CtrlShiftIT
Free IT Assessment
Microsoft 365 Security

Phishing & Email Threat Defense for Microsoft 365

Phishing accounts for the majority of SMB breaches. This guide shows the four layers — awareness, anti-phishing policy, MFA, and Conditional Access — that stop most attempts before they reach a staff inbox.

  • Configure Microsoft Defender anti-phishing properly
  • Layer awareness training, policy, and identity controls
  • Build a reporting workflow that catches what filters miss
Request a Free Security AssessmentBack to M365 Hub
15 min read Reviewed April 2026
~80%of SMB breaches begin with a phishing email
1 clickone staff member is all an attacker needs
4 layersstop most attempts before they reach an inbox

Phishing is the #1 entry point for SMB breaches

In the Microsoft 365 breach investigations we see, phishing accounts for roughly 80% of the initial access vector. The attacker does not need to break encryption or exploit a zero-day — they just need one staff member to type their password into the wrong page.

The cost is real: an average Business Email Compromise (BEC) incident costs an SMB tens of thousands of dollars in fraudulent wire transfers, plus the recovery and reputational fallout. Defending against phishing is not optional.

Defense in depth

Four protection layers for phishing defense

No single layer catches everything. Stack all four and the success rate of any given phishing attempt drops dramatically.

Layer 01

Awareness

Staff who can spot suspicious sender domains, urgency cues, and unusual requests — and who report them.

Layer 02

Policy

Microsoft Defender anti-phishing, Safe Links, Safe Attachments, and impersonation protection on key staff.

Layer 03

Identity

MFA on every account so a stolen password alone does not equal tenant access.

Layer 04

Conditional Access

Block sign-ins from impossible locations, require compliant devices for admins, and enforce session lifetimes.

Know the enemy

The threat types most SMB teams actually see

Credential phishing

Most common

A fake Microsoft, Adobe, DocuSign, or vendor login page that captures the password. Most common.

Vendor invoice fraud

A spoofed invoice from a legitimate vendor with the bank account swapped. Targets accounts payable.

Executive impersonation (CEO fraud)

A request from a "CEO" or "CFO" address asking for an urgent wire transfer or gift card purchase.

OAuth consent phishing

A link that asks the user to grant a malicious third-party app permission to read their mailbox.

Reply-chain hijacking

Attacker takes over a compromised account and replies to an existing thread with malware or a credential page.

Step by step

The Microsoft 365 anti-phishing playbook

Work top to bottom. Each step layers on the last — together they close the gaps attackers actually use.

  1. 1. Employee awareness — your first line of defense

    Filters catch most phishing, but attackers tune their messages specifically to defeat filters. The ones that get through are the ones that look legitimate enough — and that is where trained staff matter.

    • Train, do not punish: Simulated phishing campaigns should educate, not embarrass. Punishment-based training breeds non-reporting.
    • Report > delete: Use the "Report Phishing" button in Outlook. It feeds Microsoft Defender and improves filters for everyone.
    • Quarterly cadence: Run an Attack Simulation Training campaign each quarter and review results with managers.
    • Cover the new staff onboarding: Phishing awareness should be in every new-hire IT walkthrough — before they get tenant access.

  2. 2. Configure Microsoft Defender anti-phishing policy

    In the Microsoft 365 Defender portal, navigate to Email & collaboration → Policies & rules → Threat policies → Anti-phishing. Edit the default policy or create a strict policy for high-risk users.

    1. Add protected users. Add executives, finance staff, and HR — anyone who can authorize money movement or hold sensitive data.
    2. Add protected domains. Add your own domain and any subsidiary domains. Catches lookalike-domain impersonation.
    3. Set mailbox intelligence to high confidence. Move suspected impersonation to Quarantine instead of just adding a banner.
    4. Enable first-contact safety tip. Adds a banner when the sender is contacting the recipient for the first time. Useful signal for staff.
    5. Enable spoof intelligence. Lets Defender learn legitimate senders and block actual spoofing attempts.

  3. 3. Enforce multi-factor authentication

    MFA is the single most effective control against credential phishing. Even if a staff member types their password on a fake page, the attacker cannot complete the sign-in without the second factor.

    Roll out MFA in stages — pilot, communicate, then enforce. See our MFA rollout guide for a sequence that avoids locking staff out.

  4. 4. Conditional Access basics

    Conditional Access policies add context to every sign-in attempt. The most useful policies for phishing defense:

    • Require MFA for all users: The baseline policy for any Business Premium tenant.
    • Block legacy authentication: Stops the most common MFA bypass technique.
    • Require compliant device for admins: Admin sign-ins only succeed from a managed laptop or phone.
    • Block sign-ins from impossible-travel locations: Use sign-in risk policies (Azure AD Identity Protection) to require MFA or block when the location is implausible.

  5. 6. Domain authentication: SPF, DKIM, and DMARC

    These three DNS records tell other mail servers which servers are authorized to send email as your domain — making it dramatically harder for attackers to spoof you.

    1. SPF (Sender Policy Framework). Lists allowed sending servers. Include Microsoft 365 (spf.protection.outlook.com) and any third-party senders (Mailchimp, Zendesk, etc.).
    2. DKIM (DomainKeys Identified Mail). Cryptographically signs outgoing email so recipients can verify it actually came from your domain. Enable in the Defender portal.
    3. DMARC (Domain-based Message Authentication). Tells receiving servers what to do with messages that fail SPF/DKIM. Start with p=none for monitoring, then move to quarantine and reject after 4 weeks of clean reports.
If it gets through

What to do if an employee clicks a phishing link

Speed matters more than diagnostics. The longer you wait, the more the attacker can do.

  1. 1

    Revoke all active sessions

    In Azure AD, find the user, click Sign-in sessions → Revoke. Forces re-authentication everywhere.

  2. 2

    Reset the password and rotate the MFA second factor

    Issue new credentials. If the user had set up the Authenticator app on a personal device, re-enroll on a managed device.

  3. 3

    Review mailbox rules

    Attackers add inbox rules that auto-forward or delete replies. Check Outlook Rules, server-side rules, and forwarding settings.

  4. 4

    Review sign-in logs and audit logs

    Look for sign-ins from unexpected locations, file downloads, and admin role changes after the clicked time.

  5. 5

    Notify finance and customers if applicable

    If the compromised user handles invoices or customer comms, warn affected parties before fraudulent emails go out.

Stay ahead

How attackers bypass basic protections

Even a well-configured tenant has edges. These are the techniques that slip past the basics — and the control that shuts each one down.

Adversary-in-the-middle (AiTM) phishing

Real-time proxy phishing kits (Evilginx, Modlishka) capture both the password and the session cookie — bypassing MFA.

Defense: require compliant devices via Conditional Access.

OAuth consent grants

A malicious app asks the user to "Sign in with Microsoft" and grant mailbox access. The attacker now has API access without a password.

Defense: disable user consent for unverified apps.

Trusted vendor compromise

A phish from a vendor account you already trust — the attacker compromised them first.

Defense: out-of-band verification for any money movement.
Keep going

More Microsoft 365 security guides

Microsoft 365 Security Checklist for Small Businesses (2026)

A 19-control Microsoft 365 hardening checklist for Canadian small businesses: MFA, Conditional Access, legacy auth, phishing defense, endpoints, backup, and incident response.

Conditional Access Policies for Small Business

How to design, test, and enforce Conditional Access in a Microsoft 365 Business Premium tenant without locking the team out.

Rolling Out MFA Without Breaking Things

A practical rollout plan for Microsoft 365 MFA across staff, shared mailboxes, service accounts, BYOD devices, and admin accounts.

Microsoft 365 Backup for Small Business

Why OneDrive sync and the Recycle Bin are not full backups, and what small businesses should deploy for reliable Microsoft 365 recovery.

FAQ

Frequently Asked Questions

4 results
PricingHow much does Microsoft Defender for Office 365 cost?

Defender for Office 365 Plan 1 is $2/user/month (or included in Business Premium). It covers Safe Links, Safe Attachments, and anti-phishing. Plan 2 adds Attack Simulation Training and is included in Microsoft 365 E5.

CoverageWill Safe Links break legitimate URLs?

No — Safe Links rewrites the URL transparently. Users see the original URL in their email client and the rewrite only takes effect when they click. Some third-party email tools that scan rewritten URLs can get confused; whitelist the Safe Links domain in those tools.

PricingShould we use Microsoft's tools or a third-party email gateway?

For SMBs on Business Premium, Microsoft Defender for Office 365 is the cost-effective choice and integrates natively with Conditional Access and Defender for Endpoint. Third-party gateways (Proofpoint, Mimecast) add value for organizations with very high mail volume or strict compliance requirements.

CoverageHow often should we run phishing simulations?

Quarterly is the sweet spot. Monthly leads to staff feeling targeted; annually is too infrequent to build the reporting habit. Always pair the simulation with a 5-minute training video for users who fall for it.