Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteConfigure Microsoft 365 Defender anti-phishing protection by starting with the Standard or Strict preset security policy, then adding a narrowly scoped custom policy only where you need different treatment. The default policy protects every recipient with spoof and mailbox-intelligence controls, but it does not set impersonation protection or a phishing-threshold level. In the Defender portal, choose the recipients, threshold, impersonation targets, intelligence settings, detection actions and quarantine behavior, then validate the result after the change has propagated.
What an anti-phishing policy controls
Microsoft 365 anti-phishing policies combine Exchange Online Protection anti-spoofing for cloud mailboxes with Defender for Office 365 protections against impersonation. A policy can evaluate whether a sender is spoofing a domain, imitating a protected person or domain, or triggering mailbox-intelligence signals based on communication history. It then applies an action such as redirecting the message, moving it to Junk Email or quarantining it.
As an Amazon Associate I earn from qualifying purchases.
The default anti-phishing policy applies to all recipients. It includes spoof protection and mailbox intelligence, but its Defender for Office 365 configuration does not set impersonation protection or a phishing email threshold. You can add those controls through a Standard or Strict preset, by modifying the default policy where the portal allows it, or with a custom policy.
Recommended Free Tools
Microsoft’s recommended starting point is to enable the Standard and/or Strict preset security policies and configure impersonation protection there. Presets provide a broad baseline without forcing you to maintain many overlapping custom policies.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the right policy model before changing settings
Standard and Strict presets
Preset security policies are designed for organization-wide or clearly defined groups of recipients. Standard is the normal baseline; Strict applies more aggressive protection. Configure them at Email & collaboration > Policies & rules > Threat policies > Preset security policies. The setup flow lets you target all recipients or selected recipients and add protected email addresses, domains and trusted exceptions for impersonation.
Custom policies
Use a custom anti-phishing policy when a particular group, accepted domain or operating scenario needs settings different from the preset baseline. A custom policy can be enabled, disabled, reordered or removed. Give each one a unique name that identifies both its scope and purpose, such as a business unit or accepted domain.
The default policy
The default policy is always present, applies broadly and cannot be disabled or deleted. Treat it as the final baseline rather than as a replacement for the presets. Standard and Strict policy objects are managed from the preset security policy page, not by editing their anti-phishing detail flyout.
Configure a custom anti-phishing policy in the Defender portal
Open the Microsoft Defender portal’s anti-phishing page at https://security.microsoft.com/antiphishing, or use the navigation path Email & collaboration > Policies & rules > Threat policies > Anti-phishing. Select Create to start.
- Name the policy. Enter a unique, descriptive name and, if useful, an explanation of why the policy exists. Clear naming makes priority reviews and incident investigations safer.
- Define recipient scope. Select the mailboxes, mail users, contacts, supported mail-enabled groups or Microsoft 365 Groups, and accepted domains that should receive the policy. Scope is the most important decision because it determines who can be affected by every later setting.
- Set the phishing email threshold. Choose one of the four levels shown by the wizard: Standard (1), Aggressive (2), More aggressive (3) or Most aggressive (4).
- Configure impersonation protection. Add protected users by display name and email address, your owned domains, and any custom domains that should be protected. Add trusted senders or domains only when there is a specific reason to bypass or reduce impersonation suspicion.
- Review intelligence controls. Check mailbox intelligence and spoof intelligence. Both are selected by default, and Microsoft recommends leaving them enabled in normal deployments.
- Choose detection actions. On Actions, select what happens for each detection type: redirect, move to Junk Email or quarantine. When using quarantine, select an appropriate quarantine policy.
- Review safety tips and indicators. Confirm that the warning experience matches your organization’s response process, then complete the wizard.
- Inspect the resulting policy list. Verify that the policy is enabled, scoped as intended and placed at the required priority. Allow up to 30 minutes for a new or updated policy to be applied.
Set recipient scope precisely
The wizard supports several recipient conditions. Multiple values entered within one condition use OR logic; different condition types combine with AND logic. Exceptions use OR logic across exception types. For example, selecting two accepted domains means either domain can match that condition, while also selecting a group requires the message recipient to satisfy both condition categories. An exception in any configured exception category can remove a recipient from the policy.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Scope element | What you can target | How to use it |
|---|---|---|
| Users and contacts | Mailboxes, mail users and contacts | Use for named people or mail-enabled identities that need a tailored threshold or impersonation list. |
| Groups | Supported mail-enabled groups and Microsoft 365 Groups | Use when protection should follow group membership rather than a hand-maintained list of individuals. |
| Accepted domains | Domains accepted by your tenant | Use for domain-wide handling, especially when multiple recipients share the same mail domain. |
| Exceptions | Recipients or other supported exception entries | Use sparingly; exceptions are evaluated with OR logic across exception types. |
Keep scopes mutually understandable. A broad domain policy combined with a narrow user policy can be valid, but only the first applicable policy in the precedence chain will act on a recipient. Document the intended outcome before creating overlapping scopes.
Choose the phishing email threshold
The threshold controls how aggressively the policy treats phishing detections. The wizard numbers the choices from 1 through 4:
| Level | Label in the wizard | Microsoft guidance |
|---|---|---|
| 1 | Standard | Default setting and the Standard preset recommendation. |
| 2 | Aggressive | Stronger filtering than Standard. |
| 3 | More aggressive | Further increases filtering strictness. |
| 4 | Most aggressive | Strict preset recommendation. |
Higher levels should be evaluated against false positives in your organization. A message that is legitimate for one group may be unusual for another, so review quarantine and Junk Email outcomes after changing the threshold instead of assuming that the most aggressive option is appropriate everywhere.
Configure impersonation protection
User and domain impersonation protection are not enabled by default in the basic policy. Add the identities most likely to be imitated, then check that the protected values match the names and addresses recipients actually see.
Protect users
Add a person by display name and email address. Prioritize executives, finance approvers, administrators and other identities whose apparent instructions could cause a payment, credential or data-loss incident. The policy uses the protected identity as an impersonation target; it does not mean that every message from that person is automatically trusted.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Protect domains
Specify domains you own and any custom domains that should receive protection. A trusted domain entry does not automatically include its subdomains, so enter each required domain explicitly. Review domain ownership and accepted-domain changes as part of normal mail-administration work.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use trusted senders and domains carefully
Trusted entries can reduce protection for messages that would otherwise be treated as impersonation. Add them only when the sender or domain is justified, verified and still needed. Avoid broad entries that cover unrelated senders, and remember that a parent-domain trust entry does not automatically cover subdomains.
Leave intelligence protections enabled unless your mail flow requires a different fix
Mailbox intelligence
Mailbox intelligence uses sender-recipient history to help determine whether a message resembles an impersonation attempt. Microsoft selects it by default and recommends keeping it enabled. The history between a sender and recipient can affect whether a message is identified as impersonation, so a first-time or unusual communication may receive a different result from an established exchange.
Spoof intelligence
Spoof intelligence evaluates signals associated with spoofed senders. It is also selected by default and should normally remain enabled.
Mail routed through a third-party service
If inbound mail reaches Microsoft 365 through another filtering or relay service and your MX record does not point directly to Microsoft 365, Microsoft says to enable Enhanced Filtering for Connectors. Do not turn off spoof intelligence merely to accommodate that topology. Enhanced filtering preserves the relevant source information so anti-spoofing decisions can be made with a more accurate view of the original connection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Choose actions and quarantine behavior
On the Actions page, set a result for each detection category exposed by the policy. The available outcomes include redirecting the message, moving it to Junk Email or quarantining it. Match the action to the confidence of the detection and the recipient group’s ability to review messages safely.
- Redirect: Send detected mail to a designated review destination when a security team needs centralized handling.
- Move to Junk Email: Keep the message available to the recipient while separating it from the inbox.
- Quarantine: Hold the message under a quarantine policy. That quarantine policy determines what recipients can do with held messages and whether they receive notifications.
Review the safety tips and visual indicators in the same wizard. A technically correct action is less useful if users cannot tell why a message was treated differently or who is responsible for releasing it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Understand policy priority and preset precedence
Priority determines which policy acts when more than one policy scope matches a recipient. For recipients covered by presets, the order is:
| Order | Policy layer | Operational consequence |
|---|---|---|
| 1 | Strict preset | Evaluated first for recipients in its scope. |
| 2 | Standard preset | Evaluated after Strict and before custom policies. |
| 3 | Enabled custom policies | Evaluated in their configured priority order; priority 0 is highest. |
| 4 | Default policy | Provides the remaining baseline when no higher policy applies. |
Protection stops for a recipient after the first applicable policy. Consequently, a custom policy can exist, be enabled and still have no effect because a higher-precedence Standard or Strict preset already covers that recipient. When troubleshooting, inspect the recipient’s preset coverage and the custom policy’s position before changing individual settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Manage preset objects from Email & collaboration > Policies & rules > Threat policies > Preset security policies. Do not expect to edit Standard or Strict by opening the custom anti-phishing detail flyout.
Use PowerShell when policy changes need repeatability
Exchange Online PowerShell exposes an anti-phish policy and the rule that assigns recipients and priority as separate objects. The portal creates both together, but PowerShell requires this sequence:
- Create the anti-phish policy object with the desired protection and action settings.
- Create a rule that assigns recipients, exceptions and priority to that policy.
- Confirm that the rule is enabled and that its priority places it where you expect in the evaluation order.
- When removing a configuration, delete the associated rule as well as the policy object if both are no longer needed.
A policy created without an associated rule is not visible in the Defender portal. Conversely, deleting a policy does not automatically delete its corresponding rule. Maintain the two objects together in change records and automation so an orphaned rule cannot produce an unexpected result.
Validate the deployment and tune it safely
Do not treat the wizard’s completion screen as proof that messages are being handled as intended. Microsoft says to allow up to 30 minutes for a new or updated policy to apply. After that window, validate both matches and misses.
Confirm which policy handled a message
Inspect message headers, especially the Spam Filtering Verdict in X-Forefront-Antispam-Report, when a message appears to have skipped filtering or received an unexpected result. The verdict and related header data help distinguish a scope or precedence issue from a detection decision.
Compare settings with Microsoft’s recommendations
Use Configuration analyzer to compare the tenant’s anti-phishing configuration with Standard and Strict recommendations. Treat differences as review items, not automatic changes: a deliberate exception or threshold may be appropriate for a specific group.
Investigate false positives and false negatives
Use Threat Explorer and the available reports to find messages that were incorrectly quarantined, delivered to Junk or missed entirely. Review the message’s recipient, the policy that applied, the impersonation target, intelligence signals and final action. Adjust scope, trusted entries, threshold or action only after identifying the specific cause.
Review ongoing signals
Periodically review spoof intelligence and impersonation insights for new attack patterns and unnecessary trusted entries. Microsoft also recommends a monthly Secure Score review so security-policy changes are not left unexamined as the tenant and mail flows evolve.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Common configuration mistakes and their fixes
- A custom policy never appears to work: Check whether the recipient is covered by Strict or Standard, then check custom priority. The higher-precedence policy wins.
- Users receive unexpected impersonation warnings: Verify the protected user’s display name and address, inspect mailbox-intelligence history and review whether the sender was added as a justified trusted entry.
- Subdomain mail is not treated like the parent domain: Add the subdomain explicitly; trusted domain entries do not automatically include subdomains.
- Mail relayed through another service is evaluated incorrectly: If MX does not point to Microsoft 365, configure Enhanced Filtering for Connectors instead of disabling spoof intelligence.
- Quarantined users cannot release messages or receive notices: Review the selected quarantine policy. It controls recipient permissions and notification behavior.
- A newly changed setting has no immediate effect: Wait up to 30 minutes, then inspect headers and reports before making another change.
- A PowerShell-created policy is missing from the portal: Create and verify its associated rule. The portal displays the policy only when it is associated with a rule.
- Removing a PowerShell policy leaves behavior behind: Check for and remove the corresponding rule; deleting the policy alone does not delete that rule.
A practical rollout sequence
- Enable and scope the Standard or Strict preset from the preset security policies page.
- Add the users and domains that need impersonation protection, along with only the trusted exceptions that have a documented justification.
- Keep mailbox intelligence and spoof intelligence enabled. If mail is relayed and MX does not point to Microsoft 365, configure Enhanced Filtering for Connectors.
- Choose the threshold and actions appropriate for the recipient group, then select a quarantine policy when quarantine is used.
- Create a custom policy only for a documented exception to the preset baseline, and place it at the correct priority.
- Wait for propagation, inspect headers and Spam Filtering Verdict values, and review Threat Explorer and reports.
- Tune one variable at a time, then revisit spoof intelligence, impersonation insights and Secure Score monthly.
What a correctly configured tenant should make clear
You should be able to answer four questions for any recipient: which policy applies, why that policy wins, which users or domains are protected from impersonation, and what happens when a detection fires. If those answers are not obvious from the policy list, scope definitions and priority order, simplify overlapping custom policies before increasing aggressiveness.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
