What settings should be used to reduce phishing

Question

We're getting a lot of phishing emails and I assume there are some settings I could make more aggressive to reduce the odds of such emails getting through. They're already flagged as external, but I'd feel better if fewer made it to the users.

I have to choose a platform below, but it's not clear that that matters.

Answer 1

Dear John Miller, 

Good day! Thank you for your response and for sharing more about your setup. I understand how important it is to protect your users from phishing emails, and I appreciate your efforts in reporting suspicious messages. Based on the information you’ve provided, I’d like to walk you through a few steps that can help strengthen your email security using Outlook on the web and Microsoft 365 admin tools. 

1. Apply a Preset Security Policy 

1. Sign in to the Microsoft 365 Defender portal at https://security.microsoft.com.
2. Go to Email & Collaboration > Policies & Rules > Threat Policies.
3. Select Preset Security Policies.
4. Choose the Strict preset and apply it to users who are most at risk or to all users if appropriate.
   • This policy includes anti-phishing, anti-spam, and anti-malware protection with aggressive filtering.

2. Review and Adjust Anti-Phishing Settings 

1. In the same Threat Policies section, go to Anti-Phishing.
2. If no custom policy exists, create one and assign it to your users.
3. Enable the following options:  
   • Impersonation protection for your domain and key users (like executives or finance team members).
   • Spoof intelligence to block senders pretending to be from trusted domains.
   • Actions for detected phishing: set to Quarantine or Reject.

3. Check Mail Flow Rules (Transport Rules) 

1. In the Microsoft 365 admin center, go to Exchange Admin Center.
2. Navigate to Mail Flow > Rules.
3. Review any rules that allow or bypass filtering for specific domains or addresses.  
   • If any exist, ensure they include authentication checks like SPF, DKIM, or DMARC.

4. Encourage Continued Reporting Since your users are already good at reporting phishing, that’s a great advantage. Make sure the “Report Message” add-in is enabled in Outlook on the web so users can easily flag suspicious emails. This feedback helps Microsoft improve detection across your organization. 

For more information, you can check here: 

Phishing and suspicious behavior in Outlook - Microsoft Support 

Configure anti-phishing policies in Microsoft Defender for Office 365 - Microsoft Defender for Office 365 | Microsoft Learn 

Please feel free to reply with any questions or if you’d like assistance walking through any of the steps above. I’m here to help and happy to support you further. 

Warm regards, 

Vy-Ng - MSFT | Microsoft Community Support Specialist

Answer 2

1. Some of our licenses say "Microsoft 365 Business ..." and others say "Exchange Online..." so I'm not sure.
2. Yes. The admin center
3. Mostly Mac but there are quite a few PCs as well and an uncertain number of phones
4. No

I'll look at your suggestions. We are pretty good at reporting suspicious emails.

Thanks

Answer 3

Hi

Good morning! I hope this message finds you well.

It's been a while since our last conversation, and I wanted to check in on how things are progressing with the issues we've discussed. Have you had a chance to review the answers we have provided?

If there is anything else, I can help you, please don't hesitate to get in touch. I would be happy to help.

Thank you
Vy-Ng – MSFT | Microsoft Community Support Specialist

Answer 4

Dear John Miller, 

Good day! Thank you for reaching out to the Microsoft Support Community and sharing your experience. I understand your concern about phishing emails and how important it is to keep your users protected. I’m here to help guide you through the best steps to improve your email security. 

To better assist you, I’d like to ask a few questions to understand your setup more clearly: 

1. Are you using Microsoft 365 Business, Exchange Online, or another type of business account?
2. Do you manage your organization’s email settings through the Microsoft 365 admin center or another platform?
3. Are your users accessing Outlook on the web from Windows PCs, Macs, mobile devices, or a mix?
4. Have you already configured any anti-phishing policies or mail flow rules in Microsoft Defender or Exchange?

In the meantime, here are some initial actions you can take right away: 

1. Apply a Strict Anti-Phishing Policy 
   In the Microsoft 365 admin center, you can enable the “Strict” preset security policy. This helps block even low-confidence phishing attempts before they reach users.
2. Review Mail Flow Rules and Allow Lists 
   Check if any domains or addresses are allowed through filters. If so, make sure sender authentication checks (like SPF, DKIM, and DMARC) are also enabled to prevent spoofing.
3. Use Quarantine for Suspicious Messages 
   Configure your spam filter to quarantine suspicious emails instead of delivering them to inboxes. This gives you a chance to review them safely.
4. Encourage Users to Report Suspicious Emails 
   Outlook on the web includes a “Report Message” button. When users report phishing attempts, it helps improve detection across your organization.

Once I have your answers to the questions above, I’ll be able to provide more tailored recommendations. Please feel free to reply with any additional details or concerns. 

Warm regards, 

Vy-Ng - MSFT | Microsoft Community Support Specialist