# How to stop phishing emails in Microsoft 365

URL: https://iblockspam.com/blog/stop-phishing-emails-microsoft-365
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> Set up Microsoft 365 anti-phishing policies, impersonation protection, external sender tags and user reporting, and decide when to add an email gateway.

## Short answer

To stop phishing in Microsoft 365, turn on the Standard or Strict preset security policy, keep spoof intelligence on, honor senders' DMARC policies and show first contact safety tips. With Defender for Office 365, add impersonation protection for key people and domains. Tag external email, give users a Report button, and consider a filtering gateway as an extra layer.

Microsoft 365 already blocks a lot of phishing, but many tenants still run with default settings that leave impersonation protection empty and warnings switched off. This guide walks through the settings that matter, in the order we'd change them, and explains where a filtering gateway fits.

## What phishing protection does Microsoft 365 include?

Every Microsoft 365 cloud mailbox gets the built-in protection Microsoft used to call Exchange Online Protection (EOP). Defender for Office 365 adds more on top. The split matters, because some of the most useful anti-phishing settings only exist in Defender. If your problem is ordinary spam rather than phishing, start with [why spam gets through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through).

According to [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about):

| Feature | All cloud mailboxes | Defender for Office 365 |
|---|---|---|
| Default anti-phishing policy and custom policies | Yes | Yes |
| Spoof intelligence and honoring sender DMARC | Yes | Yes |
| Unauthenticated sender indicators ("?" and "via") | Yes | Yes |
| First contact safety tip | Yes | Yes |
| User and domain impersonation protection | No | Yes |
| Mailbox intelligence impersonation actions | No | Yes |
| Phishing email thresholds | No | Yes |

Microsoft is explicit that impersonation "can pass email authentication checks (SPF, DKIM, and DMARC) if the attacker created a lookalike domain and published valid DNS records." Without Defender, Microsoft 365 has no impersonation protection at all.

## Step 1: Which preset security policy should you turn on?

The fastest way to get sensible settings is a [preset security policy](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies). Microsoft offers **Standard** and **Strict** profiles that apply its recommended settings across anti-spam, anti-malware and anti-phishing. In tenants with Defender for Office 365, the **Built-in protection** preset adds basic Safe Links and Safe Attachments for users who aren't covered by Standard or Strict.

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset Security Policies** (in the **Templated policies** section).
2. Turn on **Standard protection** for most users and **Strict protection** for high-risk groups such as finance and leadership.
3. Assign users, groups or domains to each profile.
4. With Defender, add the people and domains you want protected from impersonation (see Step 3).

In preset policies, all domains you own automatically get domain impersonation protection, and all recipients get mailbox intelligence protection. Preset policies are a good baseline. If you need finer control, create custom policies instead.

## Step 2: Which anti-phishing settings does every tenant have?

Open **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-phishing** and review the default policy.

### Spoof intelligence

Leave **Enable spoof intelligence** on. Microsoft recommends it. Choose whether detected spoofs go to Junk or to quarantine. For most businesses, quarantine is safer for spoofed mail.

### Honor the sender's DMARC policy

Turn on **Honor DMARC record policy when the message is detected as spoof**. Then choose separate actions for `p=quarantine` and `p=reject`. Rejecting mail that fails a sender's `p=reject` policy does what the sender asked for.

If your MX points somewhere other than Microsoft 365, Microsoft says this setting only applies when Enhanced Filtering for Connectors is turned on for the inbound connector.

### Safety tips and indicators

- **Show first contact safety tip**: turn it on. Recipients see "You don't often get email from…" when a sender is new or rare. It's one of the cheapest warnings against supplier and executive impersonation.
- **Show (?) for unauthenticated senders for spoof**: leave it on.
- **Show "via" tag**: leave it on. It flags mail where the From domain differs from the DKIM or MAIL FROM domain.

## Step 3: How do you set up impersonation protection in Defender for Office 365?

By default, Microsoft notes, no sender addresses or domains are configured for impersonation protection in the default policy or in custom policies. Many tenants pay for Defender and never fill these lists in.

### Users to protect

Add the people criminals are most likely to pose as: the CEO, directors, the finance lead, and anyone who approves payments. You can add up to **350 users** per policy. External people, such as your accountant or a key supplier contact, can be added too.

### Domains to protect

Select **Enable domains to protect**, then **Include the domains I own**, and use **Include custom domains** to add up to **50 custom domains** per policy, such as key suppliers, your bank and your payroll provider. Impersonation protection looks for similar domains, including different top-level domains and character swaps.

### Mailbox intelligence

Make sure **Enable mailbox intelligence** and **Enable intelligence for impersonation protection** are both on. The second is off by default, and both are needed for mailbox intelligence to act on a message.

### Actions

The default action for detected user and domain impersonation is **Don't apply any action**. Change it. Quarantining the message is the usual choice, with the impersonation safety tips turned on.

### Trusted senders and domains

If a real partner keeps being flagged, add it as a trusted sender or domain rather than turning protection off. Trusted domain entries don't include subdomains, so add each one you need.

### Phishing email threshold

Defender lets you raise the threshold from **1 - Standard** to **2 - Aggressive**, **3 - More aggressive** or **4 - Most aggressive**. Microsoft warns that the chance of false positives increases as you raise it. Raise it for high-risk groups first and watch quarantine.

## Step 4: How do you tag external email in Outlook?

External sender tags make an "internal" request from outside the company easier to spot. Exchange Online has a native feature that adds an **External** icon in Outlook, Outlook on the web, Outlook for Mac and Outlook mobile ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)).

```powershell
Set-ExternalInOutlook -Enabled $true
```

- It can take between 24 and 48 hours for users to see the icon.
- If you already add "[External]" to subject lines with a mail flow rule, disable that rule first to avoid duplication.
- Use `-AllowList` for exceptions. It accepts up to 200 entries.

Our guide to the [Outlook external email warning tag](https://iblockspam.com/blog/outlook-external-email-warning-tag) compares the native tag with mail flow rule banners.

## Step 5: How do users report phishing?

Users will see phishing that filters miss. Give them one button and route what they report to someone who looks at it.

1. In the Defender portal, go to **Settings** > **Email & collaboration** > **User reported settings** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/submissions-user-reported-messages-custom-mailbox)).
2. Select **Use the built-in Report button in Outlook**.
3. Choose where reports go: **Microsoft and my reporting mailbox**, **My reporting mailbox only**, or **Microsoft only**.
4. If you use a reporting mailbox, configure it as a SecOps mailbox in the advanced delivery policy so reported messages aren't filtered on the way in.
5. Tell staff where the button is, and thank people who use it.

## Step 6: How should you handle quarantined phishing?

Phishing that's caught usually lands in quarantine. By default, only admins can release messages quarantined as malware or high confidence phishing ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)). Keep it that way. Quarantine notifications for users are off in the default quarantine policies; the preset policies use a policy with notifications turned on. Quarantined spam is kept for 15 days by default in the default anti-spam policy and 30 days in the preset policies. See [what an email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine) for how to run one safely, and [how to release quarantined email in Microsoft 365](https://iblockspam.com/blog/release-quarantined-email-microsoft-365) for the review steps.

## Where does an email gateway fit?

Microsoft's filtering is one layer. Some businesses add a filtering gateway in front of Microsoft 365, by pointing MX records at the gateway. Reasons include:

- A second opinion from different detection than Microsoft's.
- Controls that are awkward or unavailable in Microsoft 365 without Defender, such as geographic filters or per-domain allow and block lists with sender verification.
- Outage spooling, so mail is held when Microsoft 365 is unreachable.
- One policy for several platforms, if you also run Google Workspace or cPanel domains.

If you add a gateway, do two things or you'll make filtering worse, not better:

1. **Turn on Enhanced Filtering for Connectors** on the inbound connector from the gateway. Without it, Microsoft 365 sees the gateway's IP as the source, not the real sender's. With it, Microsoft says it preserves "the source IP address and sender information" and uses explicit SPF, DKIM and DMARC for spoof detection ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)). Our guide to [Enhanced Filtering with an external spam filter](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) covers the steps.
2. **Block direct-to-tenant delivery**, so attackers can't skip the gateway by sending straight to your `mail.protection.outlook.com` host. See [how to block filter bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass).

Don't set an SCL -1 bypass rule for gateway traffic once Enhanced Filtering is on. Microsoft recommends disabling those rules in most cases.

For a fuller comparison, read [Microsoft 365 built-in filtering vs a gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway).

## Microsoft 365 phishing protection checklist

| Setting | Where | Recommended |
|---|---|---|
| Preset security policy | Threat policies | Standard for all, Strict for high-risk |
| Spoof intelligence | Anti-phishing | On, quarantine spoofs |
| Honor DMARC policy | Anti-phishing | On |
| First contact safety tip | Anti-phishing | On |
| Users to protect (Defender) | Anti-phishing | Executives and finance, up to 350 |
| Domains to protect (Defender) | Anti-phishing | Own domains plus key suppliers |
| Impersonation action (Defender) | Anti-phishing | Quarantine, not "no action" |
| External tag | PowerShell | `Set-ExternalInOutlook -Enabled $true` |
| Report button | User reported settings | On, with a reporting mailbox |
| Enhanced Filtering (with a gateway) | Threat policies | On for the gateway connector |

## Next steps

1. Open the Defender portal today and check whether impersonation protection has any users or domains in it.
2. Run `Set-ExternalInOutlook -Enabled $true` and tell staff what the new tag means.
3. Paste a suspicious message's headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see which checks it passed.
4. If you want a filtering layer in front of Microsoft 365, see our [Microsoft 365 setup page](https://iblockspam.com/platforms/microsoft-365) and the [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) for the procedures that back it up.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Does Microsoft 365 have phishing protection without Defender for Office 365?

Yes. Every cloud mailbox gets anti-phishing policies with spoof intelligence, unauthenticated sender indicators and the first contact safety tip. What it lacks is user and domain impersonation protection, mailbox intelligence actions and adjustable phishing thresholds. Those need Defender for Office 365.

### How many users can I protect from impersonation in Microsoft 365?

Microsoft allows up to 350 users for user impersonation protection and up to 50 custom domains for domain impersonation protection in each anti-phishing policy. Choose executives, finance staff and anyone whose name would make a payment request look legitimate, plus key supplier domains.

### How do I add an External tag to emails in Outlook?

Connect to Exchange Online PowerShell and run Set-ExternalInOutlook -Enabled $true. Outlook then shows an External icon on mail from outside senders. Microsoft says it can take 24 to 48 hours to appear. Turn off any old mail flow rules that add [External] to subjects first.

### Should I set the phishing threshold to Most aggressive?

Not straight away. Higher thresholds treat lower-confidence detections as if they were very high confidence phishing, and Microsoft warns that false positives increase as you raise the setting. Start at 2 (Aggressive) for high-risk groups, watch quarantine for a few weeks, then adjust.

### Can I use a third-party spam filter with Microsoft 365?

Yes. Point your MX records at the filtering service, create an inbound connector from it, and turn on Enhanced Filtering for Connectors so Microsoft 365 sees the original sender IP. Then lock down direct delivery so nobody can bypass the filter.

## Sources

- [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Microsoft Learn: Preset security policies](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies)
- [Microsoft Learn: Set-ExternalInOutlook](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)
- [Microsoft Learn: Configure user reported message settings](https://learn.microsoft.com/en-us/defender-office-365/submissions-user-reported-messages-custom-mailbox)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [Microsoft Learn: Quarantined email messages in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.

---

Source: iBlockSpam, https://iblockspam.com/blog/stop-phishing-emails-microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt