Spam Vs Phishng Policy

Question

Hi

My question as around O365 Spam and Phishing policies.

Within a phishing policy we can set impersonation - gimp, dimp and uimp to go to quarantine for user review.

Then within a spam policy we can set spam and bulk actions for phishing email to move messages to junk folder.

Is there a confliction here or does this simply mean all phishing other then impersonation will go to junk and impersonation goes to quarantine?

Answer 1

Here is the order or priority:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined?view=o365-worldwide

For the second question, spam notifications will include items in the quarantine:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-spam-notifications-to-release-and-report-quarantined-messages?view=o365-worldwide

Note:

Answer 2

Sorry another question can users be notified also that messages are in Quarantine?

There is an option within the spam policies that can report spam messages to end users but we would like only for them to be notified of messages in quarantine.

Answer 3

Hi @Andy David - MVP

Thanks for the response

Is there a way to configure it so users are only notified of quarantine and not junk emails?

Answer 4

Ah ok so that's what I am looking to achieve. I only want users notified of quarantine emails not emails that go to junk so if thats the default behaviour then that meets the request :)

We only quarantine gimp, dimp and uimp cat emails and we only want users notified of these. Rest goes to junk and as you say user can manage that themselves.

Thank you for your help