Protect Your Organization
Configure Anti-Phishing Policies in Microsoft Defender for Office 365

Understanding Introduction to Anti-Phishing Policies

Anti-phishing policies in Microsoft Defender for Office 365 are crucial for safeguarding your organization against email-based threats. These policies provide comprehensive protection against various phishing attacks, including spoofing and impersonation attempts.

This guide provides step-by-step instructions for configuring and customizing these policies, ensuring maximum protection for your users. Whether you're using Microsoft Defender for Office 365 Plan 1 or Plan 2, or leveraging Microsoft Defender XDR, this guide has you covered.

The default anti-phishing policy is automatically applied to all recipients. However, custom policies allow for greater control and can be tailored to specific users, groups, or domains.

Before You Begin What You Need to Know Before Configuration

Before you begin configuring anti-phishing policies, ensure you have the necessary permissions and access to the Microsoft Defender portal or Exchange Online PowerShell.

You can access the Microsoft Defender portal at [Insert Link to Microsoft Defender Portal].

For PowerShell access, refer to the documentation on connecting to Exchange Online PowerShell [Insert Link to PowerShell documentation].

Required permissions depend on your role and the scope of your actions. Options include Microsoft Defender XDR Unified role-based access control (RBAC), Exchange Online permissions (Organization Management or Security Administrator role groups), and Microsoft Entra permissions (Global Administrator or Security Administrator roles). Make sure the necessary permissions are assigned before proceeding.

Step-by-Step Creating Anti-Phishing Policies Using the Microsoft Defender Portal

Follow these steps to create an anti-phishing policy:

1. In the Microsoft Defender portal, navigate to Email & Collaboration > Policies & Rules > Threat policies > Anti-phishing.

2. Click Create to open the new anti-phishing policy wizard.

3. On the Policy name page, enter a descriptive name and an optional description for the policy.

4. On the Users, groups, and domains page, specify the internal recipients the policy should apply to. You can target specific users, groups, or domains. Use the 'Exclude these users, groups, and domains' section to create exceptions.

5. On the Phishing threshold & protection page, configure the phishing email threshold (Standard, Aggressive, More aggressive, Most aggressive).

6. Configure impersonation settings: Enable user impersonation protection to protect specific senders (individually or by domain). Define actions for impersonation detections.

7. Configure domain impersonation protection by including domains you own and/or custom domains, and defining actions for impersonation detections.

8. After making your selections, review the settings, and click 'Create' or 'Save'.

Allow up to 30 minutes for the new or updated policy to be applied.

“

Implementing robust anti-phishing policies is a proactive measure that significantly reduces the risk of successful phishing attacks.

Microsoft Security Team

Pro Tips Best Practices and Recommendations

Here are some best practices to maximize your anti-phishing policy effectiveness:

Regularly review and update your policies to address evolving threats.

Monitor your email security reports for suspicious activity and fine-tune your settings accordingly.

Educate your users about phishing and train them to identify and report suspicious emails.

Use the 'Most aggressive' phishing threshold if your organization's risk profile warrants it. However, be aware that this might increase the number of false positives.

Leverage domain impersonation protection to safeguard your organization's brand reputation.