How to Prevent Phishing Attacks in Microsoft 365

Recognizing and avoiding phishing scams in Microsoft 365 is crucial for maintaining security. As an admin, it's essential to train users effectively to identify phishing emails.

Here are steps to identify phishing emails in Microsoft 365:

Here are some best practices to stay protected from phishing emails and safeguard yourself and your organization against such attacks.

Microsoft 365's Advanced Threat Protection (ATP) offers strong defense mechanisms against phishing, but maintaining its effectiveness requires careful oversight. Unauthorized changes to ATP settings can weaken your defenses, increasing the risk of phishing attacks.

• With AdminDroid's Advanced Threat Protection (ATP) Activities report, you can prevent unauthorized access and modifications in ATP settings.
• This report provides various details, including username, protection policy, event time, modified parameters, etc., to aid in maintaining high protection against evolving phishing threats.

In addition to the mentioned practices, users can report any phishing messages to Microsoft if they seem like an attempt to trick you into sharing sensitive information. Reporting these messages not only safeguards users but also enhances Microsoft's ability to identify and prevent phishing attempts.

Reporting a phishing email in Outlook is a straightforward process that helps protect your account and organization from potential threats.

Phishing attacks are now targeting popular communication tools like Microsoft Teams. To help users, Microsoft introduced a feature for reporting suspicious messages. Here’s how to do it:

Before users can report suspicious messages in Teams, an admin must enable this feature in the Teams admin center. Here’s how:

With these settings enabled, users can now easily report suspicious messages in Microsoft Teams, ensuring enhanced security and prompt action against phishing threats.

When you report a message as phishing in Microsoft 365, the process differs slightly depending on whether the messages are reported from Outlook or Teams.

Admins can view user-reported messages under the ‘User reported’ tab on the Submissions page in Microsoft 365 Defender. Monitoring these messages is essential for identifying legitimate senders and potential phishing attempts. If admins have not configured direct submission to Microsoft, they can submit these identified phishing attempts for analysis through this page.

Anti-phishing protection in Microsoft 365 involves several key components and practices to protect users and organizations from phishing attacks. Here's a breakdown of some of the key elements:

Overall, Microsoft 365 uses a combination of technology, policies, and training to provide robust protection against phishing attacks. Admins should use these key features as part of their Office 365 security best practices.

Microsoft 365 Defender allows you to customize anti-phishing policies to match your organization's needs. This flexibility ensures security without compromising productivity. Let's see how to create these anti-phishing policies.

Managing multiple anti-phishing policies in Microsoft 365 can be time-consuming as you need to check each policy individually to view its configurations. While creating policies is straightforward with the Microsoft 365 Defender portal, there is no direct way to explicitly see changes made to an anti-phishing policy.

AdminDroid provides detailed tracking of any changes to anti-phishing policies and rules, documenting every event in the Anti-Phish Policy/Rule Changes report.

• To access this report, navigate to Audit»Exchange»Advanced Threat Protection»Anti-Phishing.
• With this report, Microsoft 365 admins can access details, such as configured time, UPN, respective anti-phish policy, involved tenant, operation, modified properties, and more. This proactive approach ensures that your organization's defenses against phishing attacks remain strong and adaptive.

Quick tip: Easily email the report directly from AdminDroid by clicking the Email 📧 button located in the top right corner.

The phishing email threshold in Microsoft 365 Defender is a setting that determines the sensitivity level at which emails are classified as phishing attempts. By setting this threshold, you can control how aggressively Microsoft 365 Defender filters out potential phishing emails.

Here's how to set the phishing email threshold in Office 365:

To set the phishing threshold value using PowerShell, you can use the following cmdlet. This approach can help avoid the manual navigation of multiple admin portals.

Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" -PhishThresholdLevel "ThresholdValue" 

Replace with your desired threshold value between 1 and 4. This command will update the phishing threshold level of the default anti-phishing policy.

IMPORTANT: The threshold value is 1 for the default policy, 3 for the standard policy, and 4 for the strict preset security policy. Keep in mind that increasing this value raises the chances of false positives (good mail marked as phishing). Set the phishing email level threshold at 2 or higher based on your organization's requirements.

Attack simulation training is a cybersecurity training method used within Microsoft 365 organizations to improve security awareness and readiness among employees. It involves creating controlled, realistic cyber-attack scenarios that mimic various tactics used by attackers. These simulations train staff to recognize, respond to, and report potential security threats, such as phishing emails, malware attacks, or suspicious activities.

Here are key aspects of attack simulation training in Office 365:

This proactive approach is effective in reducing the risk of security breaches by ensuring that employees are better equipped to handle real-life phishing incidents.