Microsoft 365 Phishing Protection Settings Every Admin Should Turn On UK 2026
Take the free IT Readiness Test and see where you stand, 10 quick questions.
The problem: your M365 tenant is under-protected out of the box
When you first set up Microsoft 365, the default configuration protects your organisation against obvious threats. Malware, certain types of spam, basic impersonation attacks. But it does not stop sophisticated phishing campaigns that impersonate your own staff, suppliers, or executives.
According to the 2025 Cyber Security Breaches Survey, 82% of UK organisations reported phishing attacks in the past year. Most of those breaches started with a single compromised email account. And in nearly every case, the organisation had access to the M365 settings that would have stopped it. They just weren't turned on.
As an M365 administrator, you are responsible for hardening your tenant's email security posture. This is not optional compliance work. It is the difference between "we had an incident" and "we stopped it before it landed".
The good news: turning on these eight protections takes roughly 45 minutes. They are built into your M365 subscription already. No additional cost, no third-party tools required.
1. Enable Advanced Phishing and Malware Protection (ATP)
This is the foundation. Defender for Office 365 Plan 1 includes Advanced Threat Protection, which scans every email attachment and URL in real time.
Most organisations assume this is on by default. It is not. You need to create a default policy inside the Security & Compliance Centre.
In Microsoft Defender for Office 365:
This single step stops roughly 60% of targeted phishing emails before they reach user inboxes.
2. Turn on External Email Warnings
If an email arrives from outside your organisation, users should see a clear visual indicator. A banner at the top of the message: "This email came from outside your organisation."
This is remarkably effective. It breaks the illusion that the email is internal. A compromised external account posing as your finance director suddenly looks suspicious.
Enable this under Exchange Admin Centre > Mail Flow > Message Rules, or configure it in Defender using the "External email warning" policy setting.
It costs nothing and reduces the success rate of domain spoofing attacks by roughly 40%.
3. Disable Mail Forwarding Rules (or at least audit them)
One of the most overlooked attack vectors: a compromised user account with a mail forwarding rule.
Attackers compromise a single account. They create a rule that silently forwards all emails to an external address. The user never knows. Sensitive emails are being harvested in real time.
Disable the ability to create forwarding rules altogether, or at minimum audit all existing rules quarterly.
In Exchange Online PowerShell:
```
Set-TransportRule -ExternalOrgForwardingEnabled $false
```
Or if you want to keep the feature but log activity, configure a DLP policy to alert you whenever an external forwarding rule is created.
4. Enable Mail Flow Rules to Block Suspicious Patterns
Set up a transport rule that blocks emails containing common phishing red flags:
These rules catch the low-hanging fruit. Attackers often use the same templates across multiple targets.
Navigate to Exchange Admin Centre > Mail Flow > Rules and create rules for:
5. Enforce Authenticated Connections with SPF, DKIM, and DMARC
These three protocols authenticate your outbound email. They tell receiving mail servers: "Yes, this email really came from us."
Without them, anyone can send an email that appears to come from your domain.
Configure all three in your DNS records:
This prevents attackers from spoofing your domain when they send phishing emails to your own users or external contacts.
Enable DMARC with a "reject" policy (not "quarantine" or "none"). This tells external systems to reject emails that fail your authentication checks.
6. Configure User Impersonation Protection
In Defender for Office 365, enable the "User impersonation protection" feature. This uses machine learning to detect when an email appears to come from a trusted contact but is actually spoofed.
You can specify which internal users are high-priority targets (CEO, CFO, HR directors) and flag suspicious emails before they reach those users' inboxes.
Configure under Threat Policies > Anti-phishing > User impersonation settings.
Phishing campaigns often target executives because finance and HR staff are trained to obey their requests without verification.
7. Enable the Report Message Add-in
Users are your last line of defence. But they need a frictionless way to report suspicious emails.
Deploy the Report Message add-in (available free for all M365 tenants) across your organisation. It puts a single "Report" button in Outlook.
When a user clicks it, the email is:
This creates a feedback loop. Users who report phishing get it out of their inbox and help train your defences at the same time.
8. Set Up Alert Policies for Admin Account Compromise
Create an alert that triggers immediately if a user grants mailbox permissions to an external account, or if a forwarding rule is created.
In the Security & Compliance Centre, navigate to Alerts > Alert Policies and create rules for:
These alerts notify your security team within minutes, not days.
Why this matters for your role as an admin
Phishing protection is not fire-and-forget. It is a baseline. Attackers evolve. New threat vectors emerge monthly.
But these eight settings stop the majority of commodity phishing attacks. They stop most targeted campaigns aimed at your organisation.
If you are new to M365 administration and feel uncertain about implementing these settings, or if you want to understand the broader security landscape, the free 2-hour live M365 admin session at SmoothOps 365 walks through real-world tenant hardening, including phishing protection, from first principles. You will see how these settings fit into a complete security posture, and you can ask questions in real time.
Alternatively, if you are already managing M365 but want to formalise your knowledge and certification, the Microsoft 365 Administrator Course covers this and every other critical admin skill across 12 weeks.
Frequently asked questions
How do I know if my M365 tenant already has phishing protection turned on?
Go to the Microsoft Defender portal > Email and Collaboration > Policies and Rules > Threat Policies > Anti-phishing. If you see a default policy listed, it is on. If not, you need to create one. Many tenants have no default policy at all, which means only the most basic Microsoft-level filtering is active.
Will turning on strict phishing protection block legitimate emails?
It can. SPF, DKIM, and DMARC misconfigurations sometimes cause false positives, especially with third-party services or partner organisations that do not authenticate properly. Start with "quarantine" mode for DMARC policies, monitor the quarantine folder for two weeks, and switch to "reject" only after you confirm no false positives are occurring.
Do I need a paid Defender for Office 365 plan to enable these settings?
Most do not. SPF, DKIM, DMARC, mail flow rules, and external email warnings are included in all M365 business plans. Advanced Threat Protection (Plan 1) is an add-on but is relatively inexpensive if your basic plan does not include it. Check your current licence in the Microsoft 365 admin centre under Billing > Your Products.
How often should I review and update these phishing protection settings?
At minimum quarterly. Review your quarantine folder monthly to catch any false positives. Update your DMARC policy and mail flow rules whenever you add new business applications or third-party services that send email on your behalf, as these can trigger authentication failures if not properly configured.
What should I do if a user is compromised despite these protections?
Reset their password immediately, revoke active sessions in Azure AD, review their inbox and forwarding rules for backdoors, check mailbox permissions granted to external accounts, and run a threat scan on their device. Then submit the details to your security team and Microsoft. These settings reduce the risk, but no single control is 100% effective.
SmoothOps 365 runs live instructor-led training every Saturday and Sunday. 3 months. 50 contact hours. Keep your job while you train.