How to stop phishing emails in Microsoft 365

Microsoft 365 already blocks a lot of phishing, but many tenants still run with default settings that leave impersonation protection empty and warnings switched off. This guide walks through the settings that matter, in the order we'd change them, and explains where a filtering gateway fits.

What phishing protection does Microsoft 365 include?

Every Microsoft 365 cloud mailbox gets the built-in protection Microsoft used to call Exchange Online Protection (EOP). Defender for Office 365 adds more on top. The split matters, because some of the most useful anti-phishing settings only exist in Defender. If your problem is ordinary spam rather than phishing, start with why spam gets through Microsoft 365.

According to Microsoft Learn:

Microsoft is explicit that impersonation "can pass email authentication checks (SPF, DKIM, and DMARC) if the attacker created a lookalike domain and published valid DNS records." Without Defender, Microsoft 365 has no impersonation protection at all.

Step 1: Which preset security policy should you turn on?

The fastest way to get sensible settings is a preset security policy. Microsoft offers Standard and Strict profiles that apply its recommended settings across anti-spam, anti-malware and anti-phishing. In tenants with Defender for Office 365, the Built-in protection preset adds basic Safe Links and Safe Attachments for users who aren't covered by Standard or Strict.

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies (in the Templated policies section).
2. Turn on Standard protection for most users and Strict protection for high-risk groups such as finance and leadership.
3. Assign users, groups or domains to each profile.
4. With Defender, add the people and domains you want protected from impersonation (see Step 3).

In preset policies, all domains you own automatically get domain impersonation protection, and all recipients get mailbox intelligence protection. Preset policies are a good baseline. If you need finer control, create custom policies instead.

Step 2: Which anti-phishing settings does every tenant have?

Open Email & collaboration > Policies & rules > Threat policies > Anti-phishing and review the default policy.

Spoof intelligence

Leave Enable spoof intelligence on. Microsoft recommends it. Choose whether detected spoofs go to Junk or to quarantine. For most businesses, quarantine is safer for spoofed mail.

Honor the sender's DMARC policy

Turn on Honor DMARC record policy when the message is detected as spoof. Then choose separate actions for p=quarantine and p=reject. Rejecting mail that fails a sender's p=reject policy does what the sender asked for.

If your MX points somewhere other than Microsoft 365, Microsoft says this setting only applies when Enhanced Filtering for Connectors is turned on for the inbound connector.

Safety tips and indicators

• Show first contact safety tip: turn it on. Recipients see "You don't often get email from…" when a sender is new or rare. It's one of the cheapest warnings against supplier and executive impersonation.
• Show (?) for unauthenticated senders for spoof: leave it on.
• Show "via" tag: leave it on. It flags mail where the From domain differs from the DKIM or MAIL FROM domain.

Step 3: How do you set up impersonation protection in Defender for Office 365?

By default, Microsoft notes, no sender addresses or domains are configured for impersonation protection in the default policy or in custom policies. Many tenants pay for Defender and never fill these lists in.

Users to protect

Add the people criminals are most likely to pose as: the CEO, directors, the finance lead, and anyone who approves payments. You can add up to 350 users per policy. External people, such as your accountant or a key supplier contact, can be added too.

Domains to protect

Select Enable domains to protect, then Include the domains I own, and use Include custom domains to add up to 50 custom domains per policy, such as key suppliers, your bank and your payroll provider. Impersonation protection looks for similar domains, including different top-level domains and character swaps.

Mailbox intelligence

Make sure Enable mailbox intelligence and Enable intelligence for impersonation protection are both on. The second is off by default, and both are needed for mailbox intelligence to act on a message.

Actions

The default action for detected user and domain impersonation is Don't apply any action. Change it. Quarantining the message is the usual choice, with the impersonation safety tips turned on.

Trusted senders and domains

If a real partner keeps being flagged, add it as a trusted sender or domain rather than turning protection off. Trusted domain entries don't include subdomains, so add each one you need.

Phishing email threshold

Defender lets you raise the threshold from 1 - Standard to 2 - Aggressive, 3 - More aggressive or 4 - Most aggressive. Microsoft warns that the chance of false positives increases as you raise it. Raise it for high-risk groups first and watch quarantine.

Step 4: How do you tag external email in Outlook?

External sender tags make an "internal" request from outside the company easier to spot. Exchange Online has a native feature that adds an External icon in Outlook, Outlook on the web, Outlook for Mac and Outlook mobile (Microsoft Learn).

Set-ExternalInOutlook -Enabled $true

• It can take between 24 and 48 hours for users to see the icon.
• If you already add "[External]" to subject lines with a mail flow rule, disable that rule first to avoid duplication.
• Use -AllowList for exceptions. It accepts up to 200 entries.

Our guide to the Outlook external email warning tag compares the native tag with mail flow rule banners.

Step 5: How do users report phishing?

Users will see phishing that filters miss. Give them one button and route what they report to someone who looks at it.

1. In the Defender portal, go to Settings > Email & collaboration > User reported settings (Microsoft Learn).
2. Select Use the built-in Report button in Outlook.
3. Choose where reports go: Microsoft and my reporting mailbox, My reporting mailbox only, or Microsoft only.
4. If you use a reporting mailbox, configure it as a SecOps mailbox in the advanced delivery policy so reported messages aren't filtered on the way in.
5. Tell staff where the button is, and thank people who use it.

Step 6: How should you handle quarantined phishing?

Phishing that's caught usually lands in quarantine. By default, only admins can release messages quarantined as malware or high confidence phishing (Microsoft Learn). Keep it that way. Quarantine notifications for users are off in the default quarantine policies; the preset policies use a policy with notifications turned on. Quarantined spam is kept for 15 days by default in the default anti-spam policy and 30 days in the preset policies. See what an email quarantine is for how to run one safely, and how to release quarantined email in Microsoft 365 for the review steps.

Where does an email gateway fit?

Microsoft's filtering is one layer. Some businesses add a filtering gateway in front of Microsoft 365, by pointing MX records at the gateway. Reasons include:

• A second opinion from different detection than Microsoft's.
• Controls that are awkward or unavailable in Microsoft 365 without Defender, such as geographic filters or per-domain allow and block lists with sender verification.
• Outage spooling, so mail is held when Microsoft 365 is unreachable.
• One policy for several platforms, if you also run Google Workspace or cPanel domains.

If you add a gateway, do two things or you'll make filtering worse, not better:

1. Turn on Enhanced Filtering for Connectors on the inbound connector from the gateway. Without it, Microsoft 365 sees the gateway's IP as the source, not the real sender's. With it, Microsoft says it preserves "the source IP address and sender information" and uses explicit SPF, DKIM and DMARC for spoof detection (Microsoft Learn). Our guide to Enhanced Filtering with an external spam filter covers the steps.
2. Block direct-to-tenant delivery, so attackers can't skip the gateway by sending straight to your mail.protection.outlook.com host. See how to block filter bypass.

Don't set an SCL -1 bypass rule for gateway traffic once Enhanced Filtering is on. Microsoft recommends disabling those rules in most cases.

For a fuller comparison, read Microsoft 365 built-in filtering vs a gateway.

Microsoft 365 phishing protection checklist

Next steps

1. Open the Defender portal today and check whether impersonation protection has any users or domains in it.
2. Run Set-ExternalInOutlook -Enabled $true and tell staff what the new tag means.
3. Paste a suspicious message's headers into the Email Header Analyzer to see which checks it passed.
4. If you want a filtering layer in front of Microsoft 365, see our Microsoft 365 setup page and the BEC prevention guide for the procedures that back it up.

Browse our other phishing and threat guides.