Week 7, Day 1 — Defender for Microsoft 365

Week 6 close & the threat surface gap

• Ask: "WIN-CLIENT-01 is compliant, has KFM, has the Security Baseline, is managed by Intune. What happens if a Lakeview Logistics employee receives an email with a malicious attachment and opens it on that device?" — the device is managed, but if the email lands in the mailbox and the user opens the attachment, the device management layer doesn't help. The threat entered via email, before the endpoint had a chance to act.
• Ask: "In Week 3, you configured Exchange Online mail flow rules. Do those rules scan attachments for malware?" — no. Transport rules evaluate message properties (sender, recipient, headers, keywords) but don't inspect attachment content for malware. That requires a different layer.
• Frame the week: Weeks 1–6 built the infrastructure and access controls. Week 7 adds active threat defence — scanning content as it arrives, detecting threats on devices, measuring the posture of the whole tenant, and protecting data from leaving. This is the shift from governance to security operations.
• Critical naming note to establish now: Defender for Microsoft 365 (today) protects cloud workloads — email, Teams, SharePoint. Defender for Endpoint (tomorrow) protects devices. Different products, different portals within security.microsoft.com, different licensing, different configuration. Students should be able to name both without confusing them by end of week.

Defender for Microsoft 365 — the email and collaboration security layer

Defender for M365 sits in front of the collaboration workloads students have already configured. Every email, file, and link that passes through Exchange Online, SharePoint, OneDrive, and Teams is inspected before it reaches the user.

The email security stack — what sits where

• Exchange Online Protection (EOP) — the baseline layer included in every M365 plan. Handles spam filtering, basic malware detection, spoof intelligence (detecting domains pretending to be yours), and connection filtering (blocking known bad IPs). Students already have EOP — it's been running since Week 3. Today's work adds the Defender for M365 layer on top.
• Safe Attachments — when a message with an attachment arrives, Safe Attachments detonates it in an isolated virtual machine (sandbox) before delivering it to the user. If the attachment exhibits malicious behaviour in the sandbox — drops files, makes registry changes, contacts external IPs — it is quarantined and the user receives a notification. The user never sees the original attachment. Detonation typically adds 1–5 minutes of delay to delivery. The Dynamic Delivery option sends the message body immediately while the attachment is scanned, replacing the attachment with a placeholder until scanning is complete.
• Safe Links — rewrites URLs in emails and Office documents. When a user clicks a rewritten link, Safe Links checks it against Microsoft's real-time threat intelligence at that moment — not at the time the email arrived. This catches time-of-click attacks where a URL is clean at delivery but becomes malicious hours later. If the URL is flagged as malicious at click-time, the user is shown a warning page instead of the destination.
• Anti-phishing policies — Defender for M365 adds advanced impersonation protection on top of EOP's basic spoof detection. Key protections: user impersonation (detecting emails that claim to be from specific VIP users — Sarah Chen, Marcus Webb), domain impersonation (emails from lakeview1ogistics.com instead of lakeviewlogistics.com), mailbox intelligence (learns who each user normally communicates with and flags unusual senders). Spoof intelligence is also configured here.
• Threat Explorer — the investigation tool in Defender for M365. Shows a real-time view of all email flowing through the tenant — filtered by sender, recipient, subject, threat type (malware, phish, spam), delivery action. The primary tool for investigating a reported phishing email: find the message, see where it was delivered, recall it from affected mailboxes.
• Defender for M365 covers more than email — Safe Attachments and Safe Links also protect SharePoint Online, OneDrive, and Teams. A malicious file uploaded to a SharePoint document library is scanned and blocked. A malicious link shared in a Teams chat is checked at click-time. Students who configured SharePoint and Teams in Weeks 4–5 now have threat scanning on those workloads too.

Lab 7-A: Configuring Defender for M365 threat policies

Students verify licence assignment, configure Safe Attachments with Dynamic Delivery, configure Safe Links with URL rewriting and Teams protection, harden the anti-phishing policy with impersonation protection for Lakeview Logistics VIPs, and investigate the tenant's email threat landscape in Threat Explorer.

• Step 1 — Verify Defender for M365 licence assignment (5 min)
  Navigate to admin.microsoft.com → Billing → Licences. Confirm the E5 Security trial is active and shows available licences.
  Navigate to Users → Active users → [your admin account] → Licences and apps. Confirm the Microsoft Defender for Office 365 Plan 2 licence is assigned and enabled. If not assigned, assign it now.
  Do the same for all 10 Lakeview Logistics user accounts — Safe Attachments and Safe Links policies only apply to users with the licence assigned.
• Step 2 — Review the default threat policies baseline (5 min)
  Navigate to security.microsoft.com → Email & collaboration → Policies & rules → Threat policies.
  Review the four policy types: Safe Attachments, Safe Links, Anti-phishing, Anti-malware. Note which have default policies and which are in "Standard" or "Strict" preset configurations.
  Record the current state of each policy type before making any changes.
• Step 3 — Configure the Safe Attachments policy (15 min)
  Navigate to Threat policies → Safe Attachments → + Create.
  · Name: LL — Safe Attachments
  · Safe Attachments unknown malware response: Dynamic Delivery (sends message body immediately, holds attachment during scanning)
  · Redirect messages with detected attachments: On — redirect to your admin email address
  · Apply Safe Attachments to OneDrive, SharePoint, and Teams: On
  · Applied to: all users in your domain (Recipient domain is [yoursubdomain])
  Save. Then review the Global settings tab — confirm "Turn on Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams" is enabled.
• Step 4 — Configure the Safe Links policy (12 min)
  Navigate to Threat policies → Safe Links → + Create.
  · Name: LL — Safe Links
  · Action on potentially malicious URLs in messages: On — URLs will be rewritten
  · Apply real-time URL scanning: On
  · Apply Safe Links to email messages sent within the organisation: On
  · Do not rewrite URLs in Teams: Off (i.e. Safe Links IS applied to Teams)
  · Do not track when users click Safe Links: Off (i.e. clicks ARE tracked)
  · Do not let users click through Safe Links to original URL: On (users cannot bypass the warning)
  · Applied to: Recipient domain is [yoursubdomain]
  Save.
• Step 5 — Harden the anti-phishing policy (15 min)
  Navigate to Threat policies → Anti-phishing → Office365 AntiPhish Default → Edit.
  
  Under Phishing threshold & protection:
  · Phishing email threshold: 2 — Aggressive
  · Enable users to protect (impersonation): On — add protected users:
    — Sarah Chen (sarah.chen@[yoursubdomain]) — CEO/IT Manager
    — Marcus Webb (marcus.webb@[yoursubdomain]) — Operations Director
    — Priya Nair (priya.nair@[yoursubdomain]) — Finance Manager
  · Enable domains to protect: On — Include domains I own: enabled
  · Enable mailbox intelligence: On
  · Enable intelligence for impersonation protection: On
  
  Under Actions:
  · If a message is detected as user impersonation: Quarantine the message
  · If a message is detected as domain impersonation: Quarantine the message
  · If mailbox intelligence detects an impersonation: Move message to Junk Email folder
  
  Save.
• Step 6 — Explore Threat Explorer (13 min)
  Navigate to security.microsoft.com → Email & collaboration → Explorer (or Threat Explorer).
  Review the default view — All email. Note the volume charts, the threat detection breakdown, and the delivery action columns.
  Change the view to Phish. Review any messages flagged as phishing (there may be few or none in a new tenant — this is expected).
  Change the view to Malware. Same review.
  Use the Email details flyout (click any message) to see: sender IP, authentication results (SPF, DKIM, DMARC), delivery action, detection technology, and original delivery location vs current location.
  In your Lab Journal: if Sarah Chen reported a suspicious email she received yesterday, describe the exact steps you would take in Threat Explorer to investigate and potentially recall it.

⭐ Bonus: Preset security policies and DMARC configuration

Reflection & preview

• Ask: "Safe Attachments is now configured. Priya Nair receives an email with a PDF attachment. Walk through what happens to that email between the sender clicking Send and Priya seeing it in her inbox" — sandbox detonation, Dynamic Delivery sends body first, attachment placeholder shown, attachment released if clean or quarantined if malicious
• Ask: "A phishing email slips through Safe Attachments (the link was clean at delivery) and a user clicks it 6 hours later. Safe Links then flags the URL as malicious at click-time. What does the user see?" — the Safe Links warning page blocks the navigation. The click is logged in Threat Explorer with the detection result.
• Preview Day 2: Defender for M365 protects the email and collaboration layer. Tomorrow — Defender for Endpoint — puts a sensor on the device itself. WIN-CLIENT-01 gets onboarded and we trigger a test detection to see what an alert looks like in the security portal.