Recommended email and collaboration threat policy settings for cloud organizations

Although all organizations with cloud mailboxes include built-in security features, Microsoft Defender for Office 365 is the primary email and collaboration security solution for Microsoft 365.

We recommend two security levels: Standard and Strict. Although customer environments and needs are different, these levels of filtering help keep unwanted email out of user mailboxes in most situations.

To automatically apply the Standard or Strict settings to users, use Preset security policies.

This article describes the default threat policy settings, and also the recommended Standard and Strict settings to help protect users. The tables contain the settings in the Microsoft Defender portal and Exchange Online PowerShell.

Built-in security features for all cloud mailboxes

The the built-in security features in this section are available in all organizations with cloud mailboxes. We recommend the Standard or Strict configurations as described in the tables in the following subsections.

Anti-malware policy settings

To create and configure anti-malware policies, see Configure anti-malware policies.

Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy.

The policy named AdminOnlyAccessPolicy enforces the historical capabilities of messages quarantined as malware as described in the table in this article.

Users can't release their own messages quarantined as malware, regardless of how the quarantine policy is configured. If the policy is configured for users to release these quarantined messages, users are instead allowed to request the release of these quarantined messages.

Anti-spam policy settings

To create and configure anti-spam policies, see Configure anti-spam policies.

Wherever you select Quarantine message as the action for a spam filter verdict, a Select quarantine policy box is available. Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy.

If you change the action of a spam filtering verdict to Quarantine message as you create anti-spam policies in the Defender portal, the Select quarantine policy box is blank by default. A blank value means the default quarantine policy for that spam filtering verdict is used. These default quarantine policies enforce the historical capabilities of the spam filter verdict that quarantined the message as described in the table in this article. When you later view or edit the anti-spam policy settings, the quarantine policy name is shown.

Admins can create or use quarantine policies with more restrictive or less restrictive capabilities. For instructions, see Create quarantine policies in the Microsoft Defender portal.

¹ As described in Full access permissions and quarantine notifications, your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy. Quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy.

ASF settings in anti-spam policies

For more information about Advanced Spam Filter (ASF) settings in anti-spam policies, see Advanced Spam Filter (ASF) settings in anti-spam policies.

Outbound spam policy settings

To create and configure outbound spam policies, see Configure outbound spam filtering.

For more information about the default sending limits in the service, see Sending limits.

Anti-phishing policy settings for all cloud mailboxes

The anti-phishing policy settings described in this section are part of the built-in security features included in all organizations with cloud mailboxes. For more information about these settings, see Spoof settings. To configure these settings, see Configure anti-phishing policies for all cloud mailboxes.

The spoof settings are inter-related, but the Show first contact safety tip setting has no dependency on spoof settings.

Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy.

Although the Apply quarantine policy value appears unselected when you create an anti-phishing policy in the Defender portal, the quarantine policy named DefaultFullAccessPolicy¹ is used if you don't select a quarantine policy. This policy enforces the historical capabilities of messages quarantined as spoof as described in the table in this article. When you later view or edit the anti-phishing policy settings, the quarantine policy name is shown.

Admins can create or use quarantine policies with more restrictive or less restrictive capabilities. For instructions, see Create quarantine policies in the Microsoft Defender portal.

¹ As described in Full access permissions and quarantine notifications, your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy. Quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy.

Microsoft Defender for Office 365 security

If your Microsoft 365 subscription includes Defender for Office 365 or you purchased Defender for Office 365 as an add-on, you get the extra security features as described in the following subsections. For the latest news and information about Defender for Office 365 features, see What's new in Defender for Office 365.

We recommend the Standard or Strict configurations for Defender for Office 365 as described in the tables in the following subsections.

Anti-phishing policy settings in Microsoft Defender for Office 365

All Microsoft 365 organizations with cloud mailboxes get anti-phishing protection as previously described. But Defender for Office 365 includes more features and control to help prevent, detect, and remediate phishing attacks. To create and configure these anti-phishing policies, see Configure anti-phishing policies in Defender for Office 365.

Phishing email thresholds in anti-phishing policies in Microsoft Defender for Office 365

For more information about this setting, see Phishing email thresholds in anti-phishing policies in Microsoft Defender for Office 365. To configure this setting, see Configure anti-phishing policies in Defender for Office 365.

Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365

For more information about these settings, see Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365. To configure these settings, see Configure anti-phishing policies in Defender for Office 365.

Wherever you select Quarantine the message as the action for an impersonation verdict, an Apply quarantine policy box is available. Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy.

Although the Apply quarantine policy value appears unselected when you create an anti-phishing policy in the Defender portal, the quarantine policy named DefaultFullAccessPolicy is used if you don't select a quarantine policy. This policy enforces the historical capabilities of messages quarantined as impersonation as described in the table in this article. When you later view or edit the anti-phishing policy settings, the quarantine policy name is shown.

Admins can create or use quarantine policies with more restrictive or less restrictive capabilities. For instructions, see Create quarantine policies in the Microsoft Defender portal.

¹ As described in Full access permissions and quarantine notifications, your organization might use NotificationEnabledPolicy instead of DefaultFullAccessPolicy. Quarantine notifications are turned on in NotificationEnabledPolicy and turned off in DefaultFullAccessPolicy.

Anti-phishing policy settings for all cloud mailboxes in Defender for Office 365

The previously described anti-phishing policy settings for all cloud mailboxes are also available in Defender for Office 365.

Safe Attachments settings

Safe Attachments in Defender for Office 365 includes global settings that have no relationship to Safe Attachments policies, and settings that are specific to each Safe Attachments policy. For more information, see Safe Attachments in Microsoft Defender for Office 365.

Although there's no default Safe Attachments policy, the Built-in protection preset security policy provides Safe Attachments protection to all recipients who aren't defined in the Standard or Strict preset security policies or in custom Safe Attachments policies. For more information, see Preset security policies.

Global settings for Safe Attachments

To configure these settings, see Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams and Safe Documents in Microsoft 365 E5.

In Exchange Online PowerShell, you use the Set-AtpPolicyForO365 cmdlet for these settings.

Safe Attachments policy settings

To configure these settings, see Set up Safe Attachments policies in Defender for Office 365.

In Exchange Online PowerShell, you use the New-SafeAttachmentPolicy and Set-SafeAttachmentPolicy cmdlets for these settings.

Quarantine policies define what users are able to do to quarantined messages, and whether users receive quarantine notifications. For more information, see Anatomy of a quarantine policy.

The policy named AdminOnlyAccessPolicy enforces the historical capabilities of messages quarantined as malware as described in the table in this article.

Users can't release their own messages quarantined as malware or phishing by Safe Attachments, regardless of how the quarantine policy is configured. If the policy is configured for users to release these quarantined messages, users are instead allowed to request the release of these quarantined messages.

Safe Links policy settings

For more information about Safe Links protection, see Safe Links in Defender for Office 365.

Although there's no default Safe Links policy, the Built-in protection preset security policy provides Safe Links protection to all recipients who aren't defined in the Standard preset security policy, the Strict preset security policy or in custom Safe Links policies. For more information, see Preset security policies.

To configure Safe Links policy settings, see Set up Safe Links policies in Microsoft Defender for Office 365.

In Exchange Online PowerShell, you use the New-SafeLinksPolicy and Set-SafeLinksPolicy cmdlets for Safe Links policy settings.

Microsoft Teams protection settings in Microsoft Defender for Office 365

For more information about Microsoft Teams protection, see Microsoft Defender for Office 365 support for Microsoft Teams.

In Exchange Online PowerShell, you use the New-TeamsProtectionPolicy and Set-TeamsProtectionPolicy cmdlets for Microsoft Teams protection settings.

Related articles

• Are you looking for best practices for Exchange mail flow rules (also known as transport rules)? See Best practices for configuring mail flow rules in Exchange Online.

• Admins and users can submit false positives (good email marked as bad) and false negatives (bad email allowed) to Microsoft for analysis. For more information, see Report messages and files to Microsoft.

• You can find Security baselines for Windows in the following articles:

  • Group policy: Where can I get the security baselines?
  • Microsoft Intune*: Use security baselines to configure Windows devices in Intune for Intune-based security.
  • Comparison of Microsoft Defender for Endpoint and Microsoft Intune security baselines: Compare the Microsoft Defender for Endpoint and the Windows Intune security baselines.