Email security with Microsoft 365, part 2: getting Defender for Office 365 right

Part 1 of this series showed how SPF, DKIM and DMARC protect your domain against outbound abuse. This part covers the opposite direction: mail arriving at your organisation. In Microsoft 365 that is the job of Defender for Office 365, an additional layer on top of the baseline filtering every Exchange Online mailbox has.

Are we already paying for Defender for Office 365 without using it?

Probably yes, if you use Microsoft 365 Business Premium or an E5 licence. Plan 1 is included in Microsoft 365 Business Premium and, since 1 July 2026, also in Office 365 E3 and Microsoft 365 E3 (service description). Plan 2 is included in Microsoft 365 E5. Plan 1 provides the protection features; Plan 2 adds investigation tools, automated response and phishing simulations.

For management, the key question is whether the licence is configured. Out of the box only baseline protection is active; the remaining features need a decision.

What does each protection feature do?

Impersonation protection. Detects messages whose sender name or domain imitates a real person or company, such as a message “from the managing director” sent from an unknown address. You define which people (protected users) and which domains are protected. Mailbox intelligence also learns who each person corresponds with regularly. For management this means: your name belongs on the list, as do the finance lead, accounts payable and everyone who approves payments.

Safe Links. Checks links on delivery and again at the moment of the click. A link that was harmless on arrival and later redirects to a phishing page is still blocked. The protection also applies in Teams and supported Office apps.

Safe Attachments. Opens unknown attachments in an isolated environment and observes their behaviour (detonation). With Dynamic Delivery, recipients get the message immediately and the attachment follows once it has been checked, so day-to-day business is not held up.

Zero-hour auto purge (ZAP). Removes messages from mailboxes after delivery if they turn out to be malicious. ZAP works on mail delivered within the last 48 hours and also covers Teams messages. ZAP is already part of the baseline protection of every Exchange Online mailbox; check that it has not been disabled in your policies.

User reported settings. The built-in Report button in Outlook sends suspicious messages to your security team, to Microsoft, or both. By default, reports go to the global administrator’s mailbox. A dedicated reporting mailbox is the better choice.

Attack simulation training (Plan 2 only). Simulated phishing campaigns followed by training. Useful once the technical foundations are in place, and it provides measurable results for awareness evidence.

Why are preset policies better than custom ones?

There are three preset security policies: Built-in protection, Standard and Strict. Only Built-in protection is active by default and provides basic Safe Links and Safe Attachments coverage. Standard and Strict apply to no one until you assign recipients.

The advantage of presets: Microsoft maintains the settings and updates them when new protection capabilities arrive. Custom policies, by contrast, age quietly. Our recommendation: Standard for all staff, Strict for management, finance and administrators. Custom policies only where a business reason is documented. Mind the order: presets are applied before custom policies, so anyone in a preset gets its settings.

The only values you maintain yourself in Standard and Strict are the impersonation protection entries. Each preset accepts up to 350 protected users. Domains you own and mailbox intelligence are covered automatically.

What do quarantine policies control?

Quarantine policies determine what staff may do with held messages and whether they are told about them. Messages classified as malware or high confidence phishing can never be released by recipients themselves; at most they can request a release. For spam, self-release is reasonable.

Notifications are what matter most. Only certain default policies send quarantine notifications, including the one used in the presets. Without notifications, nobody notices that an expected invoice was held, and IT receives phone calls instead of traceable release requests. Release requests generate an alert to administrators by default. Decide who handles these alerts and how quickly.

Which misconfigurations do we see most often?

• Presets assigned to no one. The licence is there, but Standard and Strict are off. Only baseline protection applies.
• Impersonation lists left empty. Without listed people, the filter has limited ability to detect fake messages “from the managing director”.
• Quarantine notifications off. From the user’s point of view, messages simply vanish. Trust in the solution drops and exceptions follow.
• Allow lists that bypass the checks. Entries in the IP Allow List skip spam filtering and SPF, DKIM and DMARC checks. Mail flow rules that bypass spam filtering have a similar effect. Malware and high confidence phishing are still caught as long as your MX record points to Microsoft 365, but everything below that is not. Allow entries belong in the Tenant Allow/Block List, with an expiry date.
• Reports landing in the admin mailbox. Nobody reviews them systematically.

Why email protection alone is not enough and sign-ins need protecting as well is something we cover in our webinar recording.

How do I show auditors and insurers that the protection works?

Two tools in the Microsoft Defender portal cover most evidence needs:

• The Threat protection status report shows which threats were detected and how they were handled, by time period and detection technology.
• The configuration analyzer compares your policies with the Standard and Strict recommendations and lists deviations. Its configuration drift view records who changed which setting and when, provided unified audit logging is enabled.

Export both at fixed intervals and file the results with your compliance evidence.

The next step

You are accountable for making sure the protection you pay for actually works. We provide the evidence. In our Gap Assessment we review your Defender for Office 365 configuration against the Standard and Strict settings and deliver a prioritised list of measures. As part of Managed Security we handle the ongoing review of reported messages, quarantine and alerts.

Book an introductory call

Frequently Asked Questions

Isn’t the baseline protection in Exchange Online enough?

Baseline protection filters broad, known attacks. It does not include impersonation protection, and it has limited ability to detect links that turn malicious after delivery or unknown malware in attachments. Defender for Office 365 closes these gaps with impersonation protection, Safe Links and Safe Attachments.

Should staff be allowed to release messages from quarantine themselves?

For spam, yes. For malware and high confidence phishing Microsoft does not allow it anyway; staff can only request a release. What matters is that notifications are on and someone handles release requests promptly.

Standard or Strict, which should we use?

Standard suits most staff. Strict sends more messages to quarantine and fits people who are frequent targets of fraud attempts, such as management, finance and administrators. Both profiles can be assigned to different groups in parallel.

Do we need Plan 2?

Plan 1 contains the protection features. Plan 2 is worthwhile if you want to investigate incidents yourself, automate responses or run phishing simulations for awareness evidence. Without an in-house security team or a provider who operates these tools, the added value is limited.