Microsoft Defender for Office 365: configuration and operation

How to use Defender against suspicious email

Microsoft Defender for Office 365 delivers more value when alerts lead to an operational decision. When faced with a suspicious message, you must first identify recipients, characteristics of the email and actions carried out by users. A message blocked before delivery requires a different review than another message that arrived in the mailbox and whose link has already been opened.

In an illustrative example, a fake invoice impersonates a regular supplier. The investigation does not end when that email is removed: it is necessary to check if there are similar messages, if a user responded and if credentials were entered or a file was executed. Subsequent actions depend on that evidence. The tool helps investigate, but the team needs a procedure that assigns responsibility and determines when to escalate the incident.

The case is closed by documenting scope, actions and outcome. This information allows you to adjust training and policies without reacting to each incident with a global exception. It also helps distinguish a domain authentication deficiency, visible phishing, or malicious link: similar user issues may require different checks and controls.

How to fix a false positive without opening an excessive exception

If a legitimate provider fails to deliver a message, the first task is to locate the cause and retain an identifiable sample. Sender, domain, authentication and verdict must be reviewed, in addition to the flow that the email has followed. Authorizing an entire domain before understanding the block may allow messages that should not be treated the same.

The correction must use the appropriate mechanism for the case and be verified with new samples. The reason, scope, and person who will review the exception are documented. Monitoring false positives and malicious messages that reach users allows you to evaluate whether the protection works in practice, without measuring its quality solely by the number of blocks.

What is Microsoft Defender for Office 365

Microsoft Defender for Office 365 adds advanced prevention, detection, investigation, and response capabilities on top of the protections already provided by Exchange Online Protection. Its scope is not limited exclusively to mail. Depending on the functionality and license, you can protect items related to: Exchange Online, Microsoft Teams, SharePoint, OneDrive and Office applications supported. What threats are you trying to reduce?

Does not replace Zero Trust

Defender for Office 365 does not replace: MFA, Conditional Access, endpoint protection, identity governance, permission review or response procedures. Especially in a real BEC scenario, the problem may not be that the mail is technically fake. If a provider’s Microsoft 365 account has been compromised, the attacker can send from a legitimate identity. That’s why we need to combine message security with identity security and business processes.

Official reference: Microsoft – Microsoft Defender for Office 365.

How a layered email protection architecture works

Email security should not be seen as a single barrier. A message goes through different controls.

The advantage of this model is that a failure in one layer does not necessarily mean that the attack will be successful.

Exchange Online Protection: the first line of defense

Exchange Online Protection provides many of the built-in protections of cloud mailboxes. Among them we find: anti-spam, anti-malware, anti-spoofing, quarantine, ZAP and different mail flow controls. EOP does not mean “minimum protection.” Relevant functionality is available even without Defender for Office 365. For example, Microsoft includes spoofing protection for organizations with cloud mailboxes, and ZAP can take action on subsequently detected spam, phishing, and malware.

Defender for Office 365 extends this model with controls such as Safe Links, Safe Attachments, and advanced impersonation protection.

EOP vs Defender for Office 365 Plan 1 vs Plan 2

The fundamental difference. A practical way to understand them is: Plan 1 = advanced prevention and detection. Plan 2 = Plan 1, research, automation, response and advanced training.

Licensing updated in 2026

This is one of the parts where most old comparisons have become obsolete.

Important with E3. The incorporation of Plan 1 to E3 does not mean that E3 automatically has: Complete Threat Explorer, AIR or Attack Simulation Training. These continue to be Plan 2 level capabilities when their full functionality is required. Official reference: Microsoft – Defender for Office 365 service description.

What to review before configuring policies

One of the main mistakes is to modify filters before knowing how email really circulates.

Previous inventory

Check the actual mail flow first

Before configuring Defender we must answer: Does Microsoft 365 directly receive the message from the Internet? If the MX points to Microsoft 365, the platform has the real IP of the sending system from the input. But if it exists before: Proofpoint, Mimecast, Cisco, Barracuda, an on-premises appliance, Exchange Server, or another gateway, the situation changes. Microsoft could see the IP of the gateway and not the true sender as the origin of the message.

This affects: reputation, spoof detection, SPF and composite authentication.

Third-party gateways: Enhanced Filtering before SCL -1 rules

If there is a filtering system in front of Microsoft 365, we must review Enhanced Filtering for Connectors, also known historically as skip listing. Its goal is to help Microsoft 365 identify the true source infrastructure that existed before the gateway. Avoid the old pattern. It is common to find a rule: if the mail comes from the external filter IP → SCL -1.

That essentially means “bypass spam filtering” for that traffic. A rule that is too broad can significantly reduce Microsoft’s defenses. We should also check out ARC. When legitimate intermediaries modify messages and break SPF or DKIM, Authenticated Received Chain can help preserve the original authentication information. Official references:

• Microsoft – Enhanced Filtering for Connectors
• Microsoft – Secure by default

Standard, Strict and Built-in Protection

Microsoft provides preset security policies to apply recommended settings in a consistent manner. For most organizations, they should be the starting point before building dozens of custom policies. Standard. Microsoft describes Standard as a suitable baseline for most users. Strict. It is aimed at higher risk profiles and uses more aggressive settings in certain controls.

Built-in Protection. In organizations with Defender for Office 365 it provides a default layer of: Safe Links, Safe Attachments For users not included in: Standard, Strict or equivalent custom policies. An important distinction. The individual policies that make up Standard and Strict are not designed to be edited value by value. They are profiles maintained by Microsoft. If we need major customizations, we should design a custom policy for the corresponding group instead of trying to modify the preset internally.

Simple architecture.

Official reference: Microsoft – Preset security policies.

Order of precedence: why a custom policy may not apply

When a user matches multiple policies, they do not all have the same weight. Relevant general order.

Example. A user is simultaneously included in: Standard, a custom Safe Links policy. The preset configuration can be applied before the custom policy. That’s why groups should be designed to avoid unnecessary overlaps.

High-value users: protect by risk, not just by org chart

Attackers do not choose targets randomly. There are accounts whose compromise would have a disproportionate impact.

For these users. We can propose: Strict, phishing-resistant MFA, impersonation protection, strengthened payment processes, specific training.

Anti-phishing: spoofing, impersonation and mailbox intelligence are not the same

A good setup should distinguish them.

The last case is especially complicated. If the provider’s account has been compromised: SPF can pass, DKIM can pass and DMARC can pass. The message actually comes from the legitimate environment. There we need to combine signals of content, behavior, identity and business procedures.

Spoof intelligence

Microsoft 365 uses spoof intelligence to identify spoofed senders. It should be kept activated unless there is a very specific technical reason. Spoof intelligence insight. Allows you to review pairs of: spoofed identity, sender infrastructure to understand what spoofing is being allowed or blocked. Do not allow an entire domain because a legitimate platform spoofs. If an external service needs to send using our address: 1. we correctly configure authentication; 2. we check the detected torque; 3. only if it is still necessary, we use a specific exception.

Official reference: Microsoft – Anti-spoofing protection.

Protection against user and domain impersonation

Defender for Office 365 capabilities can detect impersonation attempts that do not require literally spoofing the domain. Example. Actual address: fernando@empresa.com Attack: fernando@ernpresa.com The second address can: pass SPF, DKIM and DMARC on your own domain and continue to be fraudulent. That’s why we need protection against impersonation. Especially for: sensitive users, own domains, relevant partner domains when justified.

Mailbox intelligence. Microsoft may use information from the typical communication pattern to help recognize whether a sender appears consistent with the user’s normal relationships. Phishing threshold. The presets also configure different levels of aggressiveness. Currently Standard uses a more aggressive level and Strict the most aggressive level within the configurations recommended by Microsoft. Official reference: Microsoft – Anti-phishing policies.

Anti-malware: basic protection is still necessary

Before Safe Attachments, messages go through the usual anti-malware capabilities. Common attachments filter. Microsoft allows you to block certain types of potentially dangerous files. We should not copy a generic list from the Internet without analyzing the business.

ZAP for malware. If Microsoft determines after delivery that a message contains malware, ZAP may quarantine it. Official reference: Microsoft – Anti-malware policies.

Inbound anti-spam: it is not simply “spam or not spam”

Microsoft classifies different levels: bulk, spam, high confidence spam, phishing and high confidence phishing. Each result can have a different action. Standard and Strict already incorporate decisions. For example, Strict is more aggressive with: bulk and spam than Standard. For clearly malicious threats, many settings are similar between both profiles. Bulk mail. Not all mass mail is malware. The Bulk Complaint Level helps us decide what type of mass email we want to consider spam.

Do not create an allow list to resolve each newsletter. First we must find out why it has been classified and correct the appropriate problem.

Outbound spam: detecting compromised accounts also matters

An email strategy should not only look at incoming traffic. A compromised account can start sending: spam, phishing or thousands of messages to external recipients. Outbound policies allow control. limits, forwarding and actions when a user exceeds certain thresholds. A shipping failure can be an indicator of compromise. If a user who normally sends 20 emails a day tries to send hundreds or thousands, we should investigate.

External automatic forwarding

Forwarding rules are a common technique after committing an account. Example. The attacker accesses a mailbox and creates a rule that: forward invoices to an external account, hide certain responses. The current recommended configuration. Microsoft uses Automatic – System-controlled as a recommended setting for the Standard and Strict presets. The current behavior is equivalent to keeping external automatic forwarding disabled except in specifically supported scenarios.

If a company needs forwarding. It is advisable to create an exception: explicit, documented, with owner, reviewable.

Safe Links: protect the moment of the click

A URL may appear secure when the message is delivered and change later. That’s one of the problems it’s trying to solve. Safe Links. Mail. You can provide: URL rewriting, time-of-click protection, file link analysis. Teams. Safe Links checks URLs at the time of click, but Teams links don’t need to be rewritten the same way they do in email.

Office. You can also check links from supported Office applications when the user is successfully authenticated. Recommended configuration.

Do not exclude entire domains for convenience. An exception in Safe Links reduces the ability to evaluate that URL. The lists of Do not rewrite They should be small and justified. Official reference: Microsoft – Safe Links.

Safe Attachments: analysis beyond an antivirus signature

Safe Attachments searches for unknown threats using analysis and detonation techniques. Current actions.

Standard and Strict. Current presets use: Block. Therefore, if we choose presets we do not need to build a custom Safe Attachments policy simply to replicate Microsoft’s baseline. Dynamic Delivery. It can be useful in specific scenarios where we want to reduce perceived latency, but it shouldn’t be automatically used just because it seems more convenient. Official reference: Microsoft – Safe Attachments.

Safe Attachments in SharePoint, OneDrive and Teams

Defender for Office 365 is not limited to SMTP attachments. You can add protection on files stored in: SharePoint Online, OneDrive and Microsoft Teams. Detonation. After the basic antivirus scan, Safe Attachments can scan files using a virtual environment. Important. Global Safe Attachments settings for SharePoint, OneDrive, and Teams are different from a Safe Attachments policy for email messages.

We should not assume that because email is protected, we have automatically revised the collaboration settings. Official reference: Microsoft – Safe Attachments for SharePoint, OneDrive and Teams.

Zero-hour Auto Purge: security continues after delivery

ZAP It is one of the capabilities that contributes the most value to the layered protection model. Problem. At 10:00 a message seems legitimate. At 10:30 new global signals show that it is part of a phishing campaign. Without a post-delivery defense, the message would still be in the mailbox. ZAP can act retrospectively. In Exchange Online mailboxes you can act on: malware, phishing and spam depending on the verdict and the configured actions.

You do not need Plan 2 for email. ZAP for malware, phishing and spam in Exchange Online is part of the cloud mailbox protections. Teams-specific ZAP protection is associated with Defender for Office 365 licenses. What to review. There is a report of: Post-delivery activities which allows you to view affected messages after they have been delivered. Official reference: Microsoft – Zero-hour Auto Purge.

SPF, DKIM, DMARC and ARC: Authenticate the domain before blaming the filter

Microsoft recommends using together: SPF, DKIM, DMARC. None of them replace Defender, but they help establish whether a message is actually authorized by the domain owner.

Passing SPF does not mean that the visible sender is legitimate. SPF primarily validates the MAIL FROM domain. An attacker can have SPF perfectly configured for their own domain and show another identity in the From. DMARC adds precisely the concept of alignment. Official reference: Microsoft – Email authentication in Microsoft 365.

Set SPF correctly

The first step is to inventory all the platforms that send using our domain. Example.

A single SPF record. A domain must publish a single consolidated SPF TXT record. DNS limit. SPF has a limit of 10 DNS lookups for the mechanisms that count as a lookup. accumulate many include: may end up generating: permerror. Recommended procedure. If we still don’t know all the sources, Microsoft proposes to start by identifying valid sources and then tighten the end of the policy.

When we know all the emitters: we can move forward -all. Official reference: Microsoft – Configure SPF.

Configure DKIM for custom domains

DKIM uses a cryptographic signature to help validate the message. Microsoft 365. For custom domains we must publish the CNAME records provided by Microsoft and enable the corresponding signing. Subdomains. Each subdomain used to send from Microsoft 365 needs its own DKIM configuration. Third parties. If we use: CRM, marketing, ecommerce or ticketing, it is advisable to try to have these services sign DKIM using our own domain or subdomain when the platform supports it.

DKIM does not replace DMARC. We can have: DKIM=pass but the signed domain is not aligned with the visible domain of the From. Official reference: Microsoft – Configure DKIM.

Deploy DMARC without breaking legitimate email

DMARC allows the domain owner to publish a policy for mail that does not pass aligned authentication. A typical business implementation.

It is not mandatory to go through exactly all the steps. The sequence depends on the control we have over the domain. For example, a new domain that we know will never send mail can be directly protected in a much more restrictive way. DMARC needs alignment. To pass DMARC we need: SPF or DKIM pass and are aligned with the visible From. Official reference: Microsoft – Configure DMARC.

Protect unused domains

A domain that we do not use for email can also be spoofed. Example. The company owns: empresa-group.com but it never sends mail from that domain. An attacker could try to use it to trick customers or employees. Microsoft recommends for parked domains. DMARC with: v=DMARC1; p=reject; when no one should legitimately send from that domain. Do not publish DKIM unnecessarily. Microsoft also recommends not publishing DKIM records for parked domains that should not be sent.

Check onmicrosoft.com. If the domain tenant.onmicrosoft.com It is also not used for shipping, it is worth checking its DMARC protection. Official reference: Microsoft – DMARC for MOERA and parked domains.

Quarantine: who can release what

Quarantine shouldn’t just be a folder that no one checks. The quarantine policies define: what the user can see, what they can release, whether they can request release, and what notifications they receive. Not all verdicts should have the same access.

Important technical restriction. Users cannot directly release quarantined messages such as: malware, Safe Attachments malware/phishing, or high confidence phishing. Depending on the policy they may request release, but the final decision requires administration. Notifications. We can configure quarantine notifications and customize them, but we must avoid generating so many alerts that users start releasing messages without analyzing them.

Official reference: Microsoft – Quarantine.

False positives: use Submissions and Tenant Allow/Block List

When Microsoft blocks a legitimate message, the solution should not be: “We add the entire domain to allowed and that’s it.” Investigate first. We review: verdict, headers, SPF, DKIM, DMARC, URLs, attachments, rules, connectors and exact reason for detection. Then use Submissions. The page Submissions allows you to send to Microsoft: email, URLs and attachments as false positives or false negatives. Tenant Allow/Block List.

Allows you to manage overrides for: domains/addresses, spoofed senders, files, URLs, certain IPs and supported Teams elements. Allows should be temporary whenever possible. Microsoft intentionally limits many allow entries because a permanent allow can become an avenue of attack. High confidence phishing and malware. We can’t just create any direct allow to bypass these verdicts. Microsoft uses flow Submissions for certain high-risk overrides.

Blocks also have an impact. Blocking a domain on Tenant Allow/Block List can: classify your email as high confidence phishing and even prevent internal users from sending to that domain. Therefore, it should not be used as a casual spam list. Official reference: Microsoft – Tenant Allow/Block List.

Advanced Delivery: the right exception for SecOps simulations and mailboxes

There are cases where we need certain messages not to be filtered in the usual way. Example 1: external phishing simulation. A third-party training platform needs to send simulated phishing. If we simply create: SCL rule -1, allow sender, allow domain, we are creating a security bypass that is difficult to control. The specific solution is Advanced Delivery. Microsoft provides a dedicated policy for: non-Microsoft phishing simulations and SecOps mailboxes.

Example 2: SOC mailbox. A mailbox used to receive suspicious samples needs different treatment than a normal user. Advanced Delivery allows you to define that scenario explicitly. Official reference: Microsoft – Advanced Delivery.

The Outlook Report button must be part of the process

Users will detect some messages that the technology does not initially detect. We have to provide them with an easy way to report them. Native button. Microsoft currently incorporates the button Report in supported versions of Outlook. Allows: Report phishing, Report junk and Not junk. Destination. Since User reported settings we can configure the reported messages to send: to Microsoft, to an internal reporting mailbox or to both.

Don’t ask users to simply forward the phishing. A normal forward may lose some of the context and metadata necessary to correctly parse the message. Old accessories. Microsoft is phasing out the old ones: Report Message / Report Phishing add-ins in favor of the built-in Outlook button. Official reference: Microsoft – Report messages in Outlook.

Investigating is not the same as blocking

When phishing gets past the first line of defense we need to answer specific questions.

Real-time detections and Threat Explorer

Research experience depends on the plan. Plan 1. Includes Real-time detections. Plan 2. Includes Threat Explorer, with broader hunting and research capabilities. Research window. Explorer allows you to consult different views of recent threats and work on: messages, malware, phishing, URLs, campaigns and other artifacts. Operational example. The SOC receives: “I opened this email and I think it was fake.”

The process should allow you to locate: message → sender → recipients → URL → clicks → campaign → remediation. Official reference: Microsoft – Threat Explorer and Real-time detections.

Automated Investigation and Response

In Plan 2, AIR allows you to automate part of the analysis of certain threats. An especially interesting example in 2026. When a user reports a message as phishing, Defender for Office 365 Plan 2 can automatically create an AIR investigation. Automatic feedback response. Administrators can configure the user to later receive a notification with the result of the investigation. This greatly improves the cycle: user reports → security investigates → user receives feedback.

Why it is useful. If users report messages and never know what happened, engagement often deteriorates. A feedback mechanism reinforces correct behavior. Automate does not mean ignore. Investigations, pending actions and remediations continue to require: monitoring, ownership and procedure. Official reference: Microsoft – Automated Investigation and Response.

Phishing or BEC response runbook

Detecting the message is not the end of the incident. Phase 1: identify.

Phase 2: determine exposure. Any user: opened, clicked, downloaded, entered credentials or executed a file? Phase 3: contain message. When applicable: remediate or purge messages, block flags, and send samples to Microsoft. Phase 4: contain identity. If there are signs of compromise: revoke sessions, review credentials, MFA methods, Inbox rules, forwarding, OAuth consent and login activity.

Phase 5: review endpoints. If there was download or execution: correlate with Microsoft Defender for Endpoint or another EDR platform. Phase 6: review business impact. At BEC: payments, bank changes, invoices, suppliers and transfers. Phase 7: look for persistence. Review: Inbox rules, forwarding, delegates, OAuth apps, sessions and administrative changes. Phase 8: communication. Notify: affected users, security, management, legal or suppliers depending on the incident.

Phase 9: improve controls. Do not close the incident with: “deleted mail”. You have to ask yourself: Why did it come about and what can we improve without creating a dangerous bypass?

Attack Simulation Training: training based on real risk

Plan 2 includes Attack Simulation Training. It should not be used as an exam to “catch” employees. Its value is in measuring patterns and providing contextual training. Available techniques. Microsoft allows you to work with different scenarios, including: Credential Harvest, Malware Attachment, Link in Attachment, Link to Malware and Drive-by URL, in addition to other supported experiences. QR phishing. Attack Simulation Training currently supports: payloads with QR codes, specific training modules for QR phishing.

Payload automation. An especially useful capability is to use safe versions of real phishing patterns that the organization has received to build subsequent simulations. Useful metrics.

Microsoft does not store credentials entered in a Credential Harvest simulation. Information entered on the simulation page is discarded; what is recorded is the event necessary to measure the behavior.

Measure trends, do not look for blame

It is more useful to ask: “Has the risk gone down for six months?” that: “Who suspended the March campaign?” Official reference: Microsoft – Attack Simulation Training.

Useful PowerShell to review Defender for Office 365

Core settings can be managed from the Microsoft Defender portal, but PowerShell is especially useful for: inventory, documentation, comparison and validation of policies.

Connection

Install-Module ExchangeOnlineManagement -Scope CurrentUser

Connect-ExchangeOnline -UserPrincipalName admin@empresa.com

Review anti-phishing policies

Get-AntiPhishPolicy |
    Format-List Name,
                Enabled,
                EnableSpoofIntelligence,
                EnableMailboxIntelligence,
                EnableTargetedUserProtection,
                EnableTargetedDomainsProtection,
                PhishThresholdLevel

Review anti-phishing rules

Get-AntiPhishRule |
    Select-Object Name,State,Priority,AntiPhishPolicy

Check anti-malware

Get-MalwareFilterPolicy |
    Format-List Name,
                EnableFileFilter,
                FileTypes,
                ZapEnabled,
                QuarantineTag

Check anti-spam inbound

Get-HostedContentFilterPolicy |
    Format-List Name,
                BulkThreshold,
                SpamAction,
                HighConfidenceSpamAction,
                PhishSpamAction,
                HighConfidencePhishAction,
                SpamZapEnabled,
                PhishZapEnabled,
                QuarantineRetentionPeriod

Check outbound spam

Get-HostedOutboundSpamFilterPolicy |
    Format-List Name,
                AutoForwardingMode,
                RecipientLimitExternalPerHour,
                RecipientLimitInternalPerHour,
                RecipientLimitPerDay,
                ActionWhenThresholdReached

Review Safe Links

Get-SafeLinksPolicy |
    Format-List Name,
                IsEnabled,
                EnableSafeLinksForEmail,
                EnableSafeLinksForTeams,
                EnableSafeLinksForOffice,
                EnableForInternalSenders,
                ScanUrls,
                DeliverMessageAfterScan,
                TrackClicks,
                AllowClickThrough,
                DoNotRewriteUrls

Review Safe Links rules

Get-SafeLinksRule |
    Select-Object Name,State,Priority,SafeLinksPolicy

Review Safe Attachments

Get-SafeAttachmentPolicy |
    Format-List Name,
                Enable,
                Action,
                QuarantineTag

Review Safe Attachment rules

Get-SafeAttachmentRule |
    Select-Object Name,State,Priority,SafeAttachmentPolicy

Check Standard preset

Get-EOPProtectionPolicyRule `
    -Identity "Standard Preset Security Policy" |
    Format-List

Get-ATPProtectionPolicyRule `
    -Identity "Standard Preset Security Policy" |
    Format-List

Review Strict preset

Get-EOPProtectionPolicyRule `
    -Identity "Strict Preset Security Policy" |
    Format-List

Get-ATPProtectionPolicyRule `
    -Identity "Strict Preset Security Policy" |
    Format-List

Review Built-in Protection

Get-ATPBuiltInProtectionRule |
    Format-List

Find rules that can bypass the spam filter

Get-TransportRule |
    Select-Object Name,State,Mode,SetSCL

Review anti-spam allow lists

Get-HostedContentFilterPolicy |
    Select-Object Name,
                  AllowedSenders,
                  AllowedSenderDomains,
                  BlockedSenders,
                  BlockedSenderDomains

Review SPF/DKIM from Microsoft 365

Get-DkimSigningConfig |
    Select-Object Domain,Enabled,Status,Selector1CNAME,Selector2CNAME

I don’t recommend publishing a script that “sets everything up” automatically. Microsoft’s presets and portal provide a much more maintainable baseline. PowerShell is great for: assessment → inventory → comparison → documentation. Changes should be made in a controlled manner, first understanding which users are within each policy.

What metrics to review after deployment

A metric that should not grow indefinitely. Number of allow lists. An organization that adds more exceptions every month may be slowly weakening the filter.

Deployment roadmap in 90 days

Days 1–15: understand the environment.

Days 16–30: baseline.

Days 31–45: Authentication and phishing.

Days 46–60: Safe Links, Attachments and collaboration.

Days 61–75: operation.

Days 76–90: Plan 2 and continuous improvement.

Common errors when setting up Microsoft Defender for Office 365

Microsoft Defender for Office 365 Checklist

Microsoft Defender for Office 365 FAQ

Does Defender for Office 365 replace all email security?

It is part of a layered protection that also depends on email configuration, domain authentication, identity and incident response. Available capacities vary by plan. To define the project, you must identify which risks will be covered and who will investigate the alerts, in addition to verifying that the policies reach the intended users.

Is it advisable to create a personalized policy for each department?

Only when there is a need that justifies a different configuration. First, you must understand the precedence of pre-established policies and protections. Multiplying configurations without a clear reason makes it difficult to know which control applies to a recipient and can leave exceptions or overlaps that go undetected until an incident.

What do you do when a legitimate email is blocked?

The sample is located and the blocking reason, flow, and authentication results are analyzed. The appropriate review or exception procedure is then used and the delivery is verified with new evidence. The authorization must be limited to the necessary scope and documented; too broad an allow list can override useful controls.

What shows that the deployment works?

The coverage of policies, the correct management of samples and the response to real or controlled cases provide useful evidence. It is also interesting to measure investigation times, false positives and repeated incidents. A high number of blocked messages alone does not allow us to conclude that users and company processes are well protected.

Final recommendations: Defender for Office 365 works best as a system, not a collection of policies

Microsoft Defender for Office 365 It can significantly reduce the risk associated with email and certain collaboration experiences, but its effectiveness depends on how its different layers are integrated. The first step should not be Safe Links. It should be understanding how mail actually arrives. If an external gateway exists, you should review Enhanced Filtering for Connectors and authentication before creating rules that bypass filtering.

Next we need a consistent base. Microsoft provides profiles precisely for this Standard and Strict. For most organizations, they are preferable to trying to manually replicate dozens of recommendations. Standard can be used as a general baseline and Strict can be reserved for high-value users when it fits the risk profile. The different layers work on that basis. Anti-phishing helps distinguish spoofing and impersonation. Mailbox intelligence incorporates context of common relationships. Safe Links protects URLs, including click-through verification. Safe Attachments scans unknown files using detonation.

But security does not end at delivery. Zero-hour Auto Purge allows you to react when Microsoft later discovers that an already delivered message was malicious. The users themselves provide another signal. Correctly configure the button Report Outlook allows you to convert a suspicious email into a structured entry for SecOps, and in Plan 2, a phishing report can automatically trigger an AIR investigation.

We also need to authenticate our own domains. SPF indicates which systems can send, DKIM signs messages, and DMARC checks alignment with the visible sender and publishes a policy. All three should be part of a single strategy. And we must not forget the domains that we do not use: an unprotected parked domain can still be attractive to an attacker. The daily operation is just as important.

Quarantine policies should determine what each user can release. Tenant Allow/Block List should be used with care. False positives should be resolved through Submissions and configuration fixes before resorting to permanent allow lists. For external phishing simulations or SecOps mailboxes there is Advanced Delivery; creating broad SCL -1 rules should not be the first option. With Plan 2 we can go further.

Threat Explorer helps investigate campaigns and artifacts, AIR automates certain investigations, and Attack Simulation Training allows you to evaluate resistance to techniques such as credential harvesting or QR phishing. Finally, the goal is not to get “Defender in green.” The really useful question is: If a user receives sophisticated phishing tomorrow, do we have enough controls to detect it, enough signals to investigate it, and a clear procedure to contain the impact if someone interacts with it?

When the answer is yes, Defender for Office 365 stops being a set of licenses and starts working as a real email security architecture.

Recommended official documentation

Microsoft Defender for Office 365.

• Microsoft – Microsoft Defender for Office 365
• Microsoft – Defender for Office 365 service description
• Microsoft – Defender for Office 365 features

Recommended settings.

• Microsoft – Recommended settings for EOP and Defender for Office 365
• Microsoft – Preset security policies
• Microsoft – Policy precedence

Anti-phishing.

• Microsoft – Anti-phishing protection
• Microsoft – Anti-phishing policies
• Microsoft – Anti-spoofing protection
• Microsoft – Tune anti-phishing protection

Anti-malware and anti-spam.

• Microsoft – Anti-malware policies
• Microsoft – Anti-spam policies
• Microsoft – Spam Confidence Level

Safe Links.

• Microsoft – Safe Links
• Microsoft – Configure Safe Links

Safe Attachments.

• Microsoft – Safe Attachments
• Microsoft – Configure Safe Attachments
• Microsoft – Safe Attachments for SharePoint, OneDrive and Teams

ZAP.

• Microsoft – Zero-hour Auto Purge
• Microsoft – Defender for Office 365 reports

SPF, DKIM, DMARC and authentication.

• Microsoft – Email authentication
• Microsoft – Configure SPF
• Microsoft – Configure DKIM
• Microsoft – Configure DMARC
• Microsoft – Troubleshoot email authentication
• Microsoft – DMARC for parked domains

Gateways and mail flow.

• Microsoft – Enhanced Filtering for Connectors
• Microsoft – Secure by default

Quarantine, Submissions and Allow/Block.

• Microsoft – Quarantine
• Microsoft – Quarantine policies
• Microsoft – Tenant Allow/Block List
• Microsoft – Submit messages and files to Microsoft
• Microsoft – Advanced Delivery

User reporting.

• Microsoft – Report suspicious messages in Outlook
• Microsoft – Admin review of user-reported messages

Investigation and response.

• Microsoft – Threat Explorer and Real-time detections
• Microsoft – Automated Investigation and Response
• Microsoft – Automatic feedback for user-reported phishing

Attack Simulation Training.

• Microsoft – Attack Simulation Training
• Microsoft – Attack Simulation Training FAQ
• Microsoft – Payload automations