What this check looks at
Checks for an anti-phishing policy applying to everyone with the settings CIS lists: threshold 3 or more, user and own-domain impersonation protection, mailbox intelligence, spoof intelligence, quarantine actions, safety tips and honouring DMARC.
Every tenant has a default anti-phishing policy (Office365 AntiPhish Default) that applies to everyone. With Defender for Office 365 it gains impersonation protection, which compares senders with the people and domains you list and flags lookalikes (a new Gmail address using the managing director’s name, or a domain one letter off your own), and mailbox intelligence, which learns who each person normally corresponds with. Out of the box nobody is protected against impersonation, the phishing threshold is at its lowest and impersonation detections have no action set.
The check looks at anti-phishing policies other than the preset ones, and passes when one that is on and applies to everyone has every setting CIS 2.1.7 lists: phishing threshold 3 or higher; user impersonation protection with at least one user; protection of the organisation’s own domains; mailbox intelligence and its impersonation protection; spoof intelligence; quarantine for impersonated users, impersonated domains and mailbox intelligence detections; the first contact, similar users, similar domains and unusual characters safety tips; and honouring the sender’s DMARC policy. It fails otherwise, naming what the closest policy misses, and is not applicable without Defender for Office 365.
Business email compromise rarely uses malware or links. It is a plain message that seems to come from someone the recipient trusts, asking for a payment, gift cards or a change of bank details. Spam filtering cannot tell that from genuine mail; impersonation protection can, because it knows who the directors are and what the company’s domains look like.
Why it matters
Most invoice fraud impersonates a director or a supplier. Impersonation protection compares senders to the people and domains that matter and quarantines lookalikes before anyone acts on them.
A finance assistant at a 40-person firm receives an email from Sarah Clarke, Managing Director, at a new Outlook.com address: she is in a meeting, a supplier needs paying today, here are the details. The display name matches, the tone is right, and £18,500 leaves the account. With Sarah listed as a protected user the message would have been quarantined as user impersonation, and the first contact safety tip would have flagged an address the assistant had never heard from.
UK Finance reports hundreds of millions of pounds lost to authorised push payment fraud every year, with invoice and CEO fraud prominent among business losses, and the reimbursement rules introduced in 2024 protect consumers and micro-enterprises rather than most businesses. For a small firm, a single payment can wipe out a year’s profit.
CIS Microsoft 365 Foundations Benchmark 2.1.7 asks for an anti-phishing policy with these settings. NIST CSF 2.0 PR.PS-01, ISO 27001 A.8.7 and A.5.14, CIS Controls v8 9.7 and NCSC CAF B4.b cover configuring email protection to a recommended standard.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-phishing
Before you start
- Needs Defender for Office 365 for impersonation and mailbox intelligence.
- List the people to protect against impersonation (directors, finance, HR): up to 350 users.
- Raising the threshold quarantines more messages; tell whoever reviews quarantine.
Step by step
- List who and what to protect. Agree with the client the people most likely to be impersonated (directors, finance, HR and anyone who approves payments), up to 350, with their display names and addresses, and confirm the organisation’s accepted domains. Tell whoever reviews quarantine that more messages will be held.
- Open the default anti-phishing policy. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-phishing and select Office365 AntiPhish Default (Default). It applies to everyone; a custom policy works too if it applies to every accepted domain with no user or group conditions.
- Set the threshold and impersonation protection. In the Phishing threshold & protection section select Edit protection settings. Set the phishing email threshold to 3 - More aggressive. Tick Enable users to protect and add the people from the first step. Tick Enable domains to protect and Include domains I own. Tick Enable mailbox intelligence, Enable intelligence for impersonation protection and Enable spoof intelligence, then select Save.
- Set the actions and safety tips. In the Actions section select Edit actions. Set the actions for user impersonation, domain impersonation and mailbox intelligence impersonation to Quarantine the message. Tick the option to honour the DMARC record policy when a message is detected as spoof. Under Safety tips & indicators tick the first contact, user impersonation, domain impersonation and unusual characters safety tips, then select Save.
- Or set it in Exchange Online PowerShell. Run Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" -PhishThresholdLevel 3 -EnableTargetedUserProtection $true -TargetedUsersToProtect "Sarah Clarke;sarah.clarke@contoso.com" -EnableOrganizationDomainsProtection $true -EnableMailboxIntelligence $true -EnableMailboxIntelligenceProtection $true -EnableSpoofIntelligence $true -TargetedUserProtectionAction Quarantine -TargetedDomainProtectionAction Quarantine -MailboxIntelligenceProtectionAction Quarantine -EnableFirstContactSafetyTips $true -EnableSimilarUsersSafetyTips $true -EnableSimilarDomainsSafetyTips $true -EnableUnusualCharactersSafetyTips $true -HonorDmarcPolicy $true, listing each protected person as "Display name;address".
- Handle false positives without weakening the policy. For the first couple of weeks, check Email & collaboration > Review > Quarantine for genuine senders caught as impersonation (a supplier with a similar name, a director’s personal address). Add them to the policy’s trusted senders and domains rather than lowering the threshold or the actions.
- Confirm the settings. Run Get-AntiPhishPolicy -Identity "Office365 AntiPhish Default" | Format-List PhishThresholdLevel, EnableTargetedUserProtection, TargetedUsersToProtect, EnableOrganizationDomainsProtection, EnableMailboxIntelligence*, EnableSpoofIntelligence, *ProtectionAction, *SafetyTips, HonorDmarcPolicy and compare it with the list in the finding. The next assessment passes.
What users will notice
Messages pretending to be the protected people or the organisation’s domains are quarantined, and safety tips appear on unusual senders.
How to confirm it worked
Get-AntiPhishPolicy shows the policy with PhishThresholdLevel 3 or more, user and domain impersonation on, and Quarantine as the impersonation actions.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(g) Basic cyber hygiene practices and training |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malwareA.5.14 Information transfer |
| CIS M365 | 2.1.7 Ensure that an anti-phishing policy has been created |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure anti-phishing policies in Defender for Office 365 (Microsoft Learn)