Enable and Review Email Threat Protection

Before you start

Before starting: identify the mail administrator, alert reviewer, and backup contact. Record current policies, licenses, mail gateways, and exceptions. Agree how users report missing or suspicious mail and how the business will recover from a false positive.

Put it into practice

1. Inventory the service's included spam, malware, phishing, spoofing, and attachment controls. In Microsoft 365, inspect Email & collaboration > Policies & rules > Threat policies. Safe Links, Safe Attachments, and some impersonation features depend on Defender licensing; absence of a paid feature is not a reason to leave included controls unused.
2. For Microsoft 365, compare applicable policies with the linked Standard preset guidance and pilot an appropriate recipient group before expanding. Inspect precedence so you know which policy actually applies. For other providers, use their included protection settings and current admin guidance; product labels and entitlements differ.
3. Review broad allow lists, transport-rule bypasses, and third-party gateways that may undermine filtering. Remove unnecessary exceptions in a controlled pilot after confirming dependencies. Do not allow an entire domain simply because one message was incorrectly quarantined; investigate and use the narrowest supported correction.
4. Assign quarantine review and alert handling to named people with backup coverage. Explain how staff report suspicious messages without interacting with links or attachments, and how to request release of legitimate mail. Verify sender context before releasing quarantined content; record decisions and recurring false positives.
5. Verify: use benign mail to confirm normal delivery and the user-reporting route. Use only a provider-documented harmless test procedure, with approval and designated test recipients, to check filtering/quarantine behavior. Do not send real malware, collect passwords, or conduct surprise phishing simulations. A delivered ordinary email does not prove threat detection works.
6. Record effective policy scope, test outcomes, reviewer, and limitations. If rollout disrupts mail, roll back the scoped change with approval and investigate rather than disabling protection globally. Recheck after license, gateway, or policy changes; even correctly configured filtering cannot catch every malicious message.