Defender for Office 365
Safe Attachments, Safe Links, and impersonation protection — configured, tuned, and tested against your real mail flow.
One Phishing Click Is Still the Most Common Breach
Ninety percent of mid-market breaches start with an email. A link that looks legitimate. An attachment from a known vendor. A CEO fraud message sent to accounting on a Friday afternoon. Exchange Online's built-in anti-spam catches the obvious — it does not catch the targeted ones.
This is not a failure of your IT team. Defender for Office 365 Plan 1 is included in every M365 Business Premium and M365 E5 license. What is missing: the Preset Security Policies need tuning, anti-phishing impersonation protection needs VIP and domain lists, Safe Attachments needs an unblock path for false positives. Without a structured rollout, the first broken workflow gets reported to the helpdesk, the policy gets disabled, and the protection is gone.
Traditional consulting for MDO? A week of billable hours for what is mostly clicking through admin-center wizards. The consultant leaves. Your team does not know why a specific setting was chosen.
ACTIVITIES IN DETAIL
DELIVERABLES
Verify Defender for Office 365 Plan 1 or Plan 2 coverage across all in-scope mailboxes
Inventory current state: Preset Security Policies, anti-spam, anti-malware, anti-phishing, Safe Attachments, Safe Links
Enable Preset Security Policies (Standard or Strict) as the baseline for all users
Configure anti-phishing with impersonation protection: add executives, finance, HR as protected users; add your own and critical partner domains as protected domains
Tune Safe Attachments: Dynamic Delivery policy, quarantine for detected malware, safe attachments for SharePoint, OneDrive, and Microsoft Teams
Configure Safe Links for Outlook, Office Apps, and Microsoft Teams — block known-malicious URLs at click time
Enable Zero-hour Auto Purge (ZAP) for malware, phishing, and spam
Configure user tags: Priority Account protection for executives (MDO Plan 2), standard tagging for departmental scoping
Set up the user-reported message workflow: Report Message add-in, internal triage mailbox, admin submissions
Tune false-positive handling via Tenant Allow/Block Lists — documented exception process
Real-time Detections dashboard walkthrough: what to monitor, when to escalate
Next steps after Defender for Office 365
A cleanly configured tenant is the foundation. These blueprints build directly on it
