How to Audit Phishing Emails in Microsoft 365

Recognizing and avoiding phishing scams in Microsoft 365 is crucial for maintaining security. As an admin, it's essential to train users effectively to identify phishing emails.

Here are steps to identify phishing emails in Microsoft 365:

Here are some best practices to enhance Microsoft 365 email phishing protection and safeguard your organization from attacks.

In addition to the mentioned practices, users can report any phishing messages to Microsoft if they seem like an attempt to trick you into sharing sensitive information. Reporting these messages not only safeguards users but also enhances Microsoft's ability to identify and prevent phishing attempts.

Reporting a phishing email in Outlook is a straightforward process that helps protect your account and organization from potential threats.

• Log in to the Microsoft Outlook account.
• Select the phishing message in your inbox.
• Under the ‘Report’ drop-down, select the 'Report phishing' option.
• On the confirmation prompt, select the Report button to flag phishing in Microsoft Outlook.

Phishing attacks are now targeting popular communication tools like Microsoft Teams. To help users, Microsoft introduced a feature for reporting suspicious messages. Here’s how to do it:

• To report a suspicious message in Teams, select the message and click 'More options' (ellipses).
• Next, select 'More actions' and choose the 'Report this message' option.
• Select "Security risk – Spam, phishing, malicious content" from the drop-down menu.
• Click the Report button to submit the message.

Before users can report suspicious messages in Teams, an admin must enable this feature in the Teams admin center. Here’s how:

With these settings enabled, users can now easily report suspicious messages in Microsoft Teams, ensuring enhanced security and prompt action against phishing threats.

When you report a message as phishing in Microsoft 365, the process differs slightly depending on whether the messages are reported from Outlook or Teams.

Admins can view user-reported messages under the ‘User reported’ tab on the Submissions page in the Microsoft 365 Defender. Monitoring these messages is essential for identifying legitimate senders and potential phishing attempts. If admins have not configured direct submission to Microsoft, they can submit these identified phishing attempts for analysis through this page.

Anti-phishing protection in Microsoft 365 involves several key components and practices to protect users and organizations from phishing attacks. Here's a breakdown of the key elements of Microsoft 365 anti-phishing:

Overall, Microsoft 365 uses a combination of technology, policies, and training to provide robust protection against phishing attacks. Admins should use these key features as part of their Office 365 security best practices.

Microsoft 365 Defender allows you to customize anti-phishing policies to match your organization's needs. This flexibility ensures security without compromising productivity. Let's see how to create these Microsoft 365 anti-phishing policies.

Managing multiple anti-phishing policies in Microsoft 365 can be time-consuming as you need to check each policy individually to view its configurations. While creating policies is straightforward with the Microsoft 365 Defender portal, there is no direct way to explicitly see changes made to an anti-phishing policy.

AdminDroid provides detailed tracking of any changes to anti-phishing policies and rules, documenting every event in the comprehensive Anti-Phish Policy/Rule Changes report.

• To access this report, navigate to Audit»Exchange»Advanced Threat Protection»Anti-Phishing.
• With this report, Microsoft 365 admins can access details, such as configured time, UPN, respective anti-phish policy, involved tenant, operation, modified properties, and more.
• This proactive approach ensures that your phishing defense for Microsoft 365 remains strong and adaptive.

Quick tip: Easily email the report directly from AdminDroid by clicking the Email 📧 button located in the top right corner.

The phishing email threshold in Microsoft 365 Defender is a setting that determines the sensitivity level at which emails are classified as phishing attempts. By setting this threshold, you can control how aggressively Microsoft 365 Defender filters out potential phishing emails.

Here's how to set the phishing email threshold in Office 365:

• Sign in to the Microsoft 365 Defender portal.
• Go to Email & collaboration»Policies & rules»Threat policies»Policies»Anti-phishing.
• Select the 'Office365 AntiPhish Default (Default)' policy.
• Under 'Phishing & threshold protection', choose 'Edit protection settings'.
• Adjust the 'Phishing email threshold' slider to set the value.

To set the phishing threshold value using PowerShell, you can use the following cmdlet. This approach can help avoid the manual navigation of multiple admin portals.

Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" -PhishThresholdLevel "ThresholdValue" 

Replace with your desired threshold value between 1 and 4. This command will update the phishing threshold level of the default anti-phishing policy.

Important: The threshold value is 1 for the default policy, 3 for the standard policy, and 4 for the strict preset security policy. Keep in mind that increasing this value raises the chances of Microsoft 365 high confidence phish false positives (good mail marked as phishing). Set the phishing email threshold level to 2 or higher to align with Microsoft Secure Score recommendations for phishing protection and enhance organizational security.

Attack simulation training is a cybersecurity training method used within Microsoft 365 organizations to improve security awareness and readiness among employees. It involves creating controlled, realistic cyber-attack scenarios that mimic various tactics used by attackers. These simulations train staff to recognize, respond to, and report potential security threats, such as phishing emails, malware attacks, or suspicious activities.

Here are key aspects of attack simulation training in Office 365:

This proactive approach is effective in reducing the risk of security breaches by ensuring that employees are better equipped to handle real-life phishing incidents.