Free tools Windows power users keep installed
One-click scans. No signup required.
Review Microsoft 365 email security in risk order: authenticate every sending domain, compare threat policies with Microsoft’s Standard or Strict baselines, check forwarding and mailbox access, protect privileged accounts, and verify reporting and audit coverage. Treat the baselines as a comparison point—not a one-size-fits-all tenant recipe—and test business-critical mail flows before changing settings.
1. Set scope, licensing, and administrative access
Before changing a policy, map the mail environment it needs to protect. Microsoft’s admin guidance applies its built-in security features to organizations with cloud mailboxes, but additional Defender for Office 365 controls depend on subscription and policy assignment. Business Premium includes Defender for Office 365 Plan 1; confirm the tenant’s actual subscription and enabled features before treating a control as available.
As an Amazon Associate I earn from qualifying purchases.
- Inventory Exchange Online recipients and all custom sending and accepted domains, including parked domains and subdomains.
- Identify legitimate third-party senders, inbound gateways, connectors, and any required external forwarding.
- Note shared or service mailbox needs, mobile access requirements, and unmanaged-device workflows that could be affected by a restriction.
- Use the least-privileged administrative role that can perform each review. Microsoft recommends reserving Global Administrator for emergency situations where an existing lower-privilege role cannot do the work.
Microsoft Learn guidance cited in this checklist was accessed October 7, 2026. Exact policy availability and tenant settings can vary with subscription, configuration, and mail-flow design.
2. Authenticate sending domains and confirm mail flow
Fix domain authentication and routing before tuning filtering. Microsoft’s administrator checklist specifies the order SPF, DKIM, then DMARC for every custom Microsoft 365 domain, including parked domains and subdomains.
- SPF: Check that each domain’s record accounts for every legitimate sender, including non-Microsoft services.
- DKIM: Enable signing for the relevant sending domains.
- DMARC: Publish a policy and monitor policy results and alignment.
Misconfigured authentication can cause legitimate mail to land in Junk or quarantine even when threat-policy settings match Microsoft’s recommendations. If mail reaches Microsoft 365 through a non-Microsoft service first, review Enhanced Filtering for Connectors so Microsoft 365 can use the relevant source and authentication signals.
Do not use broad anti-spam allowlists—or allow your own domains—to work around false positives. Microsoft warns that allowed domains can let messages through that would otherwise be filtered. Identify and correct the authentication or delivery defect instead.
3. Compare threat policies with Microsoft’s baselines
Review anti-spam, anti-malware, anti-phishing, quarantine handling, and preset-policy assignment. Microsoft recommends Standard and/or Strict preset security policies for recipients. A custom policy may be justified by a business requirement, but compare it periodically with the relevant baseline and document why any difference remains.
Separate built-in protection from Defender for Office 365 features
Microsoft distinguishes the protections available to cloud-mailbox organizations from additional Defender for Office 365 controls. Safe Links, Safe Attachments, impersonation protection, and phishing thresholds are Defender-related features; availability and default behavior depend on subscription and whether preset or custom policies apply. Verify both licensing and assignment in your tenant rather than assuming a feature is active because it appears in guidance.
Check quarantine permissions deliberately
Review who can view, request release, or release quarantined messages under the applicable policy. Microsoft’s settings guidance says users cannot self-release certain malware and high-confidence phishing messages; depending on policy, they may be able to request release. Do not configure users to release every quarantined threat as a general convenience measure.
Apply specialist baselines only where they fit
For education tenants, Microsoft’s education baseline additionally highlights common attachment filters, malware scanning, zero-hour auto purge, phishing and impersonation protections, inbound spam filtering, link scanning, and audit logging. Treat those as education-specific guidance, not as a universal instruction for every tenant.
4. Find settings that have drifted below baseline
Use the Microsoft Defender configuration analyzer to compare supported policy settings with Standard or Strict. The analyzer covers built-in anti-spam, anti-malware, and anti-phishing policies; when Defender for Office 365 is in scope, it also checks impersonation and phishing-threshold settings, Safe Links, and Safe Attachments. It checks certain settings outside policies too, including whether SPF and DKIM are detected and whether Outlook external-sender identifiers are configured.
For each finding, review the affected policy, current configuration, recommendation, and last-modified date. A difference from the baseline is a prompt to evaluate—not an instruction to change a setting without checking its effect on legitimate mail.
Use drift history to understand changes
Where drift history is available, it can show who changed a setting, its old and new values, and whether the change moved protection up or down relative to the selected baseline. Microsoft documents a review window of up to 90 days for this view and says Unified Auditing must be enabled for drift analysis. Record accepted exceptions, their business reason, and an owner so a later administrator can reassess them.
5. Restrict risky forwarding and review mailbox behavior
Policy settings do not tell the whole story: automatic forwarding policy, mailbox-level forwarding, and inbox rules can each affect where messages go. Review all three and investigate unexpected forwarding or rule changes.
Check outbound automatic forwarding
For each outbound spam policy, inspect Automatic forwarding rules. Microsoft’s Zero Trust guidance identifies Automatic – System-controlled (the default) and Off – Forwarding is disabled as values that block automatic forwarding to external recipients for affected users. Confirm which policy applies to each group and test required workflows before tightening it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesMicrosoft identifies external forwarding as a method attackers use to extract data. Secure Score and the Autoforwarded messages report can help administrators review the setting and identify forwarding activity.
Review mobile and unmanaged-device access
Check whether legacy/basic-authentication ActiveSync is blocked and whether mobile access requires appropriate app protection. For unmanaged devices, Exchange Online mailbox policies and Conditional Access can prevent attachment downloads or block viewing in Outlook on the web and new Outlook for Windows. Scope restrictions to the intended users and validate legitimate mobile and browser workflows before rollout.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Protect privileged accounts and improve detection
Require phishing-resistant MFA for administrators
Microsoft recommends phishing-resistant MFA for Exchange Administrator accounts and other privileged roles. Before enforcing a requirement, confirm that administrators have registered working authentication methods and that a recovery path is available; an untested rollout can lock administrators out. FIDO2 security keys are one supported phishing-resistant method. Manage available methods and policy scope through Microsoft Entra authentication methods and Conditional Access, and verify platform and tenant-policy compatibility before relying on a particular method.
Make user reporting actionable
Configure Outlook’s Report button and route user-reported messages to a designated mailbox, Microsoft, or both. Review the submissions queue and threat reports; submit suspected phishing as well as false positives and false negatives so detections can be investigated. Maintain alert policies relevant to user and administrator activity, potential malware, and data-loss incidents. Microsoft’s anti-phishing best practices recommend reviewing Secure Score monthly.
7. Preserve audit evidence
Do not disable the default audit policy. Microsoft’s Exchange Online education baseline says it logs certain administrator actions and recommends enabling Microsoft 365 user activity logging for incident response and threat detection. Check audit coverage and retention in the tenant’s current Purview configuration; Microsoft’s guidance cited here does not establish one retention duration that applies to every tenant.
8. Turn the review into a controlled change plan
For each finding, capture the current setting, the applicable Microsoft baseline, the affected recipients or mail flow, the decision, and the person responsible for any exception. Then test the changed configuration against both security and delivery needs.
- Verify messages from each legitimate sending domain and third-party service, including expected authentication and routing.
- Check quarantine handling and user reporting with the roles and groups that will use them.
- Test required external forwarding, mobile access, and unmanaged-device scenarios with the affected users.
- Confirm privileged administrators can satisfy the MFA policy and use the planned recovery route.
- Revisit documented exceptions and analyzer findings after changes to licensing, connectors, domains, or business workflows.
This approach keeps Microsoft’s recommendations visible while preserving the tenant-specific decisions that determine whether a secure setting also works for the organization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
