Step-by-Step Configuration of Microsoft Defender for Office 365

---

🎯 Objective

To configure email security policies in Microsoft 365 to protect against:

• Phishing attacks
• Malicious links
• Unsafe attachments

---

🛠️ Prerequisites

• Microsoft 365 Admin access
• Defender for Office 365 license (Plan 1 or Plan 2)

---

🔐 Step 1: Open Microsoft Defender Portal

1. Go to: https://security.microsoft.com
2. Sign in with admin account
3. Navigate to:

Email & Collaboration → Policies & Rules

---

🔗 Step 2: Configure Safe Links Policy

1. Go to: Threat Policies → Safe Links
2. Click Create Policy
3. Configure:

• Name: SafeLinks-Policy
• Apply to: All Users
• Enable:
  ✔ URL scanning
  ✔ Real-time protection
  ✔ Click tracking

4. Click Save

👉 This ensures malicious links are blocked before users open them.

---

📎 Step 3: Configure Safe Attachments

1. Go to: Threat Policies → Safe Attachments
2. Click Create Policy
3. Configure:

• Name: SafeAttachments-Policy
• Action: Block or Dynamic Delivery
• Apply to: All Users

4. Click Save

👉 Attachments will be scanned in a sandbox before delivery.

---

🎭 Step 4: Configure Anti-Phishing Policy

1. Navigate to: Threat Policies → Anti-Phishing
2. Click Create Policy
3. Configure:

• Enable impersonation protection
• Add protected users (CEO, Admins)
• Enable mailbox intelligence

4. Save policy

👉 Helps prevent spoofing and impersonation attacks.

---

🧪 Step 5: Test the Configuration

1. Send a test email with:
   • Suspicious link
   • Attachment
2. Observe:

✔ Link gets blocked
✔ Attachment scanned
✔ Alerts generated

---

📊 Step 6: Monitor Threats

1. Go to: Dashboard → Threat Explorer
2. Review:

• Detected threats
• Blocked emails
• User activity

---

💡 Real-World Scenario

User receives phishing email:

✔ Safe Links blocks URL
✔ Safe Attachments scans file
✔ Email flagged as suspicious