Hardening Microsoft 365 Mail Security
Review Baseline Policies
Confirm that Microsoft Secure Defaults are enabled for all tenants unless a conditional access strategy is already documented.
In the Microsoft 365 Defender portal, open Threat policies and review the preset security policies applied to your domains.
Enable the Standard preset at a minimum, and apply the Strict preset to admin accounts and service accounts receiving critical alerts.
Enable Advanced Threat Protection
From the Defender portal navigate to Policies & Rules → Threat Policies → Safe Attachments. Switch the policy mode to Dynamic Delivery to prevent user delays.
Create a Safe Links policy that rewrites URLs and blocks click-through on known malicious addresses, targeting all mailboxes.
Turn on user and domain impersonation protection within Anti-Phishing policies, adding executive and finance user mailboxes to the high value target list.
Create Transport Rules for BEC Defense
Open the Exchange Admin Center and browse to Mail flow → Rules. Add rules that prepend a warning banner for messages received from external domains.
Block automatic forwarding to external domains unless explicitly approved for a vendor integration.
Log and quarantine messages that spoof your primary domains when they originate outside approved connectors.