# The best anti-phishing settings in Microsoft Defender for Office 365

> Microsoft's recommended anti-phishing, Safe Links and Safe Attachments settings for Defender for Office 365, plus the steps presets don't do for you.

Canonical: https://www.phishclean.com/blog/microsoft-defender-office-365-anti-phishing-settings
Last updated: 2026-11-05

November 5, 2026 - 6 min read

By PhishClean Research Team

Microsoft publishes its recommended values, so you don't have to guess. Here they are in one place, with the settings presets leave for you to fill in, and the catch in that popular Dynamic Delivery advice.

Ask for the best anti-phishing settings in Defender for Office 365 and you'll probably hear: "Enable Safe Attachments with Dynamic Delivery and Safe Links with URL detonation at time of click." That's half right. Safe Links with real-time scanning is what Microsoft recommends. Dynamic Delivery is a valid choice with a trade-off, but it isn't the recommended value. Microsoft's Standard and Strict presets both use **Block**.

The values below come from Microsoft's recommended settings page, last updated 10 August 2026. Microsoft changes these from time to time, so check there before an audit.

## The fast route: preset security policies

Unless you have a specific reason, use the **Standard** preset for everyone and **Strict** for high-value accounts such as executives, finance and admins. Microsoft updates presets as its recommendations change, and they save you from setting dozens of values by hand.

Watch the order of precedence. Strict applies first, then Standard, then custom policies, then the default policies and Built-in protection. Only the first matching policy of each type applies, with no merging of settings. So if someone is in Standard, your carefully tuned custom anti-phishing policy is ignored for them.

**Presets don't finish the job.** You still have to tell them which users and domains to protect from impersonation. Until you do, nobody's CEO is on the list. This is the most commonly missed step.

## Anti-phishing policy values

Everything in this table except spoofing and first-contact tips needs Defender for Office 365. In anti-phishing policies, the built-in protection for all cloud mailboxes covers spoofing only.

| Setting | Default | Standard | Strict |
| --- | --- | --- | --- |
| Phishing email threshold | 1 - Standard | 3 - More aggressive | 4 - Most aggressive |
| Enable users to protect | Off | On, your list | On, your list |
| Include domains I own | Off | On | On |
| Include custom domains | Off | On, your list | On, your list |
| Enable mailbox intelligence | On | On | On |
| Enable intelligence for impersonation protection | Off | On | On |
| User impersonation action | No action | Quarantine | Quarantine |
| Domain impersonation action | No action | Quarantine | Quarantine |
| Mailbox intelligence impersonation action | No action | Junk Email folder | Quarantine |
| Spoof intelligence | On | On | On |
| Spoof action | Junk Email folder | Junk Email folder | Quarantine |
| Honor DMARC policy | On | On | On |
| First contact safety tip | Off | On | On |
| Impersonation safety tips (user, domain, unusual characters) | Off | On | On |

Look at the Default column. Out of the box, impersonation detections take no action at all, which is why a tenant can have Defender licenses and still deliver a fake CEO email to the inbox.

### What to put in the lists

- **Users to protect:** Microsoft suggests senders in key roles, such as your CEO, CFO and senior leaders, and external people like board members.
- **Custom domains:** domains you don't own but deal with often, such as your main suppliers, law firm and bank.
- **Trusted senders:** add only those wrongly flagged as impersonation, after checking they're real.

## Safe Links values

| Setting | Built-in protection | Standard and Strict |
| --- | --- | --- |
| Safe Links on for email, Teams and Office apps | On | On |
| Apply to messages sent within the organization | Off | On |
| Real-time URL scanning for suspicious links and links to files | On | On |
| Wait for URL scanning before delivering the message | On | On |
| Don't rewrite URLs, check via API only | On | Off (URLs are rewritten) |
| Track user clicks | On | On |
| Let users click through to the original URL | On | Off |

Internal scanning is worth a second look if you run custom policies. A hacked employee's mailbox is a favorite launchpad, and those messages come from inside your organization.

## Safe Attachments: Block or Dynamic Delivery?

Here's the difference, from Microsoft's documentation:

|  | Block (recommended) | Dynamic Delivery |
| --- | --- | --- |
| What the user sees | The message arrives after scanning | The message arrives right away, with a placeholder for each attachment until it's cleared |
| Delay | Safe messages might be delayed. Scanning typically finishes within 15 minutes, and sometimes takes longer. | No delay for the message body |
| Malicious file | Message is quarantined, and future copies are blocked automatically | Message is quarantined |
| Where it works | Everywhere Safe Attachments applies | Exchange Online mailboxes only |
| Known gaps | None specific | Placeholders can't be applied in public folders, messages moved by inbox rules, messages moved out of the mailbox, S/MIME-encrypted messages and some other cases |

If people complain about delays on time-critical mail, Dynamic Delivery is a sensible custom-policy choice for those teams. A safe setup is to start with the preset's Block and create exceptions only when the delay is a demonstrated problem. Remember that custom policies only apply to people who aren't in a preset.

One more option to consider: Safe Attachments can quarantine password-protected attachments it can't scan. It's off in all presets, and many businesses legitimately send encrypted files. If yours doesn't, turning it on closes the "password is in the email" trick we describe in [how to avoid phishing attachments](https://www.phishclean.com/blog/how-to-avoid-phishing-attachments).

## Before you touch any of this

1. **Sort out SPF, DKIM and DMARC** for every domain you send from, and unused ones too. Microsoft says threat policies work best when your domains are correctly authenticated.
2. **Run an assessment.** The free ORCA PowerShell module (`Get-ORCAReport`) compares your tenant with these recommendations.
3. **Tell the help desk first.** Moving to Quarantine will catch some real mail in its first week. Have a plan for release requests, and use the Submissions page to report mistakes instead of adding broad allow entries.
4. **Roll out in stages.** A pilot group for a week or two lets you add your trusted senders before everyone's affected.

## What these settings can't do

They only cover Microsoft 365 mail, Teams and Office apps. They won't see a phishing link in a personal Gmail tab, a LinkedIn message or a search ad. And they can't stop someone typing a password into a fake page once they reach it, which is why this pairs well with [phishing-resistant MFA](https://www.phishclean.com/blog/what-is-phishing-resistant-mfa). We cover that browser gap in [how to tell if a Microsoft 365 login page is fake](https://www.phishclean.com/blog/how-to-tell-if-a-microsoft-365-login-page-is-fake). For comparing the wider market, see [anti-phishing tools for small business](https://www.phishclean.com/blog/best-anti-phishing-tools-small-business).

## Frequently asked questions

### What is the recommended phishing threshold in Defender for Office 365?

Microsoft recommends 3 (More aggressive) in the Standard preset and 4 (Most aggressive) in Strict. The default value is 1 (Standard).

### Should I use Dynamic Delivery or Block for Safe Attachments?

Microsoft's Standard and Strict presets use Block. Dynamic Delivery delivers the message straight away with placeholders, which avoids delay, but it works only with Exchange Online mailboxes and has some gaps. Consider it for teams where a delay causes real problems.

### Why do impersonation emails still reach the inbox with Defender for Office 365?

By default, user and domain impersonation protection isn't set up and takes no action. Even in presets, you need to add the users and domains to protect. Check those lists first.

### Do Standard and Strict preset policies override custom policies?

Yes. Strict applies first, then Standard, then custom policies, then the default policies and Built-in protection. Only the first matching policy of each type applies, and settings aren't merged.

[Anti-phishing tools for small businessFive options compared for SMBs and MSSPs.](https://www.phishclean.com/blog/best-anti-phishing-tools-small-business) [Is that Microsoft 365 login page fake?What to check when a link gets past the filter.](https://www.phishclean.com/blog/how-to-tell-if-a-microsoft-365-login-page-is-fake) [Phishing-resistant MFA, explainedThe control that matters after a click.](https://www.phishclean.com/blog/what-is-phishing-resistant-mfa) [Email header analyzerRead SPF, DKIM and DMARC results.](https://www.phishclean.com/tools/email-header-analyzer)

## Sources

- [Microsoft Learn: Recommended settings for email and collaboration security](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365) (updated 10 August 2026)
- [Microsoft Learn: Safe Attachments](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about) (Block vs Dynamic Delivery)
- [Microsoft Learn: Order and precedence of email protection](https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined)
- [Microsoft Learn: Why do I need Defender for Office 365?](https://learn.microsoft.com/en-us/defender-office-365/mdo-about)

## Cover the tabs Defender can't see

PhishClean warns on fake Microsoft sign-in pages in the browser, wherever the link came from, and IT can deploy it by policy.

[See PhishClean for Teams](https://www.phishclean.com/business)

Last updated: 5 November 2026