Standard Default Anti Phishing Policy
The Standard Default Anti-Phishing Policy provides protection for all Exchange mailboxes, helping to detect and block phishing attempts and spoofed messages. This policy leverages Microsoft anti-spoof intelligence and machine learning to identify suspicious senders and protect users from credential theft and impersonation attacks.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | The Identity parameter specifies the anti-phish policy that you want to modify. Learn more |
| First contact safety tip enabled | Enables or disables first contact safety tip in email messages. Learn more |
| Authentication failure action | Action to take when authentication fails (e.g., MoveToJmf, Quarantine). Learn more |
| Spoof quarantine policy | Quarantine policy to apply for spoof detections. Learn more |
| Spoof intelligence enabled | Enables or disables antispoofing protection. Learn more |
| Via tag enabled | Enables or disables unauthenticated sender indicators in Outlook. Learn more |
| Unauthenticated sender icon enabled | Controls whether to show the unauthenticated sender (?) indicator in Outlook. Learn more |
Configure it
Add this baseline to the tenant to turn on Exchange Online’s anti-phishing protection for every mailbox, or bundle it into a scheme you deploy to many tenants at once.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn on spoof intelligence.
Set Spoof intelligence enabled on so Microsoft’s own detection catches a sender faking your domain or a trusted one, and set Authentication failure action to
Quarantinefor anything that fails. -
Set the spoof quarantine policy.
Set Spoof quarantine policy to
AdminOnlyAccessPolicy, so only an admin can release a message caught by spoof detection, not the recipient. -
Turn on the visual warnings.
Turn on First contact safety tip enabled, Via tag enabled and Unauthenticated sender icon enabled. Together they add a warning the first time someone emails a recipient, a “via” note and a ”?” icon on the sender’s photo, giving users a visible cue on a message that looks legitimate but isn’t fully authenticated.
-
Save.
Turn on Auto-remediation (Remediation) if you want Octiga to reapply these settings whenever the Default policy changes. The safety tip, via tag and ”?” icon appear for users when this baseline is applied, and disappear if it’s removed.
Check it worked
Passing means the Default anti-phishing policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Anti-phishing. End users notice the safety tip, via tag and unauthenticated-sender icon on suspicious messages in Outlook; a spoofed message is quarantined instead of delivered.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.