Email and Collaboration

Note: These controls are configured in Exchange Online, the Microsoft Defender portal and your DNS. SenseOn is not a mail gateway and does not filter email. It detects what happens after a message lands, and it ingests M365 telemetry through Data Connectors, but the controls on this page prevent the delivery that SenseOn would otherwise have to detect.

Email remains the most common delivery mechanism in the cases SenseOn escalates, and mailbox compromise remains the most common follow-on. The two halves of this page reflect that: stop the message arriving, and make the mailbox less useful once an account is taken.

This page assumes Exchange Online. Where a control requires Microsoft Defender for Office 365 Plan 1 or Plan 2, that is called out. Portal navigation changes frequently, so verify against the linked source.

Authenticate your mail

SPF, DKIM and DMARC together let receiving systems distinguish your mail from mail claiming to be yours. Without them, spoofing your own domain at your own users is trivial, and it works.

Record	What it does	Recommended position
SPF	Lists the systems authorised to send for the domain.	A single TXT record ending `-all` (hard fail). `~all` (soft fail) is a staging position, not a destination. Watch the ten DNS lookup limit, which is easy to exceed once several SaaS senders are included.
DKIM	Cryptographically signs outbound mail so it survives forwarding.	Enable for every accepted domain, not just the primary. It is off by default for custom domains in Exchange Online, and the default `onmicrosoft.com` signing does not cover them. Rotate keys.
DMARC	Tells receivers what to do when SPF and DKIM fail, and gives you reporting.	Progress `p=none` to `p=quarantine` to `p=reject`. Publish `rua` from day one, even at `p=none`, because the reports are how you find your own legitimate senders before you start rejecting them.

Do not skip to p=reject. Every organisation has forgotten senders: the payroll system, the marketing platform, a scanner in a branch office. Run at p=none with reporting for long enough to enumerate them all, typically one to two months. Rejecting your own invoices is an outage.

Also configure DMARC handling for inbound mail. In the Defender portal's anti-phishing policy, set the actions for messages that fail sender DMARC to honour the sending domain's policy rather than overriding it.

Turn on Defender for Office 365 properly

The fastest route to a defensible configuration is preset security policies in the Microsoft Defender portal, under Email & collaboration > Policies & rules > Threat policies > Preset security policies. Microsoft maintains Standard and Strict presets and updates them as the threat picture changes, which is generally better than a hand-built policy set that ages.

Apply Standard to all users as a baseline and Strict to your higher-risk population: executives, finance, HR, IT administrators, and anyone with payment authority. Preset policies always take precedence over custom policies, so use presets unless you have a specific reason not to.

The components worth understanding individually:

Feature	Plan	What it does and what to watch
Safe Links	Defender for Office 365 P1	Rewrites and detonates URLs at click time, which catches links weaponised after delivery. Enable for email, Teams, and Office applications. Do not disable the "track user clicks" option, since the click telemetry is what makes post-delivery investigation possible.
Safe Attachments	Defender for Office 365 P1	Detonates attachments in a sandbox. Use Dynamic Delivery so the body arrives immediately and the attachment follows, which avoids the delay users complain about. Enable for SharePoint, OneDrive and Teams as well as mail.
Anti-phishing with impersonation protection	Defender for Office 365 P1	Protects named users and domains against lookalike display names and domains. Add your executives and your own domains, and add key partner and supplier domains. This is the control that addresses business email compromise.
Mailbox intelligence	Defender for Office 365 P1	Builds a sender graph per mailbox and flags anomalies. Enable impersonation protection based on it.
Anti-spoofing	Exchange Online Protection	On by default. Do not disable it. Use the spoof intelligence insight to allow the legitimate third parties that spoof you, rather than turning the control off.
Zero-hour Auto Purge	Exchange Online Protection	Retroactively removes delivered messages later found malicious. Confirm it is enabled for both malware and phishing.
Attack simulation training	Defender for Office 365 P2	Phishing simulation and targeted training. Measure it as a reporting rate, not as a click rate.

Configuration analyzer under Threat policies compares your live settings against the Standard and Strict baselines and lists every deviation. Run it after any change. It is the quickest way to find the policy someone loosened two years ago for a reason nobody remembers.

Block dangerous attachments

In the anti-malware policy, enable the common attachments filter. Extend the default list to cover the executable and script types you have no business receiving: .exe, .scr, .js, .vbs, .hta, .iso, .img, .lnk, .chm, .ps1, .jar, and the macro-enabled Office formats where the business does not require them.

Container formats deserve particular attention. ISO, IMG and VHD were widely adopted specifically because they historically did not propagate Mark of the Web to their contents, defeating the endpoint macro controls described in Windows Endpoints. Unless you have a genuine need, block them at the gateway.

Where a business process genuinely requires a blocked type, move it off email onto a SharePoint or OneDrive location rather than adding an exception.

External sender identification

Enable external sender identification so mail from outside the organisation is visibly tagged, and enable first contact safety tips so users see a warning the first time a sender writes to them. Both are low cost and directly support the judgement you are asking users to exercise.

Stop automatic external forwarding

This is the step that turns a mailbox compromise into a sustained data breach, and it is the single most valuable control in this section.

After taking a mailbox, the standard next action is to create a rule that forwards mail externally, or that moves messages matching keywords such as "invoice" or "payment" to a folder the user does not read. The account holder notices nothing. The attacker reads everything, indefinitely, and retains visibility even after the password is reset.

Block automatic external forwarding in the outbound spam filter policy. The default in Exchange Online is Automatic, which blocks it. Confirm it has not been set to On, and confirm no exception policy exists for a subset of users.
Audit existing forwarding. Check both mailbox forwarding configuration (ForwardingSmtpAddress and ForwardingAddress) and inbox rules, since they are configured separately and an audit of one misses the other.
Where forwarding is a genuine requirement, scope an exception policy to the specific mailboxes and review it periodically, rather than loosening the tenant default.
Alert on new forwarding rules. Microsoft ships built-in alert policies for suspicious forwarding. Confirm they are enabled and that someone receives them. SenseOn will surface the same activity from the M365 audit telemetry once connected.

See the M365 Compromised Account playbook for how SenseOn handles this once it happens.

Retire legacy protocols

The Exchange Online counterpart to blocking legacy authentication in Entra. Do both: the Conditional Access policy and the Exchange configuration cover overlapping but not identical ground.

Disable POP and IMAP per mailbox where they are not required, and set the organisation default so new mailboxes do not inherit them.
Disable SMTP AUTH at the organisation level, then re-enable it only on the specific mailboxes that genuinely need it, typically application and device senders. Better still, move those senders to Microsoft Graph or to a dedicated relay connector.
Audit what is still using them from the sign-in logs before you disable anything. Multifunction printers and scan-to-email are the usual dependency.
Check Exchange Web Services usage and plan its retirement, since Microsoft is progressively retiring it in favour of Graph.

Auditing and visibility

Confirm mailbox auditing is on. It is enabled by default at the tenant level, but verify it has not been disabled and that the mailbox actions you need are in the audited set. MailItemsAccessed is the action that tells you what an attacker actually read, and it is the difference between reporting a compromise and reporting a breach of specific records.
Check your audit log retention. The default retention is shorter than the time most compromises take to discover. If your licensing offers longer retention, configure it, and consider Long Term Telemetry Retention for the SenseOn-side equivalent.
Connect M365 telemetry to SenseOn through Data Connectors, so mailbox and sign-in activity is correlated with endpoint and network telemetry rather than sitting in a portal nobody opens.

Give users somewhere to report

A user who spots a phishing email and has no easy way to report it will simply delete it, and you lose the chance to purge the same message from the other forty mailboxes that received it.

Deploy the Report Message or Report Phishing capability in Outlook, and configure user reported settings to route submissions where your team will see them.
Set a reporting mailbox and confirm somebody owns it.
Measure the reporting rate, not the click rate. A high reporting rate is the outcome you want from awareness training. Click rate mostly measures how convincing your simulation was.
Close the loop. Tell reporters what happened. It is the only thing that sustains the behaviour.

Mail is not the only delivery route, and increasingly not the most common one, precisely because mail is now well defended.

Set SharePoint and OneDrive external sharing to the most restrictive level the business can work with. "Anyone" links are unauthenticated and forwardable.
Set an expiry on anonymous links and default them to view-only.
Restrict Teams external access and guest access to the domains you actually federate with, rather than the whole world.
Apply Safe Attachments and Safe Links to Teams, SharePoint and OneDrive, not just to email. Both are separate settings from the email equivalents.

Go live checklist

[ ] SPF published, ending -all, within the ten lookup limit
[ ] DKIM enabled and signing for every accepted domain
[ ] DMARC published with rua reporting, and a documented plan to reach p=reject
[ ] Inbound DMARC honoured in the anti-phishing policy
[ ] Standard preset security policy applied to all users
[ ] Strict preset applied to executives, finance, HR and administrators
[ ] Safe Links and Safe Attachments enabled for mail, Teams, SharePoint and OneDrive
[ ] Impersonation protection configured with named users, own domains and key partner domains
[ ] Common attachments filter enabled and extended, including container formats
[ ] External sender identification and first contact safety tips enabled
[ ] Automatic external forwarding blocked, existing forwarding rules audited
[ ] Alerting on new forwarding rules confirmed and owned
[ ] POP, IMAP and SMTP AUTH disabled except where explicitly required and documented
[ ] Mailbox auditing verified, including MailItemsAccessed
[ ] User reporting deployed with an owned reporting mailbox
[ ] External sharing and anonymous link expiry configured
[ ] Configuration analyzer run with no unexplained deviations
[ ] M365 telemetry flowing into SenseOn

Identity and Access (Microsoft Entra ID) for the authentication controls that protect the mailbox.
Windows Endpoints for what happens if an attachment does get through.
Phishing playbook and M365 Compromised Account playbook.
Data Connectors for connecting M365 telemetry to SenseOn.
Dark Web Monitoring for credential exposure that precedes mailbox compromise.

Sources

All URLs verified on 19 August 2026.