> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender.md).

# Defender

Deploy and manage Microsoft Defender for Office 365 email-security policies across your clients' tenants, using reusable templates instead of configuring each tenant by hand in the Microsoft Defender portal.

Augmentt manages five Exchange Online Protection / Defender for Office 365 policy types, all found under **Secure > Defender**:

* **Safe Links**
* **Safe Attachments**
* **Anti-phishing**
* **Anti-spam** (inbound and outbound are configured separately, but sit under one **Anti-spam** menu)
* **Anti-malware**

{% hint style="info" %}
This is Defender for **Office 365** (email and collaboration security) — Safe Links, Safe Attachments, anti-phishing, and the two anti-spam policy types all require **Defender for Office 365 Plan 1** at minimum. Plan 1 is included with Microsoft 365 Business Premium and available as a standalone add-on on top of Office 365 E3; Plan 2 is included with Microsoft 365 E5 / E5 Security. Anti-malware is part of standard Exchange Online Protection and needs no additional Defender license. This page does not cover Defender for Endpoint (device/malware protection on the endpoint itself) — that's managed separately.
{% endhint %}

Defender is organized into two tabs:

* **Templates** — where you build the reusable configurations you'll deploy.
* **Policies** — where you deploy a template (or a baseline of templates) to a specific tenant, and see what's currently live there.

## Templates: the reusable building block

A **template** is a saved Defender policy configuration — not yet deployed anywhere — that you can push out to any number of client tenants later. Building your template library once means you're not reconfiguring the same Safe Links or anti-phishing settings by hand in every tenant's Defender portal.

You get templates two ways:

* **Start from Augmentt's out-of-the-box templates** — Augmentt ships default templates for each policy type built on security best practices (for example, "Anti-Phishing - More Aggressive" and "Anti-Phishing - Most Aggressive" presets), so you can deploy a sensible baseline without building anything yourself.
* **Import a policy you've already configured in a tenant** — capture a real, working configuration as a reusable template.

### Creating a template from an existing tenant policy

1. Go to **Secure > Defender > Templates** and click **Create New > Template**.
2. Select the **tenant** and the **policy type** (Safe Links, Safe Attachments, Anti-phishing, Anti-malware, or one of the Anti-spam types).
3. Select the specific Defender policy in that tenant you want to import. Built-in/default Microsoft policies that can't be turned into a template are filtered out of this list — you need a real, named policy to import.
4. Give the template a name and, optionally, a description.
5. Click **Create**.

The template is now stored in Augmentt, independent of the tenant it came from, and available to deploy anywhere.

### Baselines: grouping templates together

A **baseline** (called a policy template *group* internally, and labeled **Policy baseline** / **Baseline** in the UI) is a bundle of your policy templates — typically one of each type — that you deploy together in a single action instead of deploying five separate policies one at a time.

To create one:

1. Go to **Secure > Defender > Templates** and click **Create New > Baseline**.
2. Select the policy templates to include.
3. Name the baseline.
4. Click **Create**.

You can build multiple baselines for different situations — for example, a stricter baseline for regulated clients and a lighter one for standard SMB clients.

{% hint style="info" %}
Templates and baselines aren't exclusive to the Defender page. The same underlying policy-template platform backs Conditional Access, Intune (device configuration, compliance, app protection, and more), Purview, Groups, and Teams policy management — Defender is one of several policy types the template/baseline mechanism supports.
{% endhint %}

## Policies: deploying to a tenant

The **Policies** tab is where a template or baseline actually becomes a live setting in a client's tenant, and where you see what Defender policies currently exist there (including Microsoft's own **built-in protection** policies, which Augmentt shows read-only for reference).

### Deploying a single policy

1. Go to **Secure > Defender > Policies** and select the target tenant.
2. Click **Create New**, choose **Policy**, and click **Next** — this opens the **Deploy Defender Policy** wizard.
3. **Selection** — pick the policy type and the template to deploy.
4. **Deployment settings** — this is where you scope the policy: include or exclude specific **users**, **groups**, or **domains**, or apply it to all recipients tenant-wide with no scoping. You can't put the same user, group, or domain in both the include and exclude lists.
5. **Review** — check the resolved configuration and target scope before committing.
6. Click **Deploy Policy** to submit.

### Deploying a baseline

1. From **Secure > Defender > Policies**, click **Create New**, choose **Baseline**, and click **Next** — this opens the **Deploy Defender Baseline** wizard.
2. Pick the baseline to deploy.
3. Configure deployment settings for the templates in it, review, and submit.

Each policy in the baseline is deployed as its own independent create operation — the review step reports success or failure per template, so if one policy in the baseline fails to deploy (a scoping conflict, for instance), the others in the baseline can still succeed.

{% hint style="info" %}
You can also launch a Defender template deployment directly from a failing Defender-related check on **Compliance Audit**'s Configure tab — it opens the same Deploy Defender Policy wizard pre-loaded with Augmentt's recommended template, skipping straight to the deployment-settings step.
{% endhint %}

### What happens after you click Deploy

Deployment isn't a direct, synchronous API call from your browser to Microsoft. Augmentt queues the deployment as a background task against the customer's tenant, which then:

1. Authenticates to the tenant's Exchange Online using the credentials from its Microsoft 365 integration.
2. Runs the equivalent of the Exchange Online PowerShell `New-<PolicyType>Policy` cmdlet to create the policy itself (for example `New-SafeLinksPolicy`, `New-AntiPhishPolicy`, `New-MalwareFilterPolicy`).
3. Waits for Exchange Online to finish propagating the new policy, then runs the matching `New-<PolicyType>Rule` cmdlet to create the rule that actually scopes and activates it — a policy without its rule exists in the tenant but stays effectively invisible and inactive.
4. If the rule step fails after the policy was already created, Augmentt automatically removes the orphaned policy rather than leaving a stray, unscoped policy behind — so a failed deployment doesn't need manual cleanup in the tenant.

This confirms two things worth knowing when something looks off: a "deployed" policy is really a policy-plus-rule pair under the hood, and deployment happens against **Exchange Online**, which means it needs an Exchange-capable admin role on the connection (see Troubleshooting below).

## Compliance: how Defender posture is measured

"Compliance" for Defender means two different things depending on the check:

* **Most Defender-related checks are sourced from Microsoft Secure Score.** Augmentt reads Microsoft's own Secure Score recommendation state for that control. Microsoft's Secure Score has a documented **24–72 hour propagation delay** between a real change in the tenant and that change showing up in the score — so a policy you just deployed can correctly show as non-compliant for up to three days even though the configuration is already live.
* **A small number of checks are evaluated directly against the tenant's live Exchange Online policy data**, independent of Secure Score's refresh cycle — for example, comprehensive attachment filtering (malware filter policy coverage against a reference extension list), inbound anti-spam allowed-domain hygiene, and outbound anti-spam message-limit thresholds. These reflect the tenant's actual policy configuration as of Augmentt's last ingestion, not Secure Score's cache, so they can catch up faster than the 24–72 hour Secure Score window — though they still depend on Augmentt's own ingestion cycle having run.

Either way, "compliant" is a comparison against a **template's target settings**, not an abstract policy grade — the same [Posture Templates](/modules/secure/security-posture/posture-templates.md) / [Compliance Audit](/modules/secure/security-posture/compliance-audit.md) relationship used elsewhere in Secure applies here. Deploying a template is how you remediate a non-compliant Defender check; a check's Configure tab (see the hint above) is the fastest way to jump straight from a failing check into deploying the fix.

## Troubleshooting deployment and compliance issues

**Policy deployment fails with Forbidden / 403.** This is almost always a permissions problem, not a bad policy configuration. Work through these in order:

1. **Admin role on the connection** — Defender policy writes need **Global Administrator**, **Security Administrator**, or **Exchange Administrator** on the Microsoft 365 connection's service account (Exchange Administrator is enough for Safe Links / Safe Attachments / anti-phishing writes specifically). Security Reader or Global Reader can read but not write. Check and, if needed, promote the role under **Configuration > Integrations**.
2. **Integration type's permissions** — CSP integrations with AdminAgents membership carry the broadest grant. For GDAP or direct integrations, check the M365 connection's health indicator in **Configuration > Integrations**; a revoked GDAP relationship or a demoted service account on a direct integration will surface as Forbidden on write.
3. **Defender licensing in the tenant** — Microsoft returns a Forbidden/authorization error (not a licensing error) when the tenant lacks the required Defender license, which is why this often gets misdiagnosed as a permissions bug. Confirm the tenant holds Defender for Office 365 Plan 1 or higher for Safe Links, Safe Attachments, anti-phishing, and the anti-spam policy types.
4. **Overall connection health** — if the above are all fine, check the integration's connection health indicator for stale consent or a revoked token.

**A recommendation still shows Partially Compliant after you made the change.** Before assuming Augmentt is wrong:

1. Rule out the **Secure Score propagation window** first — compare the same recommendation in the Microsoft Defender portal's own Secure Score; if it agrees with Augmentt, you're just waiting out the 24–72 hour window.
2. Check whether the recommendation is a **composite** of several sub-settings (a common example: an anti-phishing recommendation needing impersonation protection *and* mailbox intelligence *and* Quarantine as the action) — fixing one sub-setting only partially moves the roll-up.
3. Check the policy's **user/group/domain scope** — a policy deployed to a pilot group only will read as Partially Compliant even if its settings are perfect, because Secure Score expects full coverage.
4. Force a posture refresh in Augmentt if the cached view seems stale.

**A check shows Not Measured.** This means Augmentt didn't receive a value from Microsoft for that check on the last ingestion — it does not mean the control is failing. Check, in order: the tenant's Defender licensing, whether Microsoft's own Secure Score also shows Not Measured for that control (a Microsoft-side gap, not an Augmentt one), whether Augmentt's last ingestion cycle actually reached the tenant (connection health, Graph throttling, a customer-side Conditional Access policy blocking the service account), and finally known Microsoft-side error states (recently renamed controls, GCC High/sovereign-cloud migration windows, or a license that hasn't finished provisioning).

{% hint style="warning" %}
If you're escalating a deployment or compliance issue to Augmentt Support, include the tenant ID, the exact check or policy name, the state you're seeing, when you made the change, the integration type and admin role on the connection, and whether Microsoft's own Secure Score agrees with what Augmentt shows. That last point in particular tells Support whether this is a Microsoft-side delay or something to actually investigate.
{% endhint %}

## In this section

* [Safe Links](/modules/secure/defender/safe-links.md)
* [Safe Attachments](/modules/secure/defender/safe-attachments.md)
* [Anti-phishing](/modules/secure/defender/anti-phishing.md)
* [Anti-spam (inbound)](/modules/secure/defender/anti-spam-inbound.md)
* [Anti-spam (outbound)](/modules/secure/defender/anti-spam-outbound.md)
* [Anti-malware](/modules/secure/defender/anti-malware.md)

Each page covers that policy type's full configuration surface, Augmentt's default template(s) with exact values, and the posture/Secure Score check(s) each default resolves.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/defender.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.