Exchange Online Protection and Defender for Office 365: Setting Up Anti-Spam, Anti-Malware, and Anti-Phishing

"Built-in spam and malware protection" is true and incomplete. Attackers specifically target tenants that rely only on defaults, because defaults are tuned to avoid false positives, not to stop targeted phishing. Treat the default as a start.

The Layers of Protection

Layer	What it does	Default state
Connection filtering	Blocks known bad IP addresses; allow and block lists	On
Anti-malware	Scans attachments with multiple engines; common attachment types filter	On (Default policy)
Anti-spam	Content filtering, bulk detection, spam actions	On (Default policy, standard settings)
Anti-phishing	Spoof intelligence, basic impersonation checks	On (basic); advanced needs Defender for Office 365
Zero-hour auto purge (ZAP)	Removes delivered mail later found to be malicious	On
Outbound spam protection	Limits and blocks compromised accounts sending spam; blocks automatic external forwarding	On
Mail flow rules	Your custom policies	Off until you create them
Safe Links	Rewrites and checks URLs at click time	Defender for Office 365 only; configure
Safe Attachments	Detonates attachments in a sandbox before delivery	Defender for Office 365 only; configure
Email authentication checks	SPF, DKIM, DMARC evaluation of inbound mail	Evaluated by default; your domains' records are your job
User and admin reporting	Report message, submissions	Configure

Defender for Office 365 comes in Plan 1 and Plan 2. Plan 1 includes Safe Links and Safe Attachments. Plan 2 adds Threat Explorer, automated investigation and response, attack simulation training, and more. Microsoft 365 Business Premium includes Plan 1, and E5 includes Plan 2. Check what your licenses include before you design.

How the Policies Are Evaluated

Microsoft's security policies come from several places, and the order matters:

1. Strict preset security policy (highest precedence if it applies).
2. Standard preset security policy.
3. Custom policies you create (ordered by priority number).
4. Built-in protection preset (a minimal, always-on baseline for Safe Links and Safe Attachments, available with Defender for Office 365).
5. Default policies (the base policy in each category).

A user is covered by the first policy in this order that applies to them, and the rest are ignored for that user. This is why a custom anti-spam policy you built months ago can be silently overridden when someone turns on the Standard preset for everyone. When troubleshooting, find which policy actually applies to the user.

The Microsoft Defender portal has an Configuration analyzer (Email & collaboration, Policies & rules, Threat policies, Configuration analyzer) that compares your settings to the Standard and Strict recommendations and lists the gaps.

Step 1: Turn On Preset Security Policies

Presets apply Microsoft's recommended settings in one step.

1. Open the Microsoft Defender portal, Email & collaboration, Policies & rules, Threat policies, Preset security policies.
2. Under Standard protection, choose Manage protection settings.
3. Apply Exchange Online Protection to all recipients (or to groups for the pilot), and, if licensed, Defender for Office 365 protection.
4. Add sensitive user protection for executives and finance (user impersonation protection) in the Strict preset or a custom policy.
5. Review and save.

Standard or Strict? Standard fits most organizations. Strict is more aggressive (more mail quarantined, shorter user wait times) and suits high-risk users. A common design is Standard for everyone and Strict for executives, finance, and IT admins. Presets cannot be edited setting by setting; if you need to tune, create a custom policy.

Step 2: Email Authentication for Your Own Domains

Authentication protects your domain from spoofing and improves delivery.

• SPF lists who may send for your domain. Publish a single SPF record that includes include:spf.protection.outlook.com and any other legitimate senders, and end with -all once you are confident.
• DKIM signs mail from your domain. In the Defender portal open Email authentication settings, DKIM, and enable signing for each domain, after publishing the two CNAME records the portal shows.
• DMARC tells receivers what to do when SPF and DKIM fail. Start with p=none and a reporting address, review reports, move to p=quarantine, then p=reject.
• MTA-STS and TLS reporting (optional) force encrypted delivery.
• ARC helps when a forwarder or list changes a message.

Our deeper guide: DKIM, SPF, DMARC, and ARC in Exchange Online. Remember that third-party senders (marketing tools, CRMs, ticketing systems) must be added to SPF or sign with DKIM, or DMARC enforcement will reject them.

Step 3: Safe Links and Safe Attachments

If your license includes Defender for Office 365:

• Safe Links checks URLs at click time, not only at delivery, so a link that turns malicious later is still caught. Turn it on for email, Teams, and Office apps; do not allow users to click through to the original URL; and enable scanning of URLs and rewriting.
• Safe Attachments opens attachments in a sandbox before delivery. The Dynamic Delivery option delivers the message body immediately and the attachment when the scan finishes, so users are not delayed. Use *Block* as the response for malware.
• Safe Attachments for SharePoint, OneDrive, and Teams protects files in those services.
• Built-in protection provides a baseline for all users, even without a custom policy.

Test these on a pilot group first, since a click-time scan changes how links look to users.

Step 4: Impersonation and Spoof Protection

Attackers often impersonate a person (the CEO, the finance director) or a domain that looks like yours.

• User impersonation protection lists protected users (executives, finance). Messages that appear to come from them but originate elsewhere are flagged.
• Domain impersonation protection covers your own domains and the partners you list.
• Mailbox intelligence learns who each user normally corresponds with and detects impersonation of those contacts.
• Spoof intelligence reviews senders that spoof your domain, and lets you allow legitimate spoofing (for example a service that sends on your behalf), carefully.
• First contact safety tips warn users on a first message from a new sender.

Tune the actions: quarantine for high-confidence impersonation, a safety tip for medium confidence. Add the protected users in the anti-phishing policy under *Phishing threshold & protection*.

Step 5: Outbound Protection

Compromised accounts send spam and phishing, which harms your reputation and gets your domain listed.

• Keep the default outbound spam policy and tune the recipient limits for external and internal mail. Choose an action when limits are exceeded: restrict the user and alert admins.
• Notify admins of blocked senders: set the notification address in the outbound policy.
• Keep automatic external forwarding blocked. See inbox rules.
• Review restricted users in the Defender portal (Email & collaboration, Review, Restricted entities) and unblock after you have secured the account.

Step 6: Allow and Block Lists, Used Carefully

The Tenant Allow/Block List lets you allow or block senders, domains, URLs, and files. Rules of thumb:

• Prefer submitting a false positive to Microsoft over adding an allow entry. Allow entries bypass filtering and give attackers a free pass if the sender is compromised or spoofed.
• Use temporary allow entries with an expiry.
• Use mail flow rules to bypass filtering only for trusted partners, and restrict by authenticated connector, not by sender address alone.
• Block entries for confirmed bad senders are safe and useful.

Never add your own domain to an allow list. That is a common mistake that lets spoofed mail through.

Step 7: Users, Quarantine, and Reporting

• Report message add-in. Deploy the Microsoft Report Message or Report Phishing button to users, and send reports to Microsoft and optionally to a security mailbox.
• Quarantine policies decide what users may do with quarantined mail (view, release, request release). High-risk phishing should not be user-releasable.
• Quarantine notifications let users review spam digests. Keep them on for spam, off for malware and high-confidence phishing.
• Attack simulation training (Plan 2) runs phishing tests and assigns training.
• Awareness. Teach users to check the sender, hover over links, and report anything odd. Technical controls fail without it.

Step 8: Investigate and Respond

When a bad message gets through:

1. Find it. In Threat Explorer (Plan 2) or Explorer and Real-time detections (Plan 1), search by sender, subject, or URL.
2. Contain it. Use *Take action* to soft delete or move to quarantine across all mailboxes. For tenants without Explorer, use Content Search with purge (see recovering deleted email).
3. Check impact. Who clicked, who replied, who opened the attachment. Check Safe Links click data and sign-in logs for those users.
4. Reset compromised accounts. Reset the password, revoke sessions, review rules and delegates.
5. Block. Add confirmed bad senders, domains, and URLs to the block list.
6. Submit the message to Microsoft so filters learn from it.
7. Review the policy. Why did it pass? Adjust anti-phishing thresholds or impersonation settings.

Run through this with a drill so the team knows who does what.

Testing Your Protection

• Send an EICAR test file (a harmless antivirus test string) from an external account to a test mailbox. It should be blocked or quarantined. Do not use real malware.
• Send a message with a link to a Microsoft-provided test URL, if your policy supports it, to see Safe Links behavior.
• Send a test message that spoofs a protected user (from a test domain you control) and see how it is handled.
• Check message trace in the Exchange admin center or the Defender portal to see the filtering verdicts.
• Use the Configuration analyzer and Microsoft Secure Score to measure gaps.

Message trace and message headers show verdicts. In the header, X-Forefront-Antispam-Report contains SFV (the spam filtering verdict, for example SPM for spam, NSPM for not spam) and CAT (the category, such as PHSH for phishing or MALW for malware), which tell you why a message was treated as it was.

Monitoring and Maintenance

• Review Threat protection status and Mailflow status reports weekly.
• Review Top targeted users and Top malware to tune protection.
• Watch Secure Score recommendations for Exchange and Defender.
• Set up alert policies for suspicious forwarding rules, user-reported messages, and compromised accounts, and route them to a monitored mailbox or SIEM.
• Revisit policies after every major change: new domains, a new third-party sender, a merger.
• Combine with sign-in security from access from anywhere, because most damage comes from stolen sign-ins, not filtered mail.

How to Check It Worked

• The Standard or Strict preset shows as On and applied to the intended users.
• DKIM shows Enabled for each domain; DMARC reports arrive and show passing mail.
• An EICAR test is blocked.
• A user can report a phishing message and it reaches the security mailbox.
• Message trace shows expected verdicts for test messages.
• The Configuration analyzer shows no high-priority gaps.

Troubleshooting

Symptom	Likely cause
Legitimate mail goes to Junk or quarantine	Sender lacks SPF/DKIM, preset too strict, or an impersonation rule. Submit as a false positive and check the verdict
Phishing reaches inboxes	Policy not applied to that user, ZAP delay, or an allow entry or mail flow rule bypass. Check which policy applies
Your own mail fails DMARC	A third-party sender is not in SPF or not signing with DKIM
Users cannot release quarantine	Quarantine policy blocks release for that verdict
Safe Links breaks a site	Link rewriting problem. Add the URL to the policy's do-not-rewrite list, with a reason
Executives get too many warnings	Impersonation settings too sensitive. Tune thresholds
Compromised user sending spam	Restricted by the outbound policy. Secure the account, then unblock

A Short Decision Guide

• Baseline only: EOP defaults, which is not enough for a business.
• Typical business: Standard preset for all, Strict for high-risk users.
• Targeted phishing risk: Defender for Office 365 with impersonation protection.
• Brand protection: SPF, DKIM, DMARC enforcement.
• Accounts as the real risk: MFA and Conditional Access first.

Related guides: DKIM, SPF, DMARC, and ARC, access from anywhere, and inbox rules.

Plan features, portal names, and preset behavior change over time, and I have not tested these settings in your tenant. Use pilot groups and Microsoft's current documentation, and keep Microsoft's own security recommendations as the reference. If you want a review of your email security configuration, get in touch.