatically protect newly discovered mailboxes without manual selection — see daily operations below.

Daily operations

When new mailboxes are discovered

• Protect all mailboxes: Newly discovered mailboxes are assigned any available licenses in alphabetical order. If the subscription is already at its limit, newly discovered mailboxes are switched off immediately — existing protected mailboxes are never displaced to make room for new ones.

• Customize protection for mailboxes: Newly discovered mailboxes are not protected automatically unless the "Automatically protect newly-added mailboxes" toggle is enabled. If it is enabled, newly discovered mailboxes are assigned available licenses in alphabetical order. If the limit is already reached, new mailboxes are switched off and must be enabled manually once a license becomes free.

When licenses are freed

• Protect all mailboxes: When a license is freed, it is automatically assigned to the first alphabetically available mailbox that was previously switched off due to license limits within the same tenant. Already protected mailboxes remain protected. Note that freed licenses are not redistributed across other tenants sharing the same subscription — only the tenant being scanned benefits from the newly available license.

• Customize protection for mailboxes: When a license is freed, it must be manually assigned to a mailbox. Existing unprotected mailboxes are not treated as newly discovered and will not be automatically protected even if the "Automatically protect newly-added mailboxes" toggle is enabled — that toggle only applies to mailboxes added for the first time.

Viewing license usage

1. Log in to the Elements Collaboration Protection portal

2. Go to the Cloud services page

3. Select the Subscription view tab from the top right corner

4. View the subscription usage column for each subscription key (expand the drop-down to see which Cloud Service tenants are consuming licenses)

Configuring which mailboxes to protect

1. Log in to the Elements Collaboration Protection portal

2. Select Cloud services on the sidebar

3. Select Configure protection in the row of the relevant connection in the Exchange column (or click on the protected/unprotected count)

4. In the page that opens:

   • Select Protect all mailboxes to protect all existing mailboxes in your Microsoft Exchange account.

   • Select Customize protection for mailboxes to manually choose which mailboxes to protect from the mailbox list.

   • Enable the Automatically protect newly-added mailboxes toggle if you want newly discovered mailboxes to be automatically added to protection. If this toggle is off, new mailboxes must be added manually.

5. To protect a specific unprotected mailbox, select it from the mailbox list and choose Turn on protection at the bottom of the page. Its status will change to "Protected".

Issue:

SharePoint Protection not all sites are listed on the portal. 

Resolution:

Typically, the Updates to the list of SharePoint sites might take around 6h to be reflected in portal.