Phishing is still the way most organizations get breached, and Microsoft 365 is a prime target simply because so many businesses run on it. The good news is that a default tenant already blocks a lot. The bad news is that “default” leaves real gaps — impersonation attempts, lookalike domains, and links that turn malicious after delivery all slip through a tenant that nobody has hardened.
No single setting fixes this. Phishing defense in Microsoft 365 works because several layers overlap: filtering catches the obvious stuff, anti-phishing policies catch impersonation, Safe Links catches weaponized URLs, MFA catches the credential theft when a message does get through, and email authentication stops attackers spoofing your own domain. This guide walks through each layer and how to set it up, then ties them together so you can see where the coverage comes from.
Start with the layers, not a single switch
Before the configuration, get the model straight. A phishing email has to survive several checkpoints to do damage, and each layer you add removes one of its options.
The layers of Microsoft 365 phishing defense
| Email filtering (EOP) | Blocks known spam, malware, and basic spoofing — on by default |
|---|---|
| Anti-phishing policy | Impersonation + mailbox intelligence for lookalike senders (Defender) |
| Safe Links / Safe Attachments | Time-of-click URL checks and sandbox detonation (Defender) |
| MFA + Conditional Access | Stops stolen credentials from being usable |
| SPF / DKIM / DMARC | Stops attackers spoofing your own domain |
| User reporting | Humans flag what the filters miss |
The aim is defense in depth. If a message gets past filtering, the anti-phishing policy should flag the impersonation; if the user clicks anyway, Safe Links should block the destination; if they still hand over a password, MFA should stop the login. Each layer assumes the one before it might fail.
Layer 1: Configure the anti-phishing policy
Exchange Online Protection gives every tenant baseline spoof filtering for free. The real anti-phishing muscle is in the Defender for Office 365 anti-phishing policy, which adds two things the baseline doesn’t have: impersonation protection and mailbox intelligence.
Configure it in the Defender portal under Email & collaboration → Policies & rules → Threat policies → Anti-phishing.
Impersonation protection
Impersonation protection guards specific people and domains against lookalike attacks — the
classic “CEO emails the finance team from [email protected]” scam, where the
display name is right and the domain is almost right.
- User impersonation — protect named high-value people (executives, finance, HR). Defender flags messages where the display name matches a protected user but the address doesn’t.
- Domain impersonation — protect your own domains and key partner domains against lookalike variants (character swaps, extra letters, different TLDs).
Mailbox intelligence
Mailbox intelligence learns each user’s normal contacts and senders. When a message mimics someone the user emails regularly but comes from a slightly different address, that anomaly becomes an impersonation signal. It catches targeted attacks that static rules can’t, because “normal” is different for every mailbox.
You also set the action for each detection — move to junk, quarantine, or add a warning — and can turn on safety tips and the first-contact safety tip that flags mail from someone the user has never heard from.
Layer 2: Turn on Safe Links and Safe Attachments
Phishing increasingly relies on links and files rather than the email text itself. Safe Links and Safe Attachments, both part of Defender for Office 365, cover those.
- Safe Links rewrites URLs and re-checks them at the moment of click, so a link that was clean on delivery but weaponized later still gets caught. It extends to Teams and the Office apps too.
- Safe Attachments detonates files in an isolated sandbox before the user can open them, catching brand-new malware that has no signature yet.
Because these two are a topic in their own right — including the Dynamic Delivery setting and the bypass list — we cover the setup in detail in Safe Links vs Safe Attachments in Microsoft Defender. For phishing defense, the key point is that they catch the payload after a message slips past filtering and the user clicks anyway.
Layer 3: MFA and Conditional Access
Most phishing exists to steal a password. The moment you enforce multi-factor authentication, a stolen password on its own stops being enough to sign in. This is the single highest-impact control against the outcome of phishing, even though it doesn’t stop the email itself.
Don’t stop at plain MFA. Conditional Access lets you require MFA intelligently, block legacy authentication protocols that can’t do MFA at all, and demand managed devices for sensitive apps. Blocking legacy auth matters specifically because attackers use those old protocols to sidestep MFA entirely during password-spray attacks.
Both topics go deeper than this section. Start with enabling MFA for your Microsoft 365 users, then layer on the policy engine described in Conditional Access explained for Microsoft 365 admins.
Layer 4: Email authentication (SPF, DKIM, DMARC)
These three records don’t stop phishing aimed at you — they stop attackers sending phishing as you. Without them, a scammer can spoof your domain to phish your customers, partners, and even your own staff.
The three email authentication records
| SPF | DNS TXT record listing the servers allowed to send mail for your domain |
|---|---|
| DKIM | Cryptographic signature on outbound mail proving it wasn't altered and came from you |
| DMARC | Policy telling receivers what to do (none/quarantine/reject) when SPF/DKIM fail, plus reporting |
The progression most admins follow:
- Publish an SPF record listing Microsoft 365 (and any other senders) as authorized.
- Enable DKIM signing for your domains in the Defender portal and publish the CNAME records.
- Publish a DMARC record starting at
p=noneto collect reports, then tighten top=quarantineand eventuallyp=rejectonce you’ve confirmed legitimate mail passes.
If you’re still setting up your domains, the authentication records are part of that process — see adding a custom domain to Microsoft 365, which is where SPF and DKIM naturally get configured.
Layer 5: User reporting
Filters miss things, especially well-crafted targeted attacks. Your users are a detection layer if you give them an easy way to report. Deploy the Report Phishing / Report Message button so a suspicious email is one click from your security team and from Microsoft’s analysis.
Phishing-resistant tenant checklist
- Anti-phishing policy on, with impersonation protection for key people and domains
- Mailbox intelligence enabled
- Safe Links and Safe Attachments policies in place
- MFA enforced for all users via Conditional Access
- Legacy authentication blocked
- SPF, DKIM, and DMARC published (DMARC progressing toward reject)
- Report Phishing button deployed to users
- A process to review reported messages and quarantine
Reporting only helps if someone acts on it. Pair the button with a habit of reviewing reported mail and the quarantine, so genuine threats get pulled from other inboxes and false positives get released quickly. Defender for Office 365 Plan 2 adds attack simulation training, which lets you run safe phishing drills and target follow-up training where users click most.
How the layers cover each other
Walk a phishing email through a hardened tenant and you can see why the layering works. A spoofed-domain message dies at SPF/DMARC. A lookalike-domain impersonation gets flagged by the anti-phishing policy. A malicious link survives delivery but gets blocked by Safe Links at click time. A weaponized attachment gets caught in Safe Attachments detonation. And if a credential somehow gets phished anyway, MFA and Conditional Access stop the attacker from using it. A user reports the one that made it to an inbox, and you quarantine it across the tenant.
No layer is complete on its own. Filtering misses targeted attacks, impersonation protection doesn’t see weaponized links, MFA doesn’t stop the email arriving. Stacked together, they leave a phishing campaign very little room to work.
Wrapping up
Protecting Microsoft 365 from phishing isn’t one setting, it’s a stack: baseline filtering, an anti-phishing policy with impersonation protection and mailbox intelligence, Safe Links and Safe Attachments, MFA enforced through Conditional Access, SPF/DKIM/DMARC on your domains, and a user reporting habit on top. If you’re starting from a bare tenant, the highest-value moves are enforcing MFA and turning on the anti-phishing policy — then work outward to the rest. Most of the strongest controls live in Defender for Office 365, so confirm your licensing covers the mailboxes you’re protecting.
Build the layers in the order that gives you coverage fastest, and revisit them as attackers shift tactics. The defenses that matter most this year — number-matching MFA, DMARC enforcement, token-theft-aware Conditional Access — were edge cases not long ago.
