Visit Website →
← Back to blog

5 Priority Controls for Microsoft 365 Email Security for IT Leaders

October 4, 2026
5 Priority Controls for Microsoft 365 Email Security for IT Leaders

Enable phishing-resistant multi-factor authentication, turn on Defender's preset Standard or Strict policies, enforce SPF, DKIM, and DMARC, and centralize monitoring and alerts. These four moves close most of the gap between the protection Microsoft 365 ships with and what CISA guidance and Microsoft Defender documentation recommend for production tenants. This guide is built around the same prioritization: controls first, tools second.

TL;DR:

  • Enforcing phishing-resistant multi-factor authentication and deploying SPF, DKIM, and DMARC can significantly reduce the risk of successful phishing attacks.
  • Turning on Defender's preset security policies and monitoring Secure Score weekly helps maintain proper configuration and detect drift early.
  • Upgrading from basic EOP protections, Plan 2 of Defender for Office 365 adds automated investigation, threat hunting, and attack simulation, mainly benefiting security teams.
  • Automatic alerts for suspicious login behaviors and external forwarding rules are critical monitoring points to identify potential compromises early.
  • Implementing a phased, hands-on approach to MFA, email authentication, and ongoing incident response is essential for effective tenant hardening.
Securetechie
Strengthen Your Microsoft 365 Security
Secure Techies provides proactive IT management and enterprise-grade cybersecurity for small and mid-size businesses in Southern California.
Explore Secure Techies

Table of Contents

What Microsoft 365 Protects by Default

Every Microsoft 365 cloud mailbox ships with Exchange Online Protection (EOP) active and cannot be turned off. EOP runs anti-malware, anti-spam, and anti-phishing checks against all inbound and outbound mail before it reaches a user's inbox, and these default threat policies apply to every recipient in the tenant automatically.

What EOP does once mail is flagged matters as much as the detection itself:

  • Zero-hour auto purge (ZAP) retroactively removes messages already delivered when Microsoft later identifies them as malicious.
  • Quarantine holds suspect messages, with release rights split between admins and, for lower-confidence detections, end users.
  • Message trace lets administrators follow a message's path through the service to diagnose delivery or filtering issues.
  • Submissions lets security teams report false positives and false negatives directly to Microsoft for reclassification.

These baseline protections catch a large share of commodity spam and known malware signatures, but they are tuned for broad coverage rather than targeted detection. They won't flag a convincing business email compromise attempt that uses no malware and no known bad links, and they offer limited investigation tooling when something does get through. That gap is exactly what Defender for Office 365 and Secure Score are built to close, and Secure Score itself is worth checking early: it gives a baseline reading of how your tenant's current configuration compares to Microsoft's recommended settings before you start layering on additional controls.

Microsoft Defender for Office 365: Plan 1 vs Plan 2

Defender for Office 365 sits on top of EOP and is licensed in two tiers. Microsoft's service description draws a clear line between what each plan covers.

  • Plan 1 adds Safe Links (rewrites and scans URLs at click time), Safe Attachments (detonates files in a sandbox before delivery), and enhanced anti-phishing beyond EOP's baseline.
  • Plan 2 adds automated investigation and response, threat hunting, attack simulation training, and integration with Microsoft's broader extended detection and response (XDR) stack.
  • Plan 2 capabilities are included in Microsoft 365 E5, A5, and G5 subscriptions; organizations on lower tiers can add Defender for Office 365 Plan 1 or Plan 2 as standalone add-ons.
  • Licensing is counted per user mailbox, so Safe Links and Safe Attachments protections only apply to mailboxes actually licensed for the plan, a detail that matters during partial rollouts or mergers.

Security operations teams with their own analysts get the most from Plan 2: the automated investigation playbooks and hunting queries cut the manual triage time that Plan 1 alone still requires. Organizations without a dedicated SOC often get adequate protection from Plan 1 paired with a managed monitoring service, since the detection quality is similar and the gap is mainly in response speed and depth.

Closing the Gaps Native Tools Leave Open

Defender and EOP reduce volume, but several controls outside the mail filter itself determine whether an attacker who gets a foothold can do damage. Address these in order:

  1. Enforce phishing-resistant MFA. CISA recommends FIDO2 keys, certificate-based authentication, or Windows Hello for Business for every user; if that rollout takes time, Microsoft Authenticator with contextual, number-matching login is an acceptable interim step, while SMS and voice one-time codes are discouraged.
  2. Publish SPF, enable DKIM, and deploy DMARC. CISA's SCuBA baseline recommends moving DMARC from p=none to quarantine to reject as reporting confirms legitimate senders are passing. Our DMARC setup guide and free SPF and DMARC record generator walk through the DNS changes step by step, and a practical six to eight week rollout timeline is a useful planning reference.
  3. Turn on data loss prevention. DLP policies in the compliance portal can block or encrypt outbound mail containing Social Security numbers, card data, or other sensitive identifiers before they leave the tenant.
  4. Layer in Conditional Access and Identity Protection. Blocking sign-ins from risky locations or impossible travel patterns requires Azure AD Premium P2, a licensing detail worth confirming early in planning.
  5. Avoid IP and tenant allowlists. Defender's secure-by-default posture intentionally ignores some transport rule overrides and allowlists for high-confidence detections, so broad allowlisting creates risk without the benefit it seems to promise.

Pro Tip: Review Conditional Access policies quarterly. Microsoft now auto-deploys some tenant-level managed policies, and configuration drift from untracked changes is one of the most common causes of a weakened security posture.

Tuning, Monitoring, and Responding to What Gets Through

Start with Microsoft's preset security policies rather than building custom rules from scratch. Standard and Strict profiles preconfigure anti-phishing, anti-spam, and impersonation thresholds, and Microsoft maintains them, which removes the configuration drift that plagues hand-built policies. Move to custom policies only when a documented business need, like a high false-positive rate for a specific department, justifies the added maintenance.

Preset and custom email policy paths

One figure worth tracking from day one: Secure Score gives each tenant a baseline configuration score against Microsoft's recommendations, and reviewing it monthly surfaces drift before it becomes an incident.

Operational monitoring should cover:

  • Suspicious sending patterns and unusual connector activity, both called out in CISA's Exchange Online baseline as high-priority alerts.
  • Automatic forwarding rules to external domains, which the same baseline recommends disabling outright.
  • MailItemsAccessed entries in Purview audit logs, which help investigators confirm whether a compromised account actually exported mail. Its absence doesn't guarantee nothing was read, since some access patterns aren't logged by default.
  • False positives surfaced through Threat Explorer and message trace, which should feed back into policy tuning rather than get dismissed one by one.

When something slips past the filters, ZAP typically removes it from inboxes automatically; the remaining work is confirming scope through audit logs and closing the loop with a quarantine review.

How Secure Techies Approaches Microsoft 365 Email Security

The same prioritized sequence is recommended for clients: phishing-resistant MFA rollout, Defender for Office 365 configuration, SPF, DKIM, and DMARC deployment, and ongoing monitoring with incident response.

  • Tenant assessment against Secure Score and the CISA Exchange Online baseline.
  • Phased MFA and Conditional Access rollout with documented fallbacks.
  • Preset Defender policy deployment, tuned over the following 30 to 60 days.
  • Ongoing alert monitoring, quarantine review, and incident response support.

Typically, clients see fewer successful phishing attempts reach end users, a measurable Secure Score improvement, and faster mean time to resolution when an incident does occur, since monitoring and response are already staffed rather than assembled after the fact.

Why Prioritized Controls Beat Chasing Tools

AI-generated phishing is getting harder to distinguish from legitimate mail, which makes the basics more urgent, not less. Organizations that chase new point products while skipping phishing-resistant MFA are solving the wrong problem. This quarter, prioritize MFA enforcement and DMARC progress toward p=reject, and track one number: Secure Score or the count of reported phishing incidents month over month.

— Alex

Get Your Microsoft 365 Tenant Hardened by a Local Team

Reading the checklist is one thing; rolling out MFA across every department, tuning Defender policies without breaking legitimate mail flow, and staffing the monitoring that catches what slips through is another.

Securetechie

  • Tenant assessment to find the highest-impact gaps first.
  • Hands-on rollout of MFA, email authentication, and Defender preset policies.
  • 24/7 monitoring and incident response once the hardening is in place.

Our Microsoft 365 security checklist covers the full tenant hardening sequence in more depth, and our Microsoft 365 MFA rollout case study shows how the phased approach plays out in practice. If you'd rather have a team execute this directly, start with our managed IT services page to see how an assessment works and request a quote.

FAQ

Is Microsoft Account Security Email Real?

Microsoft does send legitimate account security emails, typically about new sign-ins, password changes, or unusual activity. These emails never ask you to reply with a password or payment details, so treat any message that does as phishing regardless of how convincing the sender name looks.

Will I Lose My Emails if I Cancel Microsoft 365?

Microsoft retains mailbox data for a limited grace period after a subscription is canceled, after which it is permanently deleted according to Microsoft's own retention policies. Export or back up mailbox content before canceling rather than relying on that grace window.

Which Email Security Service Is Best for Microsoft 365?

The strongest setup pairs Microsoft Defender for Office 365 with phishing-resistant MFA, enforced SPF, DKIM, and DMARC, and active monitoring rather than relying on any single add-on product. For organizations without in-house security staff, a managed provider like Secure Techies can implement and monitor that stack directly.

Is Microsoft Email Safer Than Gmail?

Both platforms run substantial built-in filtering, and neither is inherently safer without proper configuration. The real difference comes down to how an organization configures MFA, email authentication, and monitoring on top of whichever platform it runs.

Sources