Week 3, Day 3 — Anti-spam, anti-phishing & email hygiene

Day 2 review & the threat landscape

• Ask: "Walk me through what DMARC does when an email fails both SPF and DKIM checks — with your current p=none policy" — verify comprehension before building on it
• Ask: "DKIM and DMARC protect against domain spoofing. What attack does SPF + DKIM + DMARC NOT protect against?" — prime the answer: a legitimate-looking phishing email sent from a different domain entirely, or malicious attachments from a trusted sender whose account is compromised
• Frame the day: authentication controls who can claim to be from your domain. Today's controls deal with what arrives in the inbox — spam classification, phishing detection, and scanning attachments and links for malware before they reach users
• Good news: today's entire lab is fully available on Business Standard — no licence gate, no deferred features

EOP, Defender for Office 365, and the email protection stack

Microsoft's email protection has two layers. Students need to understand both before configuring either.

• Exchange Online Protection (EOP) — the baseline layer — included with every Exchange Online licence. Handles anti-spam filtering, anti-malware scanning, connection filtering (block/allow by IP), and spoofing protection. All inbound mail passes through EOP before reaching any mailbox. EOP policies are configured in the Microsoft Defender portal (security.microsoft.com) under Email & collaboration → Policies & rules.
• Microsoft Defender for Office 365 Plan 1 — the advanced layer — included in Business Standard. Adds Safe Attachments, Safe Links, and anti-phishing policies with impersonation protection. These work on top of EOP — EOP filters first, then Defender's advanced protections apply to what passes through.
• Anti-spam policies — key settings admins control:

• Anti-phishing policies — impersonation protection: Defender for Office 365 anti-phishing policies protect against attackers impersonating specific users (CEO, CFO, IT admin) or domains that users trust. Key settings: protected users (specific email addresses to watch), protected domains (domains to watch for impersonation), mailbox intelligence (uses Microsoft's graph of user communication patterns to detect unusual senders), and spoof intelligence (detects when external senders try to appear as internal users).
• Safe Attachments — zero-hour detonation: Attachments are opened in a sandbox environment before delivery. If the attachment behaves maliciously in the sandbox, it is blocked. This catches zero-day malware that signature-based AV doesn't recognise. Adds a small delivery delay — typically seconds but can be minutes. Modes: Off, Monitor (deliver and log), Block (quarantine if malicious), Dynamic Delivery (deliver message body immediately, replace attachment with placeholder until scanning completes).
• Safe Links — time-of-click URL rewriting: URLs in email are rewritten to route through Microsoft's scanning proxy. When a user clicks a link, it is checked against a real-time threat intelligence feed at that moment — even if the URL was clean when the email was delivered. If the link has since become malicious, the user is blocked. Safe Links also scans URLs in Teams messages and Office documents.
• Quarantine management: Quarantined messages are held in Microsoft's quarantine centre. Admins can review, release, or delete quarantined messages. Users can be given self-service access to release their own quarantined mail (except high-confidence phishing). Quarantine retention: 30 days by default.

Lab 3-C: Configuring email protection for Lakeview Logistics

Students configure anti-spam, anti-phishing, Safe Attachments, Safe Links, and quarantine policies — building a complete email hygiene stack for Lakeview Logistics. Everything is fully functional on Business Standard.

• Step 1 — Explore the Microsoft Defender portal (5 min)
  Navigate to security.microsoft.com. Explore the left navigation: Email & collaboration → Policies & rules → Threat policies. Locate Anti-spam, Anti-phishing, Anti-malware, Safe Attachments, and Safe Links. Note which policies already exist as defaults and record their names in your Lab Journal.
• Step 2 — Review and tune the default anti-spam policy (10 min)
  Open the Default anti-spam inbound policy. Review every setting. Make the following adjustments:
  · Bulk email threshold: change from default to 6
  · Spam action: confirm set to Move to Junk Email folder
  · High confidence spam action: set to Quarantine message
  · Phishing action: set to Quarantine message
  · High confidence phishing: set to Quarantine message
  · Retain spam in quarantine for: confirm 30 days
  Save the policy. Record all values in your Lab Journal.
• Step 3 — Create a custom anti-phishing policy for executive protection (15 min)
  In Threat policies → Anti-phishing → + Create. Name it: Lakeview Logistics — Executive Protection.
  · Users to protect: Sarah Chen, Marcus Webb, Priya Nair (the three most impersonation-targeted roles)
  · Domains to protect: add your subdomain
  · Actions → If user impersonation detected: Quarantine the message
  · Actions → If domain impersonation detected: Quarantine the message
  · Mailbox intelligence: On
  · Intelligence for impersonation protection: On
  · Spoof intelligence: On
  · Applied to: your domain (all users)
  Save the policy.
• Step 4 — Configure Safe Attachments (10 min)
  In Threat policies → Safe Attachments → + Create. Name it: Lakeview Logistics — Safe Attachments.
  · Safe Attachments unknown malware response: Dynamic Delivery (delivers the message body immediately, replaces attachment with placeholder during scanning)
  · Quarantine policy: AdminOnlyAccessPolicy
  · Applied to: your domain
  Save. Also enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams in the global settings.
• Step 5 — Configure Safe Links (10 min)
  In Threat policies → Safe Links → + Create. Name it: Lakeview Logistics — Safe Links.
  · On: Safe Links checks a list of known, malicious links when users click links in email: On
  · Apply Safe Links to email messages sent within the organisation: On
  · Apply real-time URL scanning for suspicious links and links that point to files: On
  · Do not let users click through Safe Links to original URL: On
  · Display the organisation branding on notification pages: On
  · Applied to: your domain
  Save.
• Step 6 — Review quarantine and create a dmarc-reports shared mailbox (10 min)
  Navigate to security.microsoft.com → Email & collaboration → Review → Quarantine. Explore the quarantine centre — note the filters available and the actions possible on quarantined messages.
  
  Then in the EAC, create a shared mailbox:
  · Display name: DMARC Reports
  · Email address: dmarc-reports@[yoursubdomain]
  · Members: Sarah Chen (the IT Manager should receive and review DMARC reports)
  This completes the DMARC reporting setup from Lab 3-B — reports sent to this address will now reach a real mailbox.

⭐ Bonus: Threat Explorer & attack simulation

Reflection & preview

• Ask: "Safe Attachments is set to Dynamic Delivery. A user receives an email with an attached Excel file. Describe exactly what the user experiences — what do they see in their inbox and what happens when they try to open the attachment before scanning completes?"
• Ask: "The executive protection policy quarantines impersonation attempts. Sarah Chen receives a legitimate email from a new supplier whose domain looks similar to an existing one and it gets quarantined. What is the admin process to release it and prevent recurrence?"
• Ask: "What is the difference between EOP and Defender for Office 365 — if a customer only has Exchange Online Plan 1 with no Defender licence, which protections do they still have?"
• Collect exit ticket: explain what Safe Links does at the moment a user clicks a link — not when the email arrived, but at the moment of click — and why this timing matters
• Preview Day 4: the email hygiene layer is in place. Day 4 shifts to transport rules — using Exchange mail flow rules to enforce business policy: disclaimers, external email warnings, content-based routing, and an introduction to message retention