10 Steps For Office 365 Email Protection With Defender

Office 365 Email Protection with Defender

Microsoft Defender for Office 365 is designed to safeguard your organization’s email channels from advanced threats. With 90% of cyberattacks starting from email, securing these channels is critical to protecting your data and operations.

Why Email Protection Matters

Defender for Office 365 delivers a multi-layered defense approach, addressing the risks of phishing, malware, and business email compromise. This integrated solution not only helps protect data but also supports compliance requirements under frameworks like GDPR and HIPAA.

This guide will outline the top steps to fully leverage Office 365 Email Protection, including best practices for managing quarantines, configuring alerts, and enabling encryption to meet today’s security challenges.

1. Understand the Basics of Office 365 Email Protection

Office 365 Email Protection through Microsoft Defender is designed to secure your organization’s email channels from a variety of advanced threats, including phishing, malware, and business email compromise. As email remains a common entry point for cyberattacks, Defender for Office 365 provides essential tools to protect your users, data, and overall security posture.

Microsoft Defender Preset Security Policies: Standard and Strict

Microsoft Defender for Office 365 offers preset security policies—Standard and Strict—which deliver different levels of protection tailored to organizational needs.

• Standard Policy: The Standard policy is designed to provide balanced security, suitable for most users and scenarios. This policy offers a comprehensive layer of protection without overly restrictive settings, making it ideal for general users.
• Strict Policy: The Strict policy applies more aggressive settings, ideal for high-risk individuals such as executives or finance personnel who may be more vulnerable to targeted attacks. With stricter thresholds, this policy offers enhanced protection for those who handle sensitive or high-value information.

Comprehensive Protection with Key Security Configurations

These preset policies cover a wide range of configurations, including anti-phishing, anti-spam, anti-malware, Safe Links, and Safe Attachments. These features work in unison to provide robust, multi-layered protection without the need for extensive manual configuration.

By leveraging these preset policies, organizations can align with Microsoft’s recommended security practices, simplifying the management of security settings and ensuring consistent protection across the organization.

Supporting Compliance and Risk Management

Through these foundational options, Microsoft Defender for Office 365 not only helps safeguard data but also enables compliance with regulatory frameworks like GDPR and HIPAA. By utilizing the Standard and Strict policies, organizations can streamline security administration while adapting to varying risk levels, keeping email protection aligned with specific security needs and organizational priorities.

2. Configure Anti-Phishing Policies to Stop Impersonation Attacks

Phishing remains one of the most prevalent threats to email security, with attackers often using impersonation tactics to deceive users. Microsoft Defender for Office 365’s anti-phishing policies help you protect your organization from these tactics, making it harder for attackers to mimic trusted contacts or domains.

Setting Up Anti-Phishing Policies for Office 365

To strengthen your defense against phishing, you can configure anti-phishing policies in Defender for Office 365 that target specific risks like impersonation. Start by adding your high-priority users, such as executives or finance personnel, to targeted protection groups. These users are often prime targets for attackers, and configuring their protection settings will give them an extra layer of security.

Customizing Anti-Phishing Policies to Fit Your Needs

Adjusting the sensitivity levels within anti-phishing policies allows you to match the unique needs of your organization. For example, you can set stricter policies to detect domain and user impersonation attempts or flag potentially suspicious behaviors based on sender patterns. The configuration options are flexible, so you can decide how aggressively you want Defender to respond to potential phishing threats.

By setting up and fine-tuning anti-phishing policies, you create a stronger barrier against phishing attacks, helping you safeguard your organization from the financial and reputational risks associated with compromised email accounts.

3. Set Up Safe Links and Safe Attachments for Threat Detection

Defender for Office 365’s Safe Links and Safe Attachments features add crucial layers of protection to your email environment by actively detecting malicious links and attachments. These tools are essential for blocking harmful content before it reaches your users, helping you maintain a secure email environment.

Configuring Safe Links for URL Protection

Safe Links is designed to scan URLs within emails and documents to prevent users from clicking on malicious links. To set it up, configure Safe Links policies that rewrite URLs in real-time, so when a user clicks, Defender checks the link’s safety. This protection remains active even if a URL changes status after an email is delivered. You can also customize Safe Links policies for specific users or departments who may be more exposed to targeted attacks.

Implementing Safe Attachments for File Security

With Safe Attachments, Defender for Office 365 analyzes attachments in a sandboxed environment to detect any hidden malware. This feature prevents harmful files from reaching users by automatically scanning and evaluating attachments before they’re opened. Enabling Safe Attachments gives users a secure way to handle files without the risk of inadvertently triggering malware.

By configuring Safe Links and Safe Attachments, you can mitigate the risks associated with phishing links and malicious files, ensuring your users can interact with their emails safely and without interruption.

4. Optimize Your Office 365 Spam Filter and Anti-Malware Settings

An effective spam and anti-malware setup is essential for keeping unwanted or malicious emails out of your users’ inboxes. Microsoft Defender for Office 365’s built-in spam filter and anti-malware protections allow you to fine-tune these settings, reducing the likelihood of unwanted messages reaching users while preventing legitimate emails from being mistakenly flagged.

Configuring the Office 365 Spam Filter

The spam filter in Defender for Office 365 provides customizable settings to manage the types of messages that reach your users. You can start by adjusting the spam confidence level (SCL) to control the threshold at which emails are marked as spam. By fine-tuning this setting, you can filter out more junk mail without accidentally blocking valid emails. Defender also offers options to block messages containing certain keywords, domains, or senders, adding an extra layer of filtering that aligns with your organization’s needs. For more detailed instructions, see Anti-Spam Protection in Office 365.

Enhancing Anti-Malware Protection

Defender’s anti-malware policies inspect all incoming and outgoing emails to detect and block known and unknown threats. You can configure policies to handle specific types of malware or set alerts to notify you of potential risks. For additional security, consider enabling Zero-Hour Auto Purge (ZAP), which retroactively scans and removes malicious emails even after they’ve reached users’ inboxes.

Minimizing False Positives in Quarantine

Adjusting your spam and anti-malware filters to reduce false positives is critical to maintaining productivity. You can allow trusted senders and domains to bypass the spam filter, ensuring their messages reach users without being quarantined. Regularly reviewing the Office 365 quarantine email policies also helps you maintain a balance between strict filtering and delivering legitimate messages.

By optimizing spam and anti-malware settings, you enhance your organization’s resilience to junk mail, phishing attempts, and malware, allowing users to focus on their work without interruption.

5. Manage the Office 365 Quarantine Email Process Effectively

The quarantine feature in Microsoft Defender for Office 365 provides a secure holding area for emails flagged as potential threats, such as spam, malware, or phishing attempts. By managing your quarantine settings effectively, you can ensure that harmful emails are contained while allowing legitimate messages through without unnecessary delay.

Understanding Types of Quarantined Emails

Office 365 quarantine categorizes emails based on the reason for quarantine—such as spam, high-confidence phishing, or malware. Familiarizing yourself with these categories helps you quickly identify potential threats and respond appropriately. Knowing which emails end up in quarantine due to high spam confidence or phishing detection can help you adjust policies for better accuracy.

Configuring Quarantine Policies

Defender for Office 365 allows you to customize quarantine policies according to your organization’s risk tolerance and productivity needs. For example, you can adjust spam sensitivity levels to control which emails are flagged as spam and set quarantine policies to automatically delete high-confidence malware detections after a specific timeframe. These customizations let you streamline quarantine management and reduce administrative workload.

Enabling User Access to Review Quarantined Emails

To reduce the need for admin intervention, consider enabling users to review their own quarantined emails. By allowing end users to preview and release quarantined messages, you can empower them to handle low-risk items independently, freeing up IT resources for higher-priority tasks. However, ensure that these permissions are configured carefully to maintain overall security.

Regularly Reviewing Quarantine Policies and Released Items

Monitoring your quarantine settings and released items helps you keep the system effective. Regularly reviewing quarantined items and analyzing which emails users frequently release can indicate if your filters need adjustment. This ongoing review process can help fine-tune quarantine policies, ensuring they’re aligned with the current threat landscape and user behavior.

Effectively managing your quarantine process not only improves email security but also minimizes disruptions, allowing your users to receive essential communications safely and efficiently.

6. Set Up Alerts and Notifications for Real-Time Threat Awareness

Configuring alerts in Microsoft Defender for Office 365 is essential for staying informed about potential threats in real time. By setting up targeted alerts and notifications, you can respond quickly to suspicious activities, enabling you to contain incidents before they escalate.

Setting Up Threat Detection Alerts

Defender for Office 365 offers flexible alerting options that allow you to receive notifications about specific events, such as phishing attempts, malware detections, and unusual sender behavior. Start by defining alert policies that align with your organization’s threat priorities. For instance, you may want to create high-priority alerts for activities affecting executive accounts or high-risk departments like finance. Setting thresholds for these alerts ensures you receive relevant notifications without overwhelming your inbox.

Customizing Alert Policies for Specific Teams and Users

Each department or user group in your organization may face different types of email threats. Customizing alert policies based on these differences can help you monitor high-risk users and departments more effectively. For example, you can set stricter alert policies for departments that frequently handle sensitive information or for individuals who are known to receive targeted attacks. This targeted approach helps you allocate resources where they’re most needed.

Managing Incident Notifications for Efficient Response

Defender’s incident management feature allows you to track and prioritize alerts in one centralized view, helping you quickly assess and act on the highest-impact threats. By consolidating these alerts into incidents, you can view related notifications together, streamline investigations, and reduce the time needed to resolve complex security events.

Regularly Reviewing and Adjusting Alert Thresholds

As your organization’s threat landscape evolves, regularly reviewing your alert thresholds and policies ensures they remain relevant. If certain types of alerts are frequently triggered without actual incidents, consider fine-tuning the sensitivity settings. This keeps your alert system focused on real threats and reduces false positives that can lead to alert fatigue.

Setting up tailored alerts and notifications allows you to maintain real-time awareness of threats, empowering your team to respond swiftly and effectively to protect your organization’s email environment.

7. How to Whitelist in Office 365 Admin Center and Defender

Whitelisting trusted domains and emails in Microsoft Defender for Office 365 ensures that critical messages from approved sources are delivered without unnecessary filtering or quarantine. By setting up a whitelist, you can minimize disruptions to essential communications and reduce the chances of false positives.

Managing Whitelists in the Office 365 Admin Center

If you want to manage whitelisting through the Office 365 Admin Center, you can adjust spam filter policies to allow emails from designated domains and addresses. Configuring the whitelist directly in the Admin Center gives you centralized control over approved senders, allowing you to make adjustments as your list of trusted contacts evolves. Here’s how to do it:

Step 1: Sign in to the Microsoft 365 Admin Center

Go to admin.microsoft.com and sign in with your administrator account.

Step 2: Open the Exchange Admin Center

In the Admin Center, select Show all and click Exchange to open the Exchange Admin Center.

Step 3: Access the Connection Filter Policy

In the EAC, select Protection on the left. Click Connection filter.

Step 4: Edit the Default Connection Filter Policy

Click on Default connection filter policy. Click the pencil icon to edit the policy.

Step 5: Add IP Addresses for the Domain to the Allow List

Under IP Allow List, click + to add a new IP address. Enter the IP address associated with the domain. (The Connection Filter Policy uses IP addresses, not domain names, so you’ll need the IP address of the domain’s email servers.) Click OK after each IP is entered.

Step 6: Save Changes and Confirm

Once done, click Save. The IP addresses will now bypass certain spam filters.

How to Whitelist a Domain Using Defender

Alternatively, you can whitelist within Microsoft 365 Defender Portal, like so:

Step 1: Sign in to the Microsoft 365 Defender Portal

Go to the Microsoft 365 Defender portal at security.microsoft.com and log in with your administrator account.

Step 2: Go to Anti-Spam Policies

In the left-hand menu, select Policies & rules. Under Email & collaboration, click Threat policies. Then select Anti-spam.

Step 3: Edit the Default Anti-Spam Inbound Policy

On the Anti-spam policies page, locate Anti-spam inbound policy (Default) and click it to open the settings.

Step 4: Add the Domain to the Allowed Senders List

Scroll down to Allowed and blocked senders and domains. Click Edit allowed and blocked senders and domains. Under the Allowed tab, select Domains. Click Add domains and enter the domain you want to whitelist (e.g., example.com). Click Add, then Done.

Step 5: Save and Confirm Changes

Click Save to apply your changes. The whitelisted domain will now bypass certain spam filters.

Whitelisting Individual Email Addresses

In addition to domains, you may want to whitelist specific email addresses that are crucial to your organization’s operations. For example, whitelisting an address from a known supplier or a specific contact within a client’s organization can prevent delays in receiving important updates. This process helps streamline communication from high-value contacts without reducing overall security.

Regularly Reviewing Your Whitelist for Accuracy

It’s important to regularly review and update your whitelist to reflect changes in your organization’s trusted contacts. For instance, if a previously trusted domain is no longer reliable, removing it from the whitelist prevents potential security risks. Routine checks on your whitelist ensure that only essential and safe senders have approved access, reducing the risk of accidental exposure from previously whitelisted domains that may have become compromised.

By effectively managing whitelisted domains and emails in Office 365, you maintain reliable communication with trusted sources while keeping your organization’s email security standards high.

Important Considerations

• Using IP Addresses in EAC: The Connection Filter Policy in the EAC allows whitelisting based on IP addresses rather than domain names. If you only have the domain name, contact the domain owner to get the IP addresses used for sending emails.
• Propagation Time: Changes in both methods may take a few minutes to up to an hour to propagate across your organization. Only whitelist trusted domains or IP addresses to avoid potential security risks.

8. Block Suspicious Domains to Prevent Email-Based Attacks

Blocking known malicious or suspicious domains in Microsoft Defender for Office 365 is a proactive way to protect your organization from phishing, malware, and other email-borne threats. By setting up a block list, you can prevent unwanted or harmful emails from reaching users, reducing the risk of successful attacks.

How to Block a Domain in Office 365

In the Security & Compliance Center, you can block a domain by adding it to the blocked sender list within your anti-spam policies. This configuration prevents emails from the specified domains from ever reaching user inboxes, ensuring that known malicious senders are automatically filtered out. Blocking domains associated with frequent phishing attempts or known scams can significantly reduce your organization’s exposure to email-based threats.

Creating a Targeted Block List for High-Risk Domains

When creating a block list, consider focusing on domains with a high-risk profile, such as those associated with ongoing phishing campaigns, malware distribution, or recently compromised networks. Tailoring your block list to address specific threats helps you maintain a focused, manageable list that can adapt to emerging risks in real time.

Regularly Updating the Block List for Ongoing Protection

The threat landscape is constantly evolving, and a previously benign domain may become a security risk. Regularly reviewing and updating your block list ensures it includes the latest threats. Removing outdated or inactive domains and adding new ones as threats emerge can help maintain a lean, relevant block list that addresses current risks without unnecessary entries.

Best Practices for Balancing Security and Usability

While blocking suspicious domains enhances security, it’s important to balance these settings to avoid mistakenly blocking legitimate emails. Carefully monitor your block list’s effectiveness and consider setting up alerts to notify your team if an email from a blocked domain was attempted, providing insights into potential security incidents or false positives.

Implementing a targeted block list helps you control unwanted or high-risk email traffic, enabling your organization to focus on secure and trusted communications while minimizing exposure to email-based threats.

9. Enable Office 365 Email Encryption for Confidential Communications

Mail encryption is essential for protecting sensitive information in transit, ensuring that only intended recipients can access the contents of your messages. Microsoft Defender for Office 365 provides integrated email encryption features to help you maintain confidentiality in communications that involve proprietary or regulated data.

Office 365 Email Encryption Overview

Office 365 Email Encryption secures messages by encrypting their contents so that unauthorized parties cannot read them, even if intercepted. Enabling this feature is especially critical for communications involving sensitive client data, internal projects, or regulated information under standards like HIPAA or GDPR. Encryption ensures that only verified recipients with the appropriate decryption key can access the email, adding a critical layer of security to protect data integrity.

How to Send Encrypted Email in Outlook

To use Office 365 Email Encryption in Outlook, navigate to the message options before sending an email and select encryption settings based on the sensitivity of the content. Sending encrypted email in Outlook allows you to control who can view, forward, or print the message, giving you a secure way to manage confidential communications. Users can access encrypted emails through Outlook on the web or mobile devices, allowing flexibility without compromising security.

Configuring Automatic Encryption Policies

In Microsoft Defender for Office 365, you can also set up policies to automatically encrypt emails that meet specific criteria, such as those containing sensitive keywords, client data, or attachments. By configuring automatic encryption policies, you ensure that emails meeting certain conditions are always encrypted, removing the need for manual actions and reducing the chance of accidental exposure.

Reviewing Encryption Settings for Compliance Requirements

Regularly reviewing your encryption policies helps you align email security with compliance standards. Encryption is a fundamental requirement for data protection laws and industry regulations, and keeping policies up to date ensures that you maintain secure communication practices across your organization.

Using Office 365 Email Encryption allows you to securely handle sensitive information, giving your organization confidence that confidential communications are protected against unauthorized access.

10. Leverage Threat Intelligence and Automated Response Tools

Microsoft Defender for Office 365 provides advanced threat intelligence, automated response capabilities, and tools like the Configuration Analyzer that allow organizations to proactively identify, investigate, and optimize defenses against email-based threats.

Using Threat Explorer for Proactive Threat Detection

The Threat Explorer tool in Defender for Office 365 offers a real-time view of your organization’s email activity, allowing you to search for specific threats and monitor patterns across your network. Threat Explorer helps identify indicators of compromise (IOCs), such as malicious senders, suspicious attachments, and phishing URLs, before they impact users.

Setting Up Automated Investigation and Response (AIR)

With Automated Investigation and Response (AIR), Defender for Office 365 can automatically investigate and respond to low-risk alerts, such as quarantining suspicious emails or removing malware. This automation saves time for the IT team, allowing them to focus on more complex incidents.

Using Configuration Analyzer for Security Optimization

The Configuration Analyzer complements threat intelligence and automated responses by continuously assessing your email security settings. It compares current policies with Microsoft’s Standard and Strict recommendations, providing insights and actionable recommendations to enhance your organization’s security posture. Administrators can implement these recommendations directly through the Analyzer, ensuring email configurations are aligned with best practices.

The Configuration Analyzer also includes a historical view of policy changes, enabling administrators to monitor and audit security adjustments over time. By regularly reviewing Configuration Analyzer recommendations, organizations can maintain optimized security settings that keep pace with evolving threats, enhancing overall resilience.

By leveraging tools like Threat Explorer, AIR, and Configuration Analyzer, your organization can maintain a proactive defense against email-based threats, streamline incident response, and ensure security configurations remain up-to-date and aligned with best practices.

Case Study

In partnership with a customer’s team, we recently conducted an in-depth email security assessment, comparing Defender for Office 365 with another email security platform. This collaboration highlighted Defender’s superior capabilities in detection, proactive response, and comprehensive visibility.

1. Advanced Phishing Detection: Early in the assessment, a suspicious email flagged by Defender for Office 365 as unsafe had been initially marked as safe by the other platform. This incident underscored Defender’s advanced AI-driven threat detection, capturing nuanced phishing attempts that can evade standard filters and providing critical protection for the customer’s end users.
2. Proactive Email Quarantine: Defender for Office 365 further demonstrated its proactive threat management by automatically quarantining emails from suspicious domains, effectively stopping potential threats before they reached user inboxes.
3. Insightful Header Analysis: Working alongside the customer’s team, we utilized Defender’s header analysis tool to trace email origins and understand Defender’s logic behind flagged messages. This feature gave their team the insights needed to conduct efficient and accurate threat investigations.
4. Enhanced Threat Visibility: Defender for Office 365 offered broader visibility into email threats, revealing additional threats that the other platform missed. This highlighted the value of Defender’s expansive threat visibility, ensuring more robust security coverage.

Through this collaboration, the customer’s team gained hands-on experience with Defender for Office 365’s powerful detection, quarantine, and investigation tools. The engagement illustrated how Defender’s enhanced visibility and proactive capabilities provide a truly comprehensive email security solution.

Conclusion: Strengthen Your Email Security with Levacloud’s Expertise

Implementing and managing the full range of Microsoft Defender for Office 365’s email security features can significantly enhance your organization’s defense against phishing, malware, and data breaches.

However, configuring these tools to suit your unique needs and maintaining optimal security requires in-depth knowledge and ongoing oversight.

Levacloud specializes in helping organizations like yours fully leverage Microsoft Defender for Office 365 to establish a secure, compliant, and resilient email environment.

Our team of Microsoft security experts provides hands-on guidance, from initial setup to advanced configurations, ensuring that each layer of protection—whether anti-phishing, encryption, or threat intelligence—is optimized for your specific requirements.

Let Levacloud be your Microsoft Defender for Office 365 partner, enabling you to focus on your business while we handle your email security needs. Contact us to learn more about how we can help you maximize your Office 365 investment and stay ahead of email-based threats.