Phishing defence in Microsoft 365 has three layers. Microsoft filters volume attacks before anyone sees them, on every plan, with no configuration. Defender for Office 365 adds click-time and detonation protection that has to be switched on. The third layer is your own domain's email authentication and your own people, and neither of those is something a licence can supply.
Most Australian small businesses have the first layer, have paid for the second and never enabled it, and have never touched the third. This guide covers what each layer catches, what it does not, and the test that tells you whether yours is working. Frontrow's separate business email compromise guide covers the payment-fraud lockdown in detail; this one is about the phishing surface itself.
Layer one: what Microsoft blocks before anyone sees it
Every Microsoft 365 organisation with cloud mailboxes gets the built-in protections, on by default. They are not a lesser product; they are the layer doing the overwhelming majority of the blocking by volume.
- Anti-malware, anti-spam and anti-phishing spoof protection, applied through default policies or the preset security policies.
- Spoof intelligence: Microsoft learns which senders legitimately send on behalf of your domains and flags the ones that do not.
- Quarantine and quarantine policies, which decide whether a user can release a message themselves or has to ask an administrator.
- Zero-hour auto purge: when a message is reclassified as malicious after delivery, Microsoft retracts it from the mailbox it already landed in.
- User-reported messages and admin submissions, so a false negative can be pushed back to Microsoft for reanalysis.
- The Tenant Allow/Block List for domains, addresses, spoofed senders, URLs and files.
Two things are worth knowing about this layer. Zero-hour auto purge is the reason a user sometimes reports that an email they were looking at vanished, and it is doing its job. And the allow entries in the Tenant Allow/Block List are the most commonly abused control in a small tenant: an allow added to stop a supplier's newsletter being quarantined becomes a permanent hole in the filter, because an allowed sender is an allowed sender to an attacker who spoofs them.
Layer two: what Defender for Office 365 adds, and how to turn it on
Microsoft 365 Business Premium and Microsoft 365 E3 include Defender for Office 365 Plan 1. It adds four capabilities that matter for phishing specifically.
| Capability | What it catches | What it does not catch |
|---|---|---|
| Safe Links | URLs rewritten and checked at the moment of click, in email, Office apps and Teams, so a link weaponised after delivery is still stopped. | A malicious page that is still clean when the user clicks, or a credential-harvesting page hosted on an otherwise reputable service. |
| Safe Attachments | Attachments detonated in an isolated environment before delivery, plus files in SharePoint, OneDrive and Teams. | A document with no payload that simply asks the reader to ring a phone number. |
| Impersonation protection | Lookalike domains and display-name impersonation of the specific people and domains you nominate, informed by mailbox intelligence on normal sender patterns. | Anyone you did not nominate. The protected-users list is manual and gets stale as staff change. |
| Real-time detections | The investigation surface: where a given message went, who else received it, what happened after delivery. | Nothing proactive. It is a place to look, not a thing that watches. |
None of this is meaningfully on until an administrator assigns the preset security policies. Built-in protection covers every recipient by default with basic Safe Links and Safe Attachments, which is enough to make a spot check look healthy while nobody is covered by Standard or Strict. Assign Standard protection to everyone and Strict protection to the leadership team, finance, and anyone who can change bank details. The presets are deliberately not configurable, which is the right trade for a business where nobody tunes anti-spam thresholds for a living.
What Plan 1 does not include: attack simulation training, Threat Explorer, campaign views and automated investigation and response for email. Those are Defender for Office 365 Plan 2, which arrives with Microsoft 365 E5 rather than Business Premium. The fastest way to tell which plan a tenant holds is the Microsoft Defender portal: Plan 1 shows Real-time detections under Email and collaboration, Plan 2 shows Explorer.
Layer three, part one: the email authentication only you can fix
Microsoft can filter mail arriving at your tenant. It cannot stop somebody spoofing your domain to your customers, your suppliers or your bank, because that mail never touches your tenant. SPF, DKIM and DMARC records in your own DNS are the only control that addresses it, and they are the layer Frontrow most often finds missing or half-built in an Australian small business.
- SPF declares which servers may send mail for your domain. A record that ends in ~all (soft fail) rather than -all leaves the decision to the receiver.
- DKIM signs outbound mail so a receiver can verify it was not altered in transit. In Microsoft 365 this needs enabling per custom domain; the default onmicrosoft.com signing does not cover your real domain.
- DMARC tells receivers what to do when SPF and DKIM fail, and where to send reports. A policy of p=none monitors and blocks nothing, which is the correct starting point and the wrong resting point.
Configure the records for every domain you own, including the ones you do not send mail from. An unused domain with no SPF record is a free identity for an attacker. Frontrow's step-by-step SPF, DKIM and DMARC guide covers the record syntax and the sequence for moving a DMARC policy from monitoring to enforcement without losing legitimate mail.
Layer three, part two: the reporting loop
User reporting is available on every Microsoft 365 plan with a cloud mailbox, costs nothing, and is the only detection capability in this guide that improves as the business grows. The built-in Report button in Outlook lets a user report phishing and junk. The user reported settings in the Microsoft Defender portal decide where those reports go: to Microsoft for reanalysis, to an internal mailbox you nominate, or both.
Send them to both. The Microsoft submission gets the message reanalysed and improves the filter. The internal copy is what lets somebody inside the business notice that three people in the same hour reported a message about an unpaid invoice, and act on it that afternoon rather than after the money moves.
Two configuration decisions carry more weight than they look. First, the quarantine policy: whether a user can release a quarantined message themselves or has to request it. Self-release is convenient and it is also the step where a user releases the message that phished them. For high-risk groups, request-and-review is the safer setting. Second, whether reporting is the friction-free path. If reporting a suspicious email takes more clicks than deleting it, people will delete it, and the pattern nobody sees is the pattern nobody stops.
Training and simulation: what your licence actually gives you
Attack simulation training is a Defender for Office 365 Plan 2 capability. A Business Premium tenant does not have it, which surprises businesses who bought Business Premium specifically because it was described as the security plan.
| Licence | Simulation and training | Practical route |
|---|---|---|
| Business Basic or Standard | Not included | Third-party awareness platform, or briefings plus the reporting button |
| Business Premium | Not included (Defender for Office 365 Plan 1) | Third-party awareness platform, or an E5-class Defender add-on |
| Microsoft 365 E3 | Not included (Defender for Office 365 Plan 1) | Defender for Office 365 Plan 2 add-on, or third-party |
| Microsoft 365 E5 | Included (Defender for Office 365 Plan 2) | Attack simulation training in the Defender portal |
A word on how simulations get used. A simulation that exists to produce a click-rate for a board pack teaches people that IT is trying to catch them out, and the measurable result is fewer reports rather than fewer clicks. The number worth tracking is the report rate: how many people pressed the button, and how fast the first one did. A business where the first report arrives in four minutes is in a different risk position from one where the first report arrives never, even if both have the same click rate.
How to test whether any of this is working
Five checks, all read-only except the last, none of which require a third-party service or an uploaded file.
- 1Preset policies: Microsoft Defender portal, Email and collaboration, Policies and rules, Threat policies, Preset Security Policies. Confirm Standard is on and assigned to all users, and note who is in Strict. Both toggles off means Plan 1 is doing Built-in protection only.
- 2Verify by behaviour, not by toggle: Microsoft's own method is to use a setting whose default differs between the presets. Bulk mail at a complaint level of 6 lands in Junk Email for a Standard user and is quarantined for a Strict user. Check a real mailbox in each group.
- 3Impersonation protection: open the anti-phishing policy applied to your users and read the protected users and protected domains lists. If they still name people who left, the control is aimed at the wrong targets.
- 4Email authentication: check SPF, DKIM and DMARC for every domain you own using any public DNS lookup. A missing DKIM selector for your real domain is the most common finding, followed by a DMARC record sitting at p=none since the day it was created.
- 5The reporting loop: send yourself a harmless message, report it with the Outlook button, and confirm it appears both in the nominated internal mailbox and under Submissions in the Defender portal. Then ask three staff members where the Report button is. If they cannot find it, the loop does not exist.
What none of this stops
Being straight about the limits is more useful than a confident claim. Three categories get through well-configured tenants routinely.
- Attacks with no payload. A plain text email asking the reader to ring a number, or to move a payment because the supplier has changed banks, contains nothing for a filter to detonate. This is the category that costs Australian businesses the most money, and the control for it is a verification procedure, not a security product.
- Compromised legitimate senders. When a real supplier's mailbox is taken over, the mail arrives from the correct domain, passes authentication, and continues a real thread. Impersonation protection does not fire, because nobody is impersonating anyone.
- Attacker-in-the-middle credential theft. A phishing kit that proxies the real Microsoft sign-in page defeats standard push multifactor authentication by relaying the approval in real time. Phishing-resistant methods bound to the sign-in surface are the answer, and they are a Conditional Access configuration rather than an email control.
Security products reduce the volume that reaches people and shorten the time to detection. They do not remove the need for a procedure that says how a change of bank details gets verified, or for somebody to read what the reporting loop brings in. Frontrow states that plainly because a guide that implies a product prevents every attack is setting a client up to be surprised.
When someone clicks anyway
Assume it will happen and decide now what the first hour looks like. The symptoms Microsoft lists for a compromised mailbox are worth knowing by heart: a mailbox suddenly blocked from sending, inbox rules that forward to an unknown address or file messages into Notes or RSS Subscriptions, unexplained password changes or lockouts, suspicious messages in Sent Items, and new external forwarding on the mailbox.
The order of the first response matters and it is counter-intuitive in one place: resetting the password is not step one, and the new password must never be emailed to the user, because the attacker may still be reading that mailbox. Frontrow's first-response runbook sets out the full sequence, including revoking active sessions, checking registered authentication methods, and the Australian reporting obligations that run in parallel.