Microsoft 365 phishing protection

What Microsoft 365 includes for phishing protection

Microsoft describes its email protection as a ladder. Every organisation with Exchange Online mailboxes starts on the bottom rung, and each licence adds to it:

The built-in layer is what most people still call Exchange Online Protection (EOP); Microsoft's documentation now calls it the built-in security features for all cloud mailboxes. Microsoft says it is aimed at broad, volume-based, known attacks. Plan 1 is the step that targets zero-day malware, targeted phishing and business email compromise, and Microsoft lists it in subscriptions such as Microsoft 365 Business Premium and Microsoft 365 E3, with Plan 2 in subscriptions such as Microsoft 365 E5. Both plans are also sold as add-ons. Our sister site explains the plans in depth on its Microsoft Defender for Office 365 page.

A quick check of what you have: in the Microsoft Defender portal, a tenant with Plan 1 shows Real-time detections under Email & collaboration, and a tenant with Plan 2 shows Explorer instead.

How to configure the anti-phishing policy in Microsoft 365

Anti-phishing policies live in the Microsoft Defender portal at Email & collaboration > Policies & rules > Threat policies > Anti-phishing. Every tenant has a default policy that applies to all recipients; you can edit it or create custom policies for groups such as finance or the board.

Settings every tenant has - Spoof intelligence: Microsoft recommends leaving it on. The spoof intelligence insight shows senders that were automatically allowed or blocked, so you can review them. - Honor DMARC record policy: applies a sending domain's own quarantine or reject policy when its mail fails authentication. If your MX record points at a gateway in front of Microsoft 365, this only works when Enhanced Filtering for Connectors is turned on for the inbound connector. - Unauthenticated sender indicators: a question mark on the sender's photo, and a "via" tag, when a message fails authentication checks. - First contact safety tip: warns people when a sender is new to them, which is useful against invoice and payment fraud.

Settings that need Defender for Office 365 - Users to protect: add directors, finance staff and key suppliers' contacts. Microsoft allows up to 350 protected users in each anti-phishing policy, and none are configured by default. - Domains to protect: include all the domains you own, plus partner and supplier domains that criminals are likely to imitate. Trusted domain entries do not cover subdomains, so add each one. - Mailbox intelligence: learns who each user normally corresponds with. The separate setting Enable intelligence for impersonation protection is off by default and must be on for mailbox intelligence to act on what it finds. - Actions and safety tips: choose quarantine or Junk Email for each type of detection, and switch on the user and domain impersonation safety tips. - Phishing email threshold: from 1 (Standard, the default) to 4 (Most aggressive). Higher settings catch more and raise the chance of false positives, so test before raising it for everyone.

For the attacks these settings are built to stop, see our guides to email spoofing, BEC attacks and whaling attacks.

Standard and Strict preset security policies

Rather than tuning every setting by hand, Microsoft recommends turning on its preset security policies. They bundle Microsoft's recommended anti-spam, anti-malware and anti-phishing settings (plus Safe Links and Safe Attachments where you have Defender for Office 365), and Microsoft maintains the values for you.

• Standard suits most users.
• Strict is a more aggressive profile that Microsoft describes as being for high value targets or priority users, such as directors and finance staff. It tends to quarantine less harmful mail, such as bulk and spam, that Standard would leave in Junk Email.
• Built-in protection gives basic Safe Links and Safe Attachments protection to anyone with Defender for Office 365 who is not in Standard, Strict or a custom policy.

Turn them on at Email & collaboration > Policies & rules > Threat policies > Preset security policies. The wizard asks who gets the built-in protection (on a page still titled "Apply Exchange Online Protection"), then who gets the Defender for Office 365 protections, then which users and domains to protect from impersonation. In a preset policy all the domains you own are protected automatically, everyone gets mailbox intelligence, and you can add up to 350 users and 50 custom domains.

Two points catch tenants out. First, presets only help the people you add to them, so check that new starters land in the right group. Second, custom policies with weaker settings can sit alongside the presets; the configuration analyzer in the Defender portal lists every policy that falls below the Standard or Strict baseline so you can fix or retire it.

Safe Links, Safe Attachments, reporting and quarantine

With Defender for Office 365, Safe Links checks links when they are clicked in email, Office apps and Teams, and Safe Attachments detonates attachments in a sandbox before delivery, and covers files in SharePoint, OneDrive and Teams. The preset policies and Built-in protection switch both on.

The rest of the loop is about what happens when something gets through:

• User reporting: the built-in Report button in Outlook lets people report phishing. In the Defender portal's user reported settings you choose whether reports go to Microsoft, to a reporting mailbox your team reviews, or both. Our sister site covers how to report phishing from the user's side.
• Quarantine policies: decide what users can do with quarantined mail and whether they get notifications. Microsoft quarantines malware and high confidence phishing whatever your other settings, and users can only request their release.
• Zero-hour auto purge: when Microsoft's verdict on a delivered message changes, ZAP acts on it in the mailbox. Microsoft says its search covers the last 48 hours of delivered email.

A third-party integrated product goes further on post-delivery removal, pulling a message out of every mailbox it reached, which is one reason organisations add one. See integrated cloud email security.

Block automatic external forwarding

Attackers who take over a mailbox often add an inbox rule that quietly forwards mail to an outside address. Microsoft 365 controls this in the outbound spam filter policy, which has three options:

Because the default is ambiguous, Microsoft advises setting On or Off explicitly. A sensible pattern is Off for everyone, with a separate custom policy for the few mailboxes that have a documented business need. Internal forwarding is not affected. The Auto forwarded messages report shows who is forwarding today, which is worth checking before you switch it off. If forwarding rules appear unexpectedly, treat it as a sign of email account takeover.

Protect your own domains with SPF, DKIM and DMARC

Anti-phishing policies protect your users from other people's mail. Stopping criminals sending as your domain needs email authentication, which Microsoft says helps Microsoft 365 protect against spoofing for both the domains you use and the ones you do not.

1. Publish an SPF record listing Microsoft 365 and every other service that sends as you.
2. Turn on DKIM signing for each custom domain in the Defender portal.
3. Publish a DMARC record at p=none, review the reports, then move to quarantine and reject. Our sister site's DMARC guide covers the record itself, and our page on the "DMARC policy not enabled" warning covers the safe path to enforcement.
4. Add MTA-STS so mail sent to you is delivered over encrypted connections.

The NCSC retired its Mail Check service on 31 March 2026, so organisations now need their own way to collect and read DMARC reports. Our email authentication hub compares the options we supply.

When to add a third-party layer to Microsoft 365

A well-configured Microsoft 365 tenant is a sound baseline. A second product earns its place when you are heavily targeted by invoice fraud or supplier impersonation, when you want messages removed from every mailbox automatically, when you also run Google Workspace or Slack, or when you want someone else's analysts reviewing user reports. The products we supply connect in different ways:

Gateways such as Proofpoint Essentials, Symantec Email Safeguard.cloud and Bitdefender's perimeter mode sit in front of Microsoft 365 instead; see secure email gateway and ICES vs SEG for the trade-offs, and our email security platforms table for the full line-up. If you are weighing Defender against Check Point in particular, our sister site has a Defender for Office 365 vs Harmony Email comparison.

How we help

Forever Systems supplies and supports several email security platforms, so we can tell you honestly whether your tenant needs another product or just better configuration. A typical engagement:

1. Check which Microsoft 365 and Defender for Office 365 licences you hold and who they cover
2. Review anti-phishing, anti-spam, Safe Links and Safe Attachments policies against the Standard and Strict baselines
3. Add impersonation protection for senior and finance staff, set quarantine policies and user reporting, and switch off external forwarding
4. Get SPF, DKIM and DMARC in place for every domain, including the ones that do not send mail
5. If a second layer is justified, trial one in monitor mode first where the vendor offers a trial, then quote it

Pricing for any product is confirmed at quote. If you would rather start with a full tenant review, our sister site offers a Microsoft 365 security assessment. Contact us to talk it through.