L3. Defender for Office 365: Email Threat Protection
Visual workflow edition
Worked example, diagrams and a question with time to think. Synthetic American-English narration; examples are fictional. Reviewed October 2026.
Read the video transcript
An employee reports a message that was delivered yesterday. The sender looks familiar, but the link now looks suspicious. What should you check first? We'll distinguish prevention from investigation, trace the message's actual delivery and activity, and choose a response based on evidence rather than the subject line.
Safe Attachments adds analysis for attachments. Safe Links provides link protection in supported scenarios. Investigation tools help analysts understand what happened to a particular message and who may be affected. These capabilities depend on licensing and configuration. Do not treat enabling one feature as proof that every message, application, or user is covered.
Use the appropriate investigation experience for your license. Search using reliable message identifiers, sender information, recipients, and a bounded time range. Inspect the delivery location and recorded detections. Our fictional message reached two users, while another copy was quarantined. That means you need to review the delivered copies, not just the quarantined sample.
Delivery and compromise are different events. Review available interaction evidence and then correlate relevant identity or endpoint activity. A recorded click can justify further investigation, but it does not prove credentials were stolen. Missing click data is not proof that nobody interacted. Write down the visibility limits alongside your conclusion.
Choose the supported remediation action under your organization's permissions and incident process. Confirm the affected messages and recipients before broad action. Review the resulting action status and any remaining exposure. If an account or device may be compromised, coordinate those investigations too. Removing a message does not undo every action a person already took.
The suspicious email has been removed, but the recipient entered credentials on the linked page. Can you close the incident just because the mailbox is clean? Pause and explain why.
No. Message removal addresses the email, while possible account compromise needs its own investigation and authorized response. Check the affected identity and relevant activity, then verify the outcome. Keep prevention, delivery, interaction, and compromise separate in your notes. That separation makes both the technical response and the final explanation more accurate.
Course outlineLesson 3 of 18
Defender for Office 365 protects against phishing, business email compromise, and malicious attachments. This lesson covers Safe Attachments, Safe Links, anti-phishing policies, and Threat Explorer for the SC-200 exam.
Defender for Office 365 Overview
Microsoft Defender for Office 365 (MDO) protects Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams against email-based and collaboration-based threats. It comes in two plans:
| Feature | Plan 1 | Plan 2 |
|---|---|---|
| Safe Attachments | Yes | Yes |
| Safe Links | Yes | Yes |
| Anti-phishing policies | Yes | Yes |
| Threat Explorer | No | Yes |
| Automated Investigation | No | Yes |
| Attack Simulation Training | No | Yes |
| Campaign Views | No | Yes |
Safe Attachments
Safe Attachments detonates email attachments in a sandbox (Microsoft calls this "detonation") before delivery. Policy actions include:
- Block: Quarantine the attachment and prevent delivery
- Replace: Deliver the email with the attachment removed and a notification
- Dynamic Delivery: Deliver the email body immediately, replace attachment with a placeholder until scanning completes
- Monitor: Track detections without blocking (not recommended for production)
Safe Attachments also protects files in SharePoint, OneDrive, and Teams when enabled globally.
Safe Links
Safe Links rewrites URLs in emails and Office documents to route through Microsoft's scanning service. When a user clicks a rewritten URL:
- The URL is checked against a blocklist of known malicious sites
- If not blocked, a real-time reputation scan runs
- If the URL is safe, the user is redirected to the destination
- If the URL is malicious, a warning page is displayed
Key configuration options:
- Track user clicks: Required for reporting and investigation
- Do not rewrite URLs, but check against known malicious links: Preserves original URL appearance
- Do not rewrite specific URLs: Use for trusted internal applications
Anti-Phishing Policies
Anti-phishing policies use mailbox intelligence and impersonation detection:
- User impersonation protection: Detects emails impersonating specific high-value users (executives, finance team)
- Domain impersonation protection: Detects emails from domains that visually resemble your trusted domains
- Mailbox intelligence: Uses the recipient's email patterns to identify anomalous senders
- Spoof intelligence: Evaluates email authentication (SPF, DKIM, DMARC) to detect spoofing
Actions for detected impersonation: quarantine, move to Junk, deliver with a safety tip, or redirect to a specific mailbox. Exam tip: Mailbox intelligence requires the mailbox to be hosted in Exchange Online. It does not work with on-premises mailboxes.
Threat Explorer
Threat Explorer (Plan 2 only) is the primary investigation tool for email-based threats. Key views:
- All email: Complete view of inbound and outbound mail flow
- Malware: Emails detected with malicious attachments
- Phish: Emails identified as phishing attempts
- Content malware: Malicious files in SharePoint, OneDrive, and Teams
From Threat Explorer, analysts can:
- Soft delete or hard delete emails from mailboxes
- Trigger automated investigations
- Review email headers and delivery details
- Submit messages to Microsoft for analysis
Zero-Hour Auto Purge (ZAP)
ZAP retroactively removes malicious emails that were already delivered to user mailboxes. If threat intelligence updates identify a previously delivered email as malicious, ZAP moves it to Junk or Quarantine. ZAP works for phishing, spam, and malware verdicts.
- ✓Plan 2 (included in M365 E5) adds Threat Explorer, automated investigation, and attack simulation training.
- ✓Safe Attachments detonates files in a sandbox. Dynamic Delivery sends the email body immediately while the attachment is scanned.
- ✓Safe Links rewrites URLs and performs real-time scanning at time of click.
- ✓Anti-phishing policies include user impersonation, domain impersonation, mailbox intelligence, and spoof intelligence.
- ✓Zero-Hour Auto Purge (ZAP) retroactively removes malicious emails already delivered to mailboxes.
- ✓Threat Explorer allows analysts to soft delete or hard delete emails across the organization.
1. A user needs to receive an urgent email immediately but the attachment requires scanning. Which Safe Attachments action should be configured?
2. An email passed all security checks at delivery time, but later threat intelligence identifies it as a phishing message. Which feature removes it from the mailbox?
3. Which Defender for Office 365 feature requires the mailbox to be hosted in Exchange Online to function?
Keep learning
Use the knowledge check above to test your understanding. You can browse every lesson without signing in; opening another lesson does not mark this one complete.
Next lesson: Defender for Identity: Lateral Movement Detection →