Discuss your project

TOOLBOX · DOWNLOAD

SecureExchange Onlineagainst phishing.

Every mailbox in Exchange Online is scanned for spam, malware, and phishing, but only the right settings turn this into effective protection. This guide explains the layers of protection, separates the built-in features from those that require Microsoft Defender for Office 365 Plan 1 or Plan 2, and shows the values Microsoft recommends: the Standard and Strict preset policies, anti-phishing with spoofing and impersonation protection, Safe Links, Safe Attachments, ZAP, quarantine, reporting, and sender authentication for your own domain. A checklist and the most common mistakes round it off.

Download PDF (11 pages)What Is Inside

Free PDF · Guide

Exchange Online: Protection Against Spam, Phishing, and Malware

Topic
Email & Microsoft 365
Format
PDF, A4
Length
11 pages
Size
153 KB
Updated
Oct 25, 2026
Sources
27
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Built-in protection, preset policies, Defender for Office 365 Plan 1 and 2, quarantine, and sender authentication, based on Microsoft Learn and RFCs.

  • Microsoft 365 and Exchange Online administrators in small and medium-sized companies
  • IT service providers that set up and manage their customers' tenants
  • IT management that defines licenses and the level of email protection

8 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    Layers of protection at a glance

    What every mailbox in Exchange Online comes with and what Defender for Office 365 Plan 1 and Plan 2 add.

  • 02

    What built-in protection always does

    Default policies for all recipients and "Secure by Default" for malware and high confidence phishing.

  • 03

    Preset policies as a starting point

    Standard for everyone, Strict for particularly at-risk people, Built-in protection as a safety net for Safe Links and Safe Attachments.

  • 04

    Settings in detail

    The values of the default policy and the Standard and Strict profiles, plus the features that require Defender for Office 365.

  • 05

    Sender authentication for your own domain

    SPF, DKIM, and DMARC for every sending domain, blocking records for every domain that does not send; you turn on DKIM for your own domains yourself.

  • 06

    Quarantine and reporting

    Quarantine policies control what users may do and whether they are notified; reported messages belong in a dedicated mailbox.

  • 07

    Allowing, blocking, and common mistakes

    The Tenant Allow/Block List first, allow entries only temporarily, and the typical mistakes that undermine protection.

  • 08

    Checklist to tick off

    The items in the order TOMORIS recommends, with the configuration analyzer as a check.

EXCERPT

Preset policies as a starting point

Preset security policies set the values recommended by Microsoft, which can hardly be changed. Microsoft advises assigning Standard and/or Strict to all recipients; until then, they apply to no one. Strict is intended for particularly at-risk people ("high value targets or priority users"). All recipients without another policy for Safe Links and Safe Attachments automatically receive Built-in protection as soon as the tenant has at least one license for Defender for Office 365; Microsoft recommends licenses for all users.

  1. Open the page

    Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset security policies (security.microsoft.com/presetSecurityPolicies).

  2. Assign Standard protection

    Turn the switch "On", then select "Manage protection settings" and, under "Apply Exchange Online Protection", choose "All recipients". If not all users have a license, assign the Defender for Office 365 protection only to licensed users.

  3. Fill in impersonation protection (Plan 1)

    Up to 350 people whom attackers could imitate, such as executive management and the head of finance, and up to 50 external domains you frequently correspond with. Your own domains and mailbox intelligence are protected automatically.

  4. Add Strict and test

    Additionally assign Strict to at-risk people. Test: with Standard, spam lands in the Junk Email folder; with Strict, in quarantine. Do not change the profile policies with PowerShell; Microsoft does not support this.

If a recipient is included in several policies, only the first one in this order takes effect: Strict, Standard, Defender for Office 365 evaluation policies, custom policies by priority, and finally Built-in protection and default policies. Outbound spam and Teams protection are not part of the profiles.

Get the Full PDF

SOURCES

Supported
by Sources.

  1. Microsoft Learn: Built-in security features (opens in a new tab)How it works, features; October 25, 2026
  2. Microsoft Learn: Microsoft Defender for Office 365 (opens in a new tab)Protection ladder, Plan 1 and Plan 2; October 25, 2026
  3. Microsoft Learn: What's new in Defender for Office 365 (opens in a new tab)March 2025 to October 2026; October 25, 2026
  4. Microsoft Learn: Preset security policies (opens in a new tab)Assignment, profiles, order of precedence; October 25, 2026
  5. Microsoft Learn: Recommended security settings (opens in a new tab)Default, Standard, Strict, Built-in protection; October 25, 2026
  6. Microsoft Learn: Secure by default (opens in a new tab)Overrides, exceptions; October 25, 2026
  7. Microsoft Learn: Anti-spam protection (opens in a new tab)Verdicts, actions, retention; October 25, 2026
  8. Microsoft Learn: Anti-phishing policies (opens in a new tab)Spoofing, DMARC, impersonation; October 25, 2026
  9. Microsoft Learn: Safe Links (opens in a new tab)Email, Teams, Office apps, exceptions; October 25, 2026
  10. Microsoft Learn: Safe Attachments (opens in a new tab)Actions, password-protected attachments; October 25, 2026
  11. Microsoft Learn: Zero-hour auto purge (opens in a new tab)Email, Teams, licenses; October 25, 2026
  12. Microsoft Learn: Quarantine policies (opens in a new tab)Default policies, permissions; October 25, 2026
  13. Microsoft Learn: User reported settings (opens in a new tab)Reporting mailbox, destinations; October 25, 2026
  14. Microsoft Learn: Tenant Allow/Block List (opens in a new tab)Block and allow entries; October 25, 2026
  15. Microsoft Learn: Create allow lists (opens in a new tab)Methods, mail flow rules; October 25, 2026
  16. Microsoft Learn: Configuration analyzer (opens in a new tab)Recommendations, drift analysis; October 25, 2026
  17. Microsoft Learn: Prompt injection protection (opens in a new tab)Plan 2, verdict, detection; October 25, 2026
  18. Microsoft Learn: Set up SPF (opens in a new tab)Syntax, parked domains, flattening; October 25, 2026
  19. Microsoft Learn: Set up DKIM (opens in a new tab)CNAME, turning on, key length; October 25, 2026
  20. Microsoft Learn: Set up DMARC (opens in a new tab)Stages, *.onmicrosoft.com, parking; October 25, 2026
  21. RFC 7208: Sender Policy Framework (SPF) (opens in a new tab)Sections 4.5 and 4.6.4
  22. RFC 6376: DKIM Signatures (opens in a new tab)Section 3.6.2.1
  23. RFC 9989: DMARC (May 2026, Standards Track) (opens in a new tab)Sections 4.1 and 4.7 (tag t), Appendix A.6
  24. RFC 7489: DMARC (2015, Informational) (opens in a new tab)Obsolete according to the RFC Editor, replaced by RFC 9989, 9990, and 9991
  25. NISG 2026, BGBl. I No. 94/2025 (RIS) (opens in a new tab)§ 32 paras. 1 and 2, § 51 para. 2; version as of October 25, 2026
  26. NISV 2026, BGBl. II No. 290/2026 (RIS) (opens in a new tab)§ 2; promulgated on October 1, 2026
  27. Implementing Regulation (EU) 2024/2690, annex (opens in a new tab)Points 6.7.2(k) and 6.9; applicable under § 2 NISV 2026

This guide and checklist are a TOMORIS recommendation and must be adapted to your own environment; they do not replace legal advice. Microsoft constantly changes features, names, menus, default values, and license scopes: the linked Microsoft Learn pages in their current version are authoritative, and for NIS2 obligations, the statutory text of the NISG 2026 in its current version. The DNS records are examples using reserved example domains.

TOOLBOX

Explore
Further.

EMAIL & MICROSOFT 365

More on
This Topic.

More free PDFs about Email & Microsoft 365.
All Email & Microsoft 365 Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads