November 5, 2026 - 6 min read

By PhishClean Research Team

The best anti-phishing settings in Microsoft Defender for Office 365

Microsoft publishes its recommended values, so you don't have to guess. Here they are in one place, with the settings presets leave for you to fill in, and the catch in that popular Dynamic Delivery advice.

Ask for the best anti-phishing settings in Defender for Office 365 and you'll probably hear: "Enable Safe Attachments with Dynamic Delivery and Safe Links with URL detonation at time of click." That's half right. Safe Links with real-time scanning is what Microsoft recommends. Dynamic Delivery is a valid choice with a trade-off, but it isn't the recommended value. Microsoft's Standard and Strict presets both use Block.

The values below come from Microsoft's recommended settings page, last updated 10 August 2026. Microsoft changes these from time to time, so check there before an audit.

The fast route: preset security policies

Unless you have a specific reason, use the Standard preset for everyone and Strict for high-value accounts such as executives, finance and admins. Microsoft updates presets as its recommendations change, and they save you from setting dozens of values by hand.

Watch the order of precedence. Strict applies first, then Standard, then custom policies, then the default policies and Built-in protection. Only the first matching policy of each type applies, with no merging of settings. So if someone is in Standard, your carefully tuned custom anti-phishing policy is ignored for them.

Anti-phishing policy values

Everything in this table except spoofing and first-contact tips needs Defender for Office 365. In anti-phishing policies, the built-in protection for all cloud mailboxes covers spoofing only.

Look at the Default column. Out of the box, impersonation detections take no action at all, which is why a tenant can have Defender licenses and still deliver a fake CEO email to the inbox.

What to put in the lists

• Users to protect: Microsoft suggests senders in key roles, such as your CEO, CFO and senior leaders, and external people like board members.
• Custom domains: domains you don't own but deal with often, such as your main suppliers, law firm and bank.
• Trusted senders: add only those wrongly flagged as impersonation, after checking they're real.

Safe Links values

Internal scanning is worth a second look if you run custom policies. A hacked employee's mailbox is a favorite launchpad, and those messages come from inside your organization.

Safe Attachments: Block or Dynamic Delivery?

Here's the difference, from Microsoft's documentation:

If people complain about delays on time-critical mail, Dynamic Delivery is a sensible custom-policy choice for those teams. A safe setup is to start with the preset's Block and create exceptions only when the delay is a demonstrated problem. Remember that custom policies only apply to people who aren't in a preset.

One more option to consider: Safe Attachments can quarantine password-protected attachments it can't scan. It's off in all presets, and many businesses legitimately send encrypted files. If yours doesn't, turning it on closes the "password is in the email" trick we describe in how to avoid phishing attachments.

Before you touch any of this

1. Sort out SPF, DKIM and DMARC for every domain you send from, and unused ones too. Microsoft says threat policies work best when your domains are correctly authenticated.
2. Run an assessment. The free ORCA PowerShell module (Get-ORCAReport) compares your tenant with these recommendations.
3. Tell the help desk first. Moving to Quarantine will catch some real mail in its first week. Have a plan for release requests, and use the Submissions page to report mistakes instead of adding broad allow entries.
4. Roll out in stages. A pilot group for a week or two lets you add your trusted senders before everyone's affected.

What these settings can't do

They only cover Microsoft 365 mail, Teams and Office apps. They won't see a phishing link in a personal Gmail tab, a LinkedIn message or a search ad. And they can't stop someone typing a password into a fake page once they reach it, which is why this pairs well with phishing-resistant MFA. We cover that browser gap in how to tell if a Microsoft 365 login page is fake. For comparing the wider market, see anti-phishing tools for small business.

Frequently asked questions

What is the recommended phishing threshold in Defender for Office 365?

Microsoft recommends 3 (More aggressive) in the Standard preset and 4 (Most aggressive) in Strict. The default value is 1 (Standard).

Should I use Dynamic Delivery or Block for Safe Attachments?

Microsoft's Standard and Strict presets use Block. Dynamic Delivery delivers the message straight away with placeholders, which avoids delay, but it works only with Exchange Online mailboxes and has some gaps. Consider it for teams where a delay causes real problems.

Why do impersonation emails still reach the inbox with Defender for Office 365?

By default, user and domain impersonation protection isn't set up and takes no action. Even in presets, you need to add the users and domains to protect. Check those lists first.

Do Standard and Strict preset policies override custom policies?

Yes. Strict applies first, then Standard, then custom policies, then the default policies and Built-in protection. Only the first matching policy of each type applies, and settings aren't merged.

Sources

• Microsoft Learn: Recommended settings for email and collaboration security (updated 10 August 2026)
• Microsoft Learn: Safe Attachments (Block vs Dynamic Delivery)
• Microsoft Learn: Order and precedence of email protection
• Microsoft Learn: Why do I need Defender for Office 365?

Last updated: 5 November 2026