Configure anti-phishing impersonation protection, mailbox intelligence and safety tips

Description

Every recipient is covered by an anti-phishing policy (the impersonation settings of the Standard or Strict preset, or a custom policy) with at least the Standard values:

• Phishing email threshold at {{ phish_threshold }} or higher (PhishThresholdLevel);
• user impersonation protection on (EnableTargetedUserProtection $true) for {{ protected_users }}, action Quarantine the message;
• domain impersonation protection on for the organization's domains (EnableOrganizationDomainsProtection $true) and for {{ partner_domains }} (EnableTargetedDomainsProtection $true), action Quarantine the message;
• mailbox intelligence and intelligence for impersonation protection on (EnableMailboxIntelligence, EnableMailboxIntelligenceProtection), action Move the message to the recipients' Junk Email folders or stricter;
• safety tips on: user impersonation, domain impersonation, unusual characters, first contact, unauthenticated sender (?) and "via" tag;
• spoof intelligence on, spoofed senders moved to Junk Email or quarantined;
• trusted senders and domains (ExcludedSenders, ExcludedDomains) empty or limited to documented false positives.

Rationale

Business email compromise relies on a sender that looks like someone the victim trusts: the CEO from a personal address, examp1e.com for example.com, a supplier asking to change bank details. Impersonation protection compares senders with the protected names and domains and with each user's usual contacts (mailbox intelligence); safety tips warn users when the match is not certain.

Impact

Some legitimate messages (a protected executive writing from a personal account, a partner with a similar domain) may be quarantined; add them as trusted senders or domains after review. The protected user list is limited to 350 entries per policy.

Applies when

Requires: Microsoft Defender for Office 365 Plan 1

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Preset security policies and review the impersonation protection of the Standard and Strict presets; then Threat policies > Anti-phishing for custom policies and the default policy.
3. Check the values above for each policy that applies to users.
4. In Exchange Online PowerShell (read-only):

   Get-AntiPhishPolicy | Format-List Name, PhishThresholdLevel, EnableTargetedUserProtection, TargetedUsersToProtect,
     TargetedUserProtectionAction, EnableOrganizationDomainsProtection, EnableTargetedDomainsProtection, TargetedDomainsToProtect,
     TargetedDomainProtectionAction, EnableMailboxIntelligence, EnableMailboxIntelligenceProtection, MailboxIntelligenceProtectionAction,
     EnableSimilarUsersSafetyTips, EnableSimilarDomainsSafetyTips, EnableUnusualCharactersSafetyTips, EnableFirstContactSafetyTips,
     EnableUnauthenticatedSender, EnableViaTag, EnableSpoofIntelligence, AuthenticationFailAction, ExcludedSenders, ExcludedDomains
   

5. Fail if a policy that applies to users misses one of the values, if the protected users or partner domains lists are empty, or if trusted senders and domains contain undocumented entries.

Remediation

1. Prefer the preset: in Preset security policies > Standard protection (and Strict)

   Manage protection settings > Impersonation protection, add the protected users and partner domains and confirm (Security Administrator).

2. For a custom policy, in Anti-phishing, edit the policy: Phishing threshold & protection with the threshold, user and domain protection, mailbox intelligence; Actions with Quarantine for user and domain impersonation and every safety tip selected.
3. PowerShell equivalent:

   Set-AntiPhishPolicy -Identity "<policy>" -PhishThresholdLevel 3 -EnableTargetedUserProtection $true `
     -TargetedUsersToProtect "CEO;[email protected]","CFO;[email protected]" -TargetedUserProtectionAction Quarantine `
     -EnableOrganizationDomainsProtection $true -EnableTargetedDomainsProtection $true -TargetedDomainsToProtect "partner.example" `
     -TargetedDomainProtectionAction Quarantine -EnableMailboxIntelligence $true -EnableMailboxIntelligenceProtection $true `
     -MailboxIntelligenceProtectionAction MoveToJmf -EnableSimilarUsersSafetyTips $true -EnableSimilarDomainsSafetyTips $true `
     -EnableUnusualCharactersSafetyTips $true -EnableFirstContactSafetyTips $true -EnableUnauthenticatedSender $true -EnableViaTag $true
   

Rollback

Set the impersonation actions back to NoAction on the custom policy, or remove a protected entry that causes false positives.

References

• Configure anti-phishing policies in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• Anti-phishing policies in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-111 to 123, 180, 220 to 230, 241) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-003 Tag messages from external senders in Outlook
• related CB-M365-MAIL-017 Honor the sender's DMARC policy for inbound spoofed mail
• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients
• related CB-M365-MAIL-020 Tag priority accounts and protect them with the Strict preset security policy

People and lifecycle