Edit

Anti-phishing protection in Microsoft 365

  • Article

Tip

Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub. Learn about who can sign up and trial terms here.

Applies to

Phishing is an email attack that tries to steal sensitive information in messages that appear to be from legitimate or trusted senders. There are specific categories of phishing. For example:

  • Spear phishing uses focused, customized content that's specifically tailored to the targeted recipients (typically, after reconnaissance on the recipients by the attacker).

  • Whaling is directed at executives or other high value targets within an organization for maximum effect.

  • Business email compromise (BEC) uses forged trusted senders (financial officers, customers, trusted partners, etc.) to trick recipients into approving payments, transferring funds, or revealing customer data. Learn more by watching this video.

  • Ransomware that encrypts your data and demands payment to decrypt it almost always starts out in phishing messages. Anti-phishing protection can't help you decrypt encrypted files, but it can help detect the initial phishing messages that are associated with the ransomware campaign. For more information about recovering from a ransomware attack, see Ransomware incident response playbooks.

With the growing complexity of attacks, it's even difficult for trained users to identify sophisticated phishing messages. Fortunately, Exchange Online Protection (EOP) and the additional features in Microsoft Defender for Office 365 can help.

Anti-phishing protection in EOP

EOP (that is, Microsoft 365 organizations without Microsoft Defender for Office 365) contains features that can help protect your organization from phishing threats:

  • Spoof intelligence: Use the spoof intelligence insight to review detected spoofed senders in messages from external and internal domains, and manually allow or block those detected senders. For more information, see Spoof intelligence insight in EOP.

  • Anti-phishing policies in EOP: Turn spoof intelligence on or off, turn unauthenticated sender indicators in Outlook on or off, and specify the action for blocked spoofed senders. For more information, see Configure anti-phishing policies in EOP.

    Honor the sender's DMARC policy when the message is detected as spoof (currently in Preview): Control what happens to messages where the sender fails explicit DMARC checks and the DMARC policy is set to p=quarantine or p=reject. For more information, see Spoof protection and sender DMARC policies.

  • Allow or block spoofed senders in the Tenant Allow/Block List: When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the Spoofed senders tab in the Tenant Allow/Block List. You can also manually create allow or block entries for spoof senders before they're detected by spoof intelligence. For more information, see Manage the Tenant Allow/Block List in EOP.

  • Implicit email authentication: EOP enhances standard email authentication checks for inbound email (SPF, DKIM, and DMARC with sender reputation, sender history, recipient history, behavioral analysis, and other advanced techniques to help identify forged senders. For more information, see Email authentication in Microsoft 365.

Additional anti-phishing protection in Microsoft Defender for Office 365

Microsoft Defender for Office 365 contains additional and more advanced anti-phishing features:

  • Anti-phishing policies in Microsoft Defender for Office 365: Configure impersonation protection settings for specific message senders and sender domains, mailbox intelligence settings, and adjustable advanced phishing thresholds. For more information, see Configure anti-phishing policies in Microsoft Defender for Office 365. For more information about the differences between anti-phishing policies in EOP and anti-phishing policies in Defender for Office 365, see Anti-phishing policies in Microsoft 365.
  • Campaign Views: Machine learning and other heuristics identify and analyze messages that are involved in coordinated phishing attacks against the entire service and your organization. For more information, see Campaign Views in Microsoft Defender for Office 365.
  • Attack simulation training: Admins can create fake phishing messages and send them to internal users as an education tool. For more information, see Simulate a phishing attack.

Other anti-phishing resources