Merge pull request MicrosoftDocs#7061 from MicrosoftDocs/chrisda

Update New-AntiPhishPolicy.md

Author: chrisda

exchange/exchange-ps/exchange/Get-SafeLinksAggregateReport.md

@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in the cloud-based service.
 
-Use the Get-SafeLinksAggregateReport cmdlet to return to return general data about Safe Links for the last 90 days.
+Use the Get-SafeLinksAggregateReport cmdlet to return to return general information about Safe Links results for the last 90 days. Yesterday is the most recent date that you can specify.
 
 **Note**: We recommend that you use the Exchange Online PowerShell V2 module to connect to Exchange Online PowerShell. For instructions, see [Connect to Exchange Online PowerShell](https://docs.microsoft.com/powershell/exchange/connect-to-exchange-online-powershell).
 
@@ -33,11 +33,13 @@ Get-SafeLinksAggregateReport
 ```
 
 ## DESCRIPTION
+**Note**: If you run Get-SafeLinksAggregateReport without specifying a date range, the command will return an unspecified error.
+
 Safe Links is a feature in Microsoft Defender for Office 365 that checks links in email messages to see if they lead to malicious web sites. When a user clicks a link in a message, the URL is temporarily rewritten and checked against a list of known, malicious web sites.
 
 For the reporting period you specify, the cmdlet returns the following information:
 
-- Action
+- Action (Allowed, Blocked, ClickedEventBlocked, and ClickedDuringScan)
 - App
 - MessageCount
 - RecipientCount
@@ -111,6 +113,8 @@ The EndDate parameter specifies the end date of the date range.
 
 Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.
 
+Yesterday is the most recent date that you can specify. You can't specify a date that's older than 90 days.
+
 ```yaml
 Type: System.DateTime
 Parameter Sets: (All)
@@ -129,6 +133,8 @@ The StartDate parameter specifies the start date of the date range.
 
 Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.
 
+Yesterday is the most recent date that you can specify. You can't specify a date that's older than 90 days.
+
 ```yaml
 Type: System.DateTime
 Parameter Sets: (All)

exchange/exchange-ps/exchange/Get-SafeLinksDetailReport.md

@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in the cloud-based service.
 
-Use the Get-SafeLinksAggregateReport cmdlet to return to return detailed information about Safe Links.
+Use the Get-SafeLinksDetailReport cmdlet to return to return detailed information about Safe Links results for the last 7 days. Yesterday is the most recent date that you can specify.
 
 **Note**: We recommend that you use the Exchange Online PowerShell V2 module to connect to Exchange Online PowerShell. For instructions, see [Connect to Exchange Online PowerShell](https://docs.microsoft.com/powershell/exchange/connect-to-exchange-online-powershell).
 
@@ -36,7 +36,8 @@ Get-SafeLinksDetailReport [-Action <MultiValuedProperty>]
 ```
 
 ## DESCRIPTION
-The Get-SafeLinksDetailReport cmdlet returns information about URL clicks for the last 7 days.
+**Note**: If you run Get-SafeLinksAggregateReport without specifying a date range, the command will return an unspecified error.
+
 Safe Links is a feature in Microsoft Defender for Office 365 that checks links in email messages to see if they lead to malicious web sites. When a user clicks a link in a message, the URL is temporarily rewritten and checked against a list of known, malicious web sites.
 
 This cmdlet returns the following information:
@@ -62,7 +63,7 @@ You need to be assigned permissions before you can run this cmdlet. Although thi
 
 ### Example 1
 ```powershell
-Get-SafeLinksDetailReport -StartDate 06-07-2020 -EndDate 06-10-2020 -Action Allowed,Blocked -AppNameList "Email Client","Teams"  -Domain google.com,teams.com -RecipientAddress [email protected],[email protected]
+Get-SafeLinksDetailReport -StartDate 06-07-2020 -EndDate 06-10-2020 -Action Allowed,Blocked -AppNameList "Email Client","Teams" -Domain google.com,teams.com -RecipientAddress [email protected],[email protected]
 ```
 
 This example returns filters the results by the following information:
@@ -149,6 +150,8 @@ The EndDate parameter specifies the end date of the date range.
 
 Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.
 
+Yesterday is the most recent date that you can specify. You can't specify a date that's older than 7 days.
+
 ```yaml
 Type: System.DateTime
 Parameter Sets: (All)
@@ -216,6 +219,8 @@ The StartDate parameter specifies the start date of the date range.
 
 Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.
 
+Yesterday is the most recent date that you can specify. You can't specify a date that's older than 7 days.
+
 ```yaml
 Type: System.DateTime
 Parameter Sets: (All)

exchange/exchange-ps/exchange/New-AntiPhishPolicy.md

@@ -345,7 +345,7 @@ This setting is part of spoof protection.
 
 The EnableUnauthenticatedSender parameter enables or disables unauthenticated sender identification in Outlook. Valid values are:
 
-- $true: This is the default value. A question mark (?) is applied to the sender's photo if the message does not pass SPF or DKIM checks AND the message does not pass DMARC or composite authentication. The via tag ([email protected] <u>via</u> michelle@fabrikam.com) is added if the domain in the From address (the message sender that's displayed in email clients) is different from the domain in the DKIM signature or the MAIL FROM address.
+- $true: This is the default value. A question mark (?) is applied to the sender's photo if the message does not pass SPF or DKIM checks AND the message does not pass DMARC or composite authentication. The via tag ([email protected] <u>via</u> fabrikam.com) is added if the domain in the From address (the message sender that's displayed in email clients) is different from the domain in the DKIM signature or the MAIL FROM address.
 - $false: A question mark is never applied to the sender's photo. The via tag is still added if the domain in the From address is different from the domain in the DKIM signature or the MAIL FROM address.
 
 To prevent these identifiers from being added to messages from specific senders, you have the following options: