Defender for Office 365 anti-phishing policies: going beyond the defaults
CEO fraud and payment diversion attacks rarely rely on a malicious attachment. They imitate an executive or a supplier. Defender for Office 365 can detect them, provided you tell it whom to protect.
What each tier provides
Exchange Online Protection (EOP), included in every subscription, provides an anti-phishing policy with spoof intelligence and the first contact safety tip. Defender for Office 365 (Plan 1 or 2) adds impersonation protection, mailbox intelligence and advanced phishing thresholds. A default policy exists, but its impersonation protection is not populated with your sensitive users.
Impersonation protection
Two complementary parts:
- protected users: executives, finance, accounts payable, executive assistants. A message from an external address whose display name resembles one of them is detected. The number of protected users per policy is capped, so check the current limit;
- protected domains: your own accepted domains and those of key partners (bank, main suppliers), to catch look-alike domains such as a doubled or substituted letter.
Set the action to quarantine rather than simply delivering to Junk, and add recurring legitimate senders to trusted senders to avoid false positives.
Mailbox intelligence
Mailbox intelligence learns each user's communication patterns. It can therefore tell a genuine contact from a sender that merely resembles one. Enable it, along with the impersonation protection that relies on it, with a quarantine or move-to-Junk action depending on your tolerance.
Spoof intelligence and safety tips
Spoof intelligence handles messages whose sender fails authentication (SPF, DKIM, DMARC). The dedicated insight in the Defender portal lets you allow or block sender and infrastructure pairs, together with the Tenant Allow/Block List. Also enable safety tips: user impersonation, domain impersonation and unusual characters, as well as the unauthenticated sender indicator. The first contact safety tip flags a sender the recipient has never dealt with, a simple but effective signal against supplier fraud.
Recommendation. The Standard and Strict preset security policies apply a consistent set of settings maintained by Microsoft. For most organisations, assigning everyone to Standard and exposed profiles to Strict beats custom policies that are never reviewed.
Preset or custom policies
Preset policies take precedence over custom ones and evolve with Microsoft's recommendations. Their one limitation: you still have to enter the protected users and domains yourself in the preset policy configuration. Custom policies are justified for specific needs, but should be documented and regularly compared with the recommended values.
What an audit checks
- protected users and domains are configured for impersonation protection;
- mailbox intelligence and safety tips are enabled;
- quarantine actions rather than plain delivery;
- Standard or Strict preset policies are actually assigned;
- allow list exceptions, which are often far too broad.