Microsoft 365 anti-phishing policy settings: what each one does

Anti-phishing policies are where Microsoft 365 decides what to do with spoofed senders and lookalikes of your people and partners. The settings are spread across two wizard pages, half of them need Defender for Office 365, and the defaults leave the most useful protections switched off. This is a setting-by-setting reference, with Microsoft's Default, Standard and Strict values side by side.

If you want the short version, our guide to stopping phishing in Microsoft 365 gives the order to change things in. This guide is the detail behind it.

Which settings are in EOP and which need Defender?

Anti-phishing policies live at Email & collaboration > Policies & rules > Threat policies > Anti-phishing in the Microsoft Defender portal (https://security.microsoft.com/antiphishing). Microsoft Learn splits the features like this:

Microsoft is explicit that the default policy in Defender for Office 365 "provides spoof protection and mailbox intelligence for all recipients," but the other impersonation features and thresholds "aren't configured in the default policy." Paying for Defender doesn't turn them on. If you're unsure which plan you have, see Defender for Office 365 Plan 1 vs Plan 2.

Who does a policy apply to?

Custom policies need at least one recipient condition: Users, Groups or Domains. The logic trips people up:

• Several values in one condition use OR. Any listed user matches.
• Different condition types use AND. A policy for user romain@contoso.com and group Executives applies only if Romain is in Executives.
• Exceptions always use OR.
• Dynamic distribution groups aren't supported.

Order matters too. The Strict preset policy applies first, then Standard, then custom policies by priority (0 is highest), then the default policy, which is always Lowest. Microsoft says protection "stops for a recipient after the first policy is applied." A user in the Standard preset ignores your custom policy entirely. Preset security policies explains how to plan around that.

What do the spoof settings do?

Spoof settings appear on the Phishing threshold & protection page (Enable spoof intelligence) and the Actions page:

• If the message is detected as spoof by spoof intelligence: Junk Email (default) or quarantine. It applies to senders spoof intelligence blocked automatically, or that you blocked in the Tenant Allow/Block List.
• Honor DMARC record policy when the message is detected as spoof: on by default. You then pick separate actions for p=quarantine (quarantine by default, or Junk) and p=reject (reject by default, or quarantine).

If your MX record points to a gateway, Microsoft says Honor DMARC only applies when Enhanced Filtering for Connectors is enabled on the inbound connector. Don't turn spoof intelligence off because of a gateway; turn Enhanced Filtering on instead.

How spoof intelligence reaches its verdict, the compauth reason codes and how to allow a spoofed sender pair are covered in our guide to Microsoft 365 spoof intelligence.

How does impersonation protection work?

Impersonation is a lookalike, not a forgery. Microsoft's examples: ćóntoso.com for contoso.com, or a real employee's display name on a different address. Microsoft notes impersonation "can pass email authentication checks (SPF, DKIM, and DMARC)" when the attacker registers a lookalike domain and publishes valid records. That's why DMARC alone can't stop it; see lookalike domain phishing.

Note the difference between the two lists. Users, groups, and domains are the recipients the policy protects. Users to protect and Domains to protect are the senders it watches for.

Users to protect

Enable users to protect lets you list internal and external senders by display name and address, up to 350 per policy. By default, no users are listed in any policy. Microsoft recommends key roles: CEO, CFO, senior leaders and board members.

Domains to protect

Enable domains to protect has two parts: Include the domains I own (your accepted domains) and Include custom domains, up to 50 per policy. Microsoft suggests domains "that you don't own, but you frequently interact with": suppliers, your bank, payroll and legal advisers. Detection covers other top-level domains and even loosely similar names such as contosososo.com.

Mailbox intelligence

Mailbox intelligence learns each user's frequent contacts. Enable mailbox intelligence is on by default. Enable intelligence for impersonation protection is off by default, and Microsoft says both "need to be turned on" for mailbox intelligence to act.

There's a trade-off. With both on, user and domain impersonation protection "doesn't work if the sender and recipient previously communicated via email." That suppresses false positives from a real vendor who shares your CEO's name, but it also means an attacker who has already exchanged messages with a target isn't flagged as an impersonator.

Trusted senders and domains

Add trusted senders and domains creates exceptions to impersonation checks, up to 1,024 entries. Trusted domains "don't include subdomains," so add each one. If Microsoft 365 system mail is flagged, Microsoft lists senders such as no-reply@sharepointonline.com that you can add.

You can't use the Tenant Allow/Block List to allow an impersonation false positive. Submitting the message as clean adds the sender to the trusted list of the policy that caught it (Microsoft Learn).

Impersonation actions

For user impersonation, domain impersonation and mailbox intelligence, the choices are: Don't apply any action (the default for all three), redirect, Junk Email, quarantine, deliver and Bcc others, or delete before delivery. Leaving the default means detection without consequence.

What do phishing thresholds 1 to 4 mean?

The Phishing email threshold slider controls how Microsoft's machine learning confidence maps to actions:

Microsoft warns that "the chance of false positives (good messages marked as bad) increases as you increase this setting." Standard uses 3 and Strict uses 4.

Which safety tips can you show?

Safety tips appear in Outlook above the message. They're controlled by the SFTY value in X-Forefront-Antispam-Report:

• Show first contact safety tip (SFTY:9.25): "You don't often get email from <email address>." With several recipients, Microsoft uses a majority model and shows "Some people who received this message don't often get email from…". It isn't shown on S/MIME-signed mail, mail delivered through an SCL -1 bypass rule, or mail to mailboxes created less than seven days ago.
• Show user impersonation safety tip (SFTY:9.20): "<Sender> appears similar to someone who previously sent you email, but may not be that person."
• Show domain impersonation safety tip (SFTY:9.19): "This sender might be impersonating a domain that's associated with your organization."
• Show user impersonation unusual characters safety tip: warns when a protected sender's address "includes unexpected letters or numbers."
• Show (?) for unauthenticated senders for spoof and Show "via" tag: the spoof indicators, both on by default.

Microsoft notes the majority model could reveal one recipient's contact habits to others. If that's a concern, it suggests leaving the first contact tip off and using a mail flow rule instead.

Default vs Standard vs Strict: Microsoft's values

From Microsoft's recommended settings, at the time of writing (October 2026):

Quarantined impersonation mail uses DefaultFullAccessPolicy unless you choose otherwise; Standard and Strict use DefaultFullAccessWithNotificationPolicy for user and domain impersonation. Our guide to quarantine policies and notifications explains what each allows.

How do you build a custom policy?

The wizard steps below are Microsoft's; the starting values (threshold, actions, review period) are our recommendation, not Microsoft defaults.

1. Go to Anti-phishing and select Create.
2. On Policy name, name it, for example "Finance and leadership".
3. On Users, groups, and domains, add the recipient group.
4. On Phishing threshold & protection, set the threshold (we suggest starting at 2 or 3), turn on Enable users to protect and add the people attackers will pose as, turn on Enable domains to protect with Include the domains I own plus key suppliers, and turn on Enable intelligence for impersonation protection.
5. On Actions, set each impersonation action to Quarantine the message, choose a quarantine policy, and select every safety tip.
6. Review and select Submit. Our suggestion: watch quarantine and the impersonation insight for a week before raising the threshold.

Next steps

• Open your default anti-phishing policy and check whether Show first contact safety tip is still off. It's off by default.
• If you have Defender, check that Users to protect isn't empty and the actions aren't Don't apply any action.
• Review user-reported phishing to find which names and suppliers attackers use; our guide to the Report button and user reported settings shows where reports go.
• Test how a suspicious message was handled by pasting its headers into the Email Header Analyzer. If you want a second filtering layer before Microsoft 365, see Microsoft 365 built-in filtering vs a gateway.