# Microsoft 365 anti-phishing policy settings: what each one does

URL: https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Setup guides
Author: iBlockSpam Team

> Every Microsoft 365 anti-phishing setting explained: spoof, impersonation, mailbox intelligence, phishing thresholds 1 to 4, safety tips and Standard vs Strict.

## Short answer

Every Microsoft 365 tenant gets anti-phishing policies with spoof intelligence, DMARC handling, unauthenticated sender indicators and the first contact safety tip. Defender for Office 365 adds user and domain impersonation protection, mailbox intelligence actions, trusted senders and a phishing threshold from 1 (Standard) to 4 (Most aggressive). The default policy leaves impersonation unconfigured.

Anti-phishing policies are where Microsoft 365 decides what to do with spoofed senders and lookalikes of your people and partners. The settings are spread across two wizard pages, half of them need Defender for Office 365, and the defaults leave the most useful protections switched off. This is a setting-by-setting reference, with Microsoft's Default, Standard and Strict values side by side.

If you want the short version, our guide to [stopping phishing in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365) gives the order to change things in. This guide is the detail behind it.

## Which settings are in EOP and which need Defender?

Anti-phishing policies live at **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-phishing** in the Microsoft Defender portal (`https://security.microsoft.com/antiphishing`). [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about) splits the features like this:

| Feature | All cloud mailboxes | Defender for Office 365 |
|---|---|---|
| Default policy and custom policies | Yes | Yes |
| Spoof settings (spoof intelligence, Honor DMARC, indicators) | Yes | Yes |
| First contact safety tip | Yes | Yes |
| Impersonation settings | No | Yes |
| Phishing email thresholds | No | Yes |

Microsoft is explicit that the default policy in Defender for Office 365 "provides spoof protection and mailbox intelligence for all recipients," but the other impersonation features and thresholds "aren't configured in the default policy." Paying for Defender doesn't turn them on. If you're unsure which plan you have, see [Defender for Office 365 Plan 1 vs Plan 2](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2).

## Who does a policy apply to?

Custom policies need at least one recipient condition: **Users**, **Groups** or **Domains**. The logic trips people up:

- Several values in one condition use **OR**. Any listed user matches.
- Different condition types use **AND**. A policy for user `romain@contoso.com` *and* group Executives applies only if Romain is in Executives.
- Exceptions always use **OR**.
- Dynamic distribution groups aren't supported.

Order matters too. The Strict preset policy applies first, then Standard, then custom policies by priority (0 is highest), then the default policy, which is always **Lowest**. Microsoft says protection "stops for a recipient after the first policy is applied." A user in the Standard preset ignores your custom policy entirely. [Preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies) explains how to plan around that.

## What do the spoof settings do?

Spoof settings appear on the **Phishing threshold & protection** page (**Enable spoof intelligence**) and the **Actions** page:

- **If the message is detected as spoof by spoof intelligence**: Junk Email (default) or quarantine. It applies to senders spoof intelligence blocked automatically, or that you blocked in the Tenant Allow/Block List.
- **Honor DMARC record policy when the message is detected as spoof**: on by default. You then pick separate actions for `p=quarantine` (quarantine by default, or Junk) and `p=reject` (reject by default, or quarantine).

If your MX record points to a gateway, Microsoft says Honor DMARC only applies when [Enhanced Filtering for Connectors](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) is enabled on the inbound connector. Don't turn spoof intelligence off because of a gateway; turn Enhanced Filtering on instead.

How spoof intelligence reaches its verdict, the compauth reason codes and how to allow a spoofed sender pair are covered in our guide to [Microsoft 365 spoof intelligence](https://iblockspam.com/blog/microsoft-365-spoof-intelligence).

## How does impersonation protection work?

Impersonation is a lookalike, not a forgery. Microsoft's examples: `ćóntoso.com` for `contoso.com`, or a real employee's display name on a different address. Microsoft notes impersonation "can pass email authentication checks (SPF, DKIM, and DMARC)" when the attacker registers a lookalike domain and publishes valid records. That's why DMARC alone can't stop it; see [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

Note the difference between the two lists. **Users, groups, and domains** are the *recipients* the policy protects. **Users to protect** and **Domains to protect** are the *senders* it watches for.

### Users to protect

**Enable users to protect** lets you list internal and external senders by display name and address, up to **350 per policy**. By default, no users are listed in any policy. Microsoft recommends key roles: CEO, CFO, senior leaders and board members.

### Domains to protect

**Enable domains to protect** has two parts: **Include the domains I own** (your accepted domains) and **Include custom domains**, up to **50 per policy**. Microsoft suggests domains "that you don't own, but you frequently interact with": suppliers, your bank, payroll and legal advisers. Detection covers other top-level domains and even loosely similar names such as `contosososo.com`.

### Mailbox intelligence

Mailbox intelligence learns each user's frequent contacts. **Enable mailbox intelligence** is on by default. **Enable intelligence for impersonation protection** is off by default, and Microsoft says both "need to be turned on" for mailbox intelligence to act.

There's a trade-off. With both on, user and domain impersonation protection "doesn't work if the sender and recipient previously communicated via email." That suppresses false positives from a real vendor who shares your CEO's name, but it also means an attacker who has already exchanged messages with a target isn't flagged as an impersonator.

### Trusted senders and domains

**Add trusted senders and domains** creates exceptions to impersonation checks, up to **1,024 entries**. Trusted domains "don't include subdomains," so add each one. If Microsoft 365 system mail is flagged, Microsoft lists senders such as `no-reply@sharepointonline.com` that you can add.

You can't use the Tenant Allow/Block List to allow an impersonation false positive. Submitting the message as clean adds the sender to the trusted list of the policy that caught it ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)).

### Impersonation actions

For user impersonation, domain impersonation and mailbox intelligence, the choices are: **Don't apply any action** (the default for all three), redirect, Junk Email, quarantine, deliver and Bcc others, or delete before delivery. Leaving the default means detection without consequence.

## What do phishing thresholds 1 to 4 mean?

The **Phishing email threshold** slider controls how Microsoft's machine learning confidence maps to actions:

| Level | What Microsoft says it does |
|---|---|
| **1 - Standard** | Default. Action severity matches confidence (low, medium, high or very high) |
| **2 - Aggressive** | High confidence phishing is treated as very high confidence |
| **3 - More aggressive** | Medium and high confidence are treated as very high confidence |
| **4 - Most aggressive** | Low, medium and high confidence are treated as very high confidence |

Microsoft warns that "the chance of false positives (good messages marked as bad) increases as you increase this setting." Standard uses 3 and Strict uses 4.

## Which safety tips can you show?

Safety tips appear in Outlook above the message. They're controlled by the `SFTY` value in `X-Forefront-Antispam-Report`:

- **Show first contact safety tip** (`SFTY:9.25`): "You don't often get email from <email address>." With several recipients, Microsoft uses a majority model and shows "Some people who received this message don't often get email from…". It isn't shown on S/MIME-signed mail, mail delivered through an SCL -1 bypass rule, or mail to mailboxes created less than seven days ago.
- **Show user impersonation safety tip** (`SFTY:9.20`): "<Sender> appears similar to someone who previously sent you email, but may not be that person."
- **Show domain impersonation safety tip** (`SFTY:9.19`): "This sender might be impersonating a domain that's associated with your organization."
- **Show user impersonation unusual characters safety tip**: warns when a protected sender's address "includes unexpected letters or numbers."
- **Show (?) for unauthenticated senders for spoof** and **Show "via" tag**: the spoof indicators, both on by default.

Microsoft notes the majority model could reveal one recipient's contact habits to others. If that's a concern, it suggests leaving the first contact tip off and using a mail flow rule instead.

## Default vs Standard vs Strict: Microsoft's values

From Microsoft's [recommended settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365), at the time of writing (October 2026):

| Setting | Default policy | Standard | Strict |
|---|---|---|---|
| Enable spoof intelligence | On | On | On |
| Spoof intelligence action | Junk Email | Junk Email | Quarantine |
| Honor DMARC record policy | On | On | On |
| DMARC `p=quarantine` / `p=reject` actions | Quarantine / Reject | Quarantine / Reject | Quarantine / Reject |
| Show first contact safety tip | **Off** | On | On |
| Show (?) and "via" tag | On | On | On |
| Phishing email threshold | 1 - Standard | 3 - More aggressive | 4 - Most aggressive |
| Enable users to protect | Off | On, with your list | On, with your list |
| Include domains I own | Off | On | On |
| Include custom domains | Off | On, with your list | On, with your list |
| Enable mailbox intelligence | On | On | On |
| Enable intelligence for impersonation protection | Off | On | On |
| User and domain impersonation action | Don't apply any action | Quarantine | Quarantine |
| Mailbox intelligence action | Don't apply any action | Junk Email | Quarantine |
| Impersonation safety tips (user, domain, unusual characters) | Off | On | On |

Quarantined impersonation mail uses DefaultFullAccessPolicy unless you choose otherwise; Standard and Strict use DefaultFullAccessWithNotificationPolicy for user and domain impersonation. Our guide to [quarantine policies and notifications](https://iblockspam.com/blog/microsoft-365-quarantine-policies-notifications) explains what each allows.

## How do you build a custom policy?

The wizard steps below are Microsoft's; the starting values (threshold, actions, review period) are our recommendation, not Microsoft defaults.

1. Go to **Anti-phishing** and select **Create**.
2. On **Policy name**, name it, for example "Finance and leadership".
3. On **Users, groups, and domains**, add the recipient group.
4. On **Phishing threshold & protection**, set the threshold (we suggest starting at 2 or 3), turn on **Enable users to protect** and add the people attackers will pose as, turn on **Enable domains to protect** with **Include the domains I own** plus key suppliers, and turn on **Enable intelligence for impersonation protection**.
5. On **Actions**, set each impersonation action to **Quarantine the message**, choose a quarantine policy, and select every safety tip.
6. Review and select **Submit**. Our suggestion: watch quarantine and the impersonation insight for a week before raising the threshold.

## Next steps

- Open your default anti-phishing policy and check whether **Show first contact safety tip** is still off. It's off by default.
- If you have Defender, check that **Users to protect** isn't empty and the actions aren't **Don't apply any action**.
- Review user-reported phishing to find which names and suppliers attackers use; our guide to the [Report button and user reported settings](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings) shows where reports go.
- Test how a suspicious message was handled by pasting its headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). If you want a second filtering layer before Microsoft 365, see [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway).

## Frequently asked questions

### Which anti-phishing settings need Defender for Office 365?

Impersonation settings and phishing email thresholds. That covers users to protect, domains to protect, mailbox intelligence actions, impersonation safety tips and trusted senders and domains. Spoof intelligence, the Honor DMARC setting, the question mark and via indicators and the first contact safety tip are available in every Microsoft 365 tenant with cloud mailboxes.

### Why didn't impersonation protection flag a message from a lookalike sender?

Check three things. Is the sender's real target in Users to protect or Domains to protect? Is the action still Don't apply any action, the default? And had the recipient emailed that sender before? With Enable mailbox intelligence and Enable intelligence for impersonation protection both on, Microsoft says impersonation protection doesn't work when the sender and recipient previously communicated.

### What does the phishing email threshold actually change?

It changes how confident Microsoft must be before applying its most severe phishing action. At 1 - Standard, the action matches the confidence level. At 2, high confidence is treated as very high; at 3, medium and high; at 4, low, medium and high. Microsoft warns false positives increase as you raise it.

### Can I add a Microsoft 365 user to impersonation protection in two policies?

In the Defender portal you might see the error The email address already exists if the user is already protected in another anti-phishing policy. Microsoft says the error only occurs in the portal. Using the TargetedUsersToProtect parameter with New-AntiPhishPolicy or Set-AntiPhishPolicy in PowerShell doesn't produce it.

### How do I stop a real partner being flagged as impersonation?

Add the sender or domain to Add trusted senders and domains in the anti-phishing policy that flagged it. You can't fix impersonation false positives with Tenant Allow/Block List allow entries. Submitting the message as clean adds the sender to the trusted list of that policy. Trusted domains don't cover subdomains, so add each one.

## Sources

- [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Microsoft Learn: Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-mdo-configure)
- [Microsoft Learn: Recommendations for Microsoft 365 security settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Quarantine policies](https://learn.microsoft.com/en-us/defender-office-365/quarantine-policies)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List (impersonation section)](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt