Protecting Your Organization
Anti-Phishing Policies: Your Shield Against Email Threats

Overview Understanding Anti-Phishing Policies

Anti-phishing policies are crucial for securing cloud organizations against malicious email attacks. These policies are available in all organizations with cloud mailboxes, offering essential protection. Microsoft Defender for Office 365 enhances these capabilities with advanced features.

This guide provides a detailed look at configuring and managing anti-phishing policies, covering essential settings, spoof intelligence, and DMARC configurations to fortify your email security.

Policy Types Anti-Phishing Policies: Default vs. Defender for Office 365

There are two primary types of anti-phishing policies: those for all cloud mailboxes and those within Microsoft Defender for Office 365.

While both offer core features, Defender for Office 365 provides advanced capabilities like impersonation protection and AI-driven threat detection. Key differences include the availability of impersonation settings, phishing email thresholds, and advanced reporting. Both types support custom policy creation and common policy settings. The default policy applies to all recipients, while custom policies allow for specific recipient filtering.

Common Settings Configuring Common Anti-Phishing Policy Settings

Several settings are common to both policy types. These include configuring recipient filters (users, groups, and domains) to apply the policy to specific internal recipients. Custom policies require at least one condition, whereas the default policy applies to all recipients. You can create conditions and exceptions to refine policy application, using 'OR' logic for multiple values within a condition or exception, and 'AND' logic across different conditions.

Consider examples like applying a policy to specific users or groups, or excluding certain domains. Remember, detailed configuration enables precision in safeguarding your organization against email threats.

Spoof Settings Understanding and Managing

Spoofing, where the 'From' address doesn't match the email source domain, is a key tactic in phishing attacks. Enable spoof intelligence to automatically detect and manage spoofed senders. When enabled, the system shows spoofed senders in the spoof intelligence insight, allowing you to override the verdicts to allow or block senders. You can also create manual allow/block entries in the Tenant Allow/Block List.

Configure actions for blocked spoofed senders, such as moving messages to Junk Email folders or quarantining them. When quarantining, select a quarantine policy defining user actions. Remember that spoof intelligence is the engine behind spoof detection. Therefore it is vital to be enabled to receive its benefits. In addition, consider using sender DMARC policies.

“

Anti-phishing policies are essential for cloud security, providing layered protection against malicious emails.

Security Expert

DMARC Policy and Anti-Phishing Policies

DMARC (Domain-based Message Authentication, Reporting & Conformance) policies further enhance email security by defining actions for emails failing DMARC checks. The ‘Honor DMARC record policy when the message is detected as spoof’ setting controls how your anti-phishing policy interacts with sender DMARC settings.

If a message fails DMARC checks, you can specify actions based on the sender's DMARC policy, such as quarantining or rejecting the message. Understand the relationship between spoof intelligence and DMARC settings. Explicit and implicit failures have different handling based on whether spoof intelligence is enabled or disabled and the sender's DMARC policy (p=quarantine, p=reject or p=none)

Summary Strengthening Your Email Security Posture

By implementing and continuously refining anti-phishing policies, you significantly bolster your organization’s defenses against email-based attacks. Regularly review your policies, update recipient filters, and monitor spoof intelligence insights to maintain a robust security posture. Leveraging Microsoft Defender for Office 365 enhances these protections, providing advanced detection and response capabilities.

Stay informed, stay proactive, and protect your organization from evolving phishing threats. Make sure to continuously monitor and refine your approach.