Configuring Defender for Office 365 anti-phishing, Safe Links and Safe Attachments

Every Microsoft 365 mailbox gets Exchange Online Protection: anti-malware, anti-spam and basic anti-phishing, including spoof intelligence and the first contact safety tip. Defender for Office 365 (Plan 1 or Plan 2) adds impersonation protection, Safe Links and Safe Attachments.

Microsoft provides three preset security policies:

• Microsoft notes Standard and Strict are probably off on your first visit to the Preset security policies page. Turning them on and assigning users is the single biggest improvement most tenants can make here.
• Presets update automatically when Microsoft changes its recommendations. Custom policies don't.
• Preset policies take precedence over custom policies, and Strict over Standard. Use custom policies only where you need settings the presets can't give you, such as a specific quarantine notification or exception.

Impersonation protection catches messages that look like they come from someone you trust: 'Jon Smith <[email protected]>' instead of your real CEO, or a vendor's domain with one letter changed. This is the engine behind most invoice and payment-redirection fraud, so it deserves care. Microsoft's anti-phishing policy reference lists every setting.

1. 01

   Protect named users

   Add executives, finance leads, payroll, and key external contacts such as your lawyer or main supplier to 'Users to protect'. Microsoft allows up to 350 users per anti-phishing policy.

2. 02

   Protect domains

   Turn on protection for the domains you own and add critical partner domains (your bank, your largest clients and suppliers).

3. 03

   Make mailbox intelligence act

   Mailbox intelligence learns each user's normal correspondents and is on in the default policy. By itself it takes no action on a suspected impersonation: turn on intelligence impersonation protection and choose an action, such as moving the message to Junk or quarantining it.

4. 04

   Choose actions

   Quarantine impersonation detections for protected users and domains; show safety tips so users see why a message looks odd.

5. 05

   Review trusted senders

   Add legitimate lookalikes (a sister company's domain, for example) to trusted senders and domains rather than switching protection off.

Safe Links scans URLs in email before delivery and checks them again when clicked (time-of-click protection), because a link can be clean at 9 a.m. and malicious at noon. Policies can also cover links in Microsoft Teams conversations, group chats and channels, and in supported Office desktop, mobile and web apps.

Microsoft documents an option not to rewrite URLs and check through the Safe Links API only. Rewriting makes links look ugly but means protection still applies when someone opens the message in a client that doesn't support the API. For most small organizations, the Standard preset's settings are the right default. Don't let other link-wrapping services sit in front of Safe Links; Microsoft notes this can stop Safe Links processing links.

Safe Attachments opens attachments in a virtual environment (detonation) after normal anti-malware scanning. Microsoft says scanning typically completes within 15 minutes. The policy action decides what users experience while that happens:

• Use quarantine policies to decide what users can do with their own quarantined mail. Microsoft's defaults already let users view and release spam and bulk mail but not high-confidence phishing or malware; keep that line where it is.
• Use the built-in Report button in Outlook. Microsoft says the older Report Message and Report Phishing add-ins are in maintenance mode and will eventually be deprecated.
• Send user reports to Microsoft and to a reporting mailbox your IT team monitors, so you see what staff are flagging.
• Tell staff that reporting is always right, even if they already clicked. Fast reports shorten incidents.

Once a month, look at the email security reports and Threat Explorer or Real-time detections. Real-time detections is the Plan 1 tool; Threat Explorer comes with Plan 2. Check which users are most targeted, which impersonation attempts were caught, and how many messages were released from quarantine and by whom. Most-targeted users are candidates for Strict protection and phishing-resistant MFA.

Repeated admin releases of the same sender usually mean a policy needs tuning, not more clicking. Fix it with a trusted-sender entry or a policy change rather than releasing the same mail every week.

• Preset security policies, Microsoft Learn
• Anti-phishing policies, Microsoft Learn
• Safe Links overview, Microsoft Learn
• Safe Attachments, Microsoft Learn
• Quarantine policies, Microsoft Learn
• About Threat Explorer and Real-time detections, Microsoft Learn
• Report phishing and suspicious emails in Outlook, Microsoft Learn