Secure the messaging environment
Domain 4 - Secure the messaging environment
This domain tests protection layers in Exchange Online: EOP anti-spam and anti-malware, Defender for Office 365 anti-phishing, Safe Links, Safe Attachments, quarantine, zero-hour auto purge (ZAP), alert policies, and encryption controls.
Core rules
- Anti-phishing policies provide spoof intelligence, impersonation protection for users and domains, mailbox intelligence, and safety tips. Impersonation actions can move a message to quarantine, junk, or add a banner.
- Safe Links rewrites and checks URLs; Safe Attachments detonates attachments. Both are Defender for Office 365 features and can apply to Teams and SharePoint as well as email.
- Quarantine policies determine what recipients can see and whether they can release their own quarantined messages.
- ZAP retroactively removes malicious messages after delivery when new signals arrive. Tenant allow/block lists, alert policies, and the Configuration Analyzer help tune protection.
Worked example
A vendor's domain is being spoofed to target finance staff. Create an anti-phishing policy with the vendor domain added to protected domains and the CFO added to protected users. Enable impersonation protection, set the action to quarantine for domain impersonation, and enable mailbox intelligence. Add a transport rule to prepend a warning when the display name matches the CFO but the sender is external. Reasoning: anti-phishing handles impersonation and spoof signals; the transport rule adds a visible cue. Test with a simulated phishing message and review quarantine and alerts.
Traps
- User allow lists can override block decisions; check them before blaming policy.
- Anti-phishing policy priority matters when multiple policies match.
- Quarantine notifications require a quarantine policy and notification settings.