What this check looks at
Checks the Defender for Office 365 protections Microsoft Secure Score tracks, such as Safe Links, Safe Attachments, anti-phishing with impersonation protection and zero-hour auto purge, using Secure Score’s own assessment of each.
Microsoft Defender for Office 365 (Plan 1 in Business Premium and on its own, Plan 2 in Microsoft 365 E5) adds Safe Links, Safe Attachments, impersonation protection, mailbox intelligence and zero-hour auto purge for Teams on top of Exchange Online Protection. Holding the licence does not switch most of it on. Apart from the Built-in protection policy, which gives only basic Safe Links and Safe Attachments, each protection needs a policy that applies it to people, with settings strong enough to matter.
This check reads Microsoft Secure Score’s own assessment of each Defender for Office 365 control (those whose names start mdo_), counting a control as in place when Secure Score awards all of its points or when the setting read directly from Exchange Online is on. It passes when every control is in place, warns when at least 75% are, and fails below that. It is not applicable when the licences were read and include no Defender for Office 365 plan.
The gaps attackers use are specific: a Safe Links policy that lets people click through the warning or leaves out Teams and Office documents, Safe Attachments set to monitor rather than block, or anti-phishing with nobody protected against impersonation. A link that is clean on delivery and malicious an hour later, or an email from a lookalike of the managing director’s address, gets past any one of those gaps.
Why it matters
Phishing and malicious attachments are still how most breaches start. A tenant can pay for Defender for Office 365 and still leave its strongest protections switched off; Safe Links and Safe Attachments only work once policies apply them to users.
Credential phishing and malicious attachments remain the commonest way into a small business. A typical case: an email apparently from the company’s own director, linking to a shared invoice on a legitimate file-sharing site that later redirects to a fake Microsoft sign-in page. Without Safe Links checking at the moment of the click and impersonation protection flagging the lookalike sender, the accounts assistant signs in, the attacker takes the session, and the mailbox is being used for invoice fraud within days.
The client is already paying for these protections in Business Premium or E5. Leaving them unconfigured means paying for licences that do nothing, and learning after an incident that the control which would have caught it was a few clicks away. A single business email compromise in a small firm, counting the lost payment, forensic work and customer notification, regularly costs tens of thousands of pounds.
Email malware and phishing protection runs through every framework this check maps to: the CIS Microsoft 365 Foundations Benchmark covers Safe Links (2.1.1), Safe Attachments (2.1.4) and anti-phishing (2.1.7); ISO 27001 A.8.7 (protection against malware) and A.8.23 (web filtering), CIS Controls v8 9.7 and the Essential Eight email filtering control ask for it; and the Cyber Essentials Plus malware protection test checks what happens when test files arrive by email.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies
Before you start
- Check the licence (Defender for Office 365 Plan 1 is in Business Premium).
- Start with the Standard preset; Strict quarantines more and suits high-risk users.
Step by step
- Confirm the licence covers everyone. In the Microsoft 365 admin centre, go to Billing > Licences and check the client holds Microsoft 365 Business Premium, Microsoft 365 E5 or E5 Security, or Defender for Office 365 Plan 1 or Plan 2. Microsoft’s licensing terms expect every user who benefits from the protection to be licensed, so note any mailboxes on Business Standard or Exchange Online plans alone.
- Review the existing threat policies. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies. Open Anti-phishing, Safe Links and Safe Attachments and note each custom policy and who it applies to. Preset security policies take priority over custom policies for the people they cover, so note any deliberate exception (an allowed partner, a mailbox excluded from scanning) before applying a preset.
- Apply the Standard preset to everyone. Under Templated policies select Preset security policies, then under Standard protection select Manage protection settings. Apply Exchange Online Protection to All recipients and, on the next page, Defender for Office 365 protection to All recipients. On the impersonation pages add the directors, finance staff and other senior people (up to 350) and the key partner domains. Choose Turn on the policy when finished and select Confirm.
- Apply the Strict preset to the most targeted people. Under Strict protection select Manage protection settings and apply both Exchange Online Protection and Defender for Office 365 protection to Specific recipients: the priority accounts (directors, finance, HR, IT administrators). Add the same impersonation entries and turn it on. Strict quarantines more, so tell those people and whoever reviews quarantine.
- Turn on Safe Attachments for SharePoint, OneDrive and Teams. Go to Threat policies > Safe Attachments > Global settings and turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams. Where the licence includes Safe Documents (Microsoft 365 E5 or E5 Security), turn that on too, leave click-through through Protected View off, and select Save.
- Close the remaining actions in Secure Score. Open Exposure management > Secure Score > Recommended actions and filter by the product Defender for Office 365. Compare the open actions with this finding’s evidence, then open each and follow its Implementation tab (for example zero-hour auto purge for Teams, priority account protection or the outbound spam notifications). Most also have a finding of their own in this assessment with full steps.
- Confirm the protections apply. On Preset security policies, Standard protection should show as on for all recipients. In Exchange Online PowerShell, Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule should show the Standard Preset Security Policy rules as Enabled. Secure Score updates once a day, so check the evidence again after 24 to 48 hours; the check passes when every Defender for Office 365 control is in place.
What users will notice
More phishing and malware is quarantined; users may see Safe Links wrapping and occasional quarantine notifications.
How to confirm it worked
Microsoft Defender, Email and collaboration, Policies, Preset security policies: Standard protection is on for all recipients.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Zero Trust | Applications |
| Secure Score | Safe LinksSafe AttachmentsAnti-phishing policies |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks5.2.1 An anti-malware solution is deployed on all system components |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malwareA.8.23 Web filtering |
| CIS M365 | 2.1.1 Ensure Safe Links for Office Applications is enabled2.1.4 Ensure Safe Attachments policy is enabled2.1.7 Ensure that an anti-phishing policy has been created |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Architecture and configurationIncident management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Preset security policies (Microsoft Learn)