> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/anti-phishing.md). # Anti-phishing Anti-phishing is Defender for Office 365's policy type for detecting and acting on impersonation-based attacks — a message that pretends to be a specific person (your CEO, a known contact), a specific domain (your own domain, or a well-known brand like Microsoft or PayPal), or that fails email-authentication checks (SPF/DKIM/DMARC) in a way that suggests spoofing. It's the broadest and most heavily-configured of the six Defender policy types. {% hint style="info" %} Anti-phishing requires **Defender for Office 365 Plan 1** at minimum. See the main [Defender](/modules/secure/defender.md) page for how templates, baselines, and deployment work generally. {% endhint %} ## What you can configure **Threshold and protection** * **Phishing email threshold** (`PhishThresholdLevel`) — how aggressively Defender's AI treats a message as phishing, from `1` (Standard) up to `4` (Most aggressive). Higher settings catch more phishing but raise the false-positive rate. * **User impersonation protection** (`EnableTargetedUserProtection` / `TargetedUsersToProtect`) — protect specific named individuals (typically executives) from being impersonated by look-alike sender names or addresses. * **Domain impersonation protection** (`EnableTargetedDomainsProtection` / `TargetedDomainsToProtect`, plus `EnableOrganizationDomainsProtection` for your own domain(s)) — protect specific domains — your own, and/or well-known external brands — from being impersonated. * **Trusted impersonated senders/domains** (`ExcludedSenders` / `ExcludedDomains`) — an exception list, exempting specific senders or domains from impersonation checks. * **Mailbox intelligence** (`EnableMailboxIntelligence`) — learn each user's normal contacts and communication patterns to spot anomalies, with a sub-toggle **Enable intelligence for impersonation protection** (`EnableMailboxIntelligenceProtection`) that lets mailbox intelligence actually act on what it learns, not just observe. * **Spoof intelligence** (`EnableSpoofIntelligence`) — Microsoft's cross-tenant intelligence on senders spoofing your domain or others. * **Impersonation protection mode** (`ImpersonationProtectionState`) — `Automatic` (Microsoft's AI decides who to protect) vs `Manual` (only the named users/domains you configured). **Actions** * **If user impersonation is detected** (`TargetedUserProtectionAction` / `TargetedUserActionRecipients`) — the response action (Quarantine, Move to Junk, Redirect, etc.) and, for Redirect, who receives the redirected copy. * **If domain impersonation is detected** (`TargetedDomainProtectionAction` / `TargetedDomainActionRecipients`) — same, for domain impersonation. * **If mailbox intelligence detects impersonation** (`MailboxIntelligenceProtectionAction` / recipients) — same, for mailbox-intelligence-flagged messages. * **Honor DMARC record policy** (`HonorDmarcPolicy`) — respect the sending domain's own published DMARC policy, with separate actions for what to do **if the DMARC policy says quarantine** (`DmarcQuarantineAction`) vs **if it says reject** (`DmarcRejectAction`) — both use the quarantine policy set for spoof detections (`SpoofQuarantineTag`). * **If spoof intelligence detects a spoofed sender** (`AuthenticationFailAction`, using `SpoofQuarantineTag`) — the action when a message fails SPF/DKIM/DMARC authentication in a way Defender's spoof intelligence flags as likely spoofing. * **Safety tips** — several independent toggles that add a warning banner to a suspicious message rather than blocking it: first-contact senders (`EnableFirstContactSafetyTips`), similar-user impersonation (`EnableSimilarUsersSafetyTips`), similar-domain impersonation (`EnableSimilarDomainsSafetyTips`), unusual characters in a display name (`EnableUnusualCharactersSafetyTips`), and unauthenticated-sender marking, shown as a question-mark icon next to the sender (`EnableUnauthenticatedSender`). * **Show "via" tag** (`EnableViaTag`) — display a `via domain.com` tag next to the sender name when the message's From address and sending infrastructure don't match, making spoofing more visible to the recipient. ## Augmentt's default templates Augmentt ships two out-of-the-box anti-phishing templates, both built on Microsoft's own preset tiers: ### Anti-Phishing - More Aggressive Corresponds to Microsoft's **Standard** preset security policy tier. | Setting | Value | | ----------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | Phishing threshold | 3 | | Domain impersonation protection | On — protects 8 well-known brand domains: microsoft.com, paypal.com, amazon.com, google.com, apple.com, facebook.com, linkedin.com, twitter.com | | Organization domains protection | On | | User impersonation protection | Off (no named users configured) | | Impersonation protection mode | Manual | | Mailbox intelligence | On | | Mailbox intelligence protection | On | | Spoof intelligence | On | | Honor DMARC policy | On | | If DMARC says quarantine | Quarantine | | If DMARC says reject | Reject | | If spoof intelligence detects spoofing | Quarantine | | If user impersonation detected | Quarantine | | If domain impersonation detected | Quarantine | | If mailbox intelligence detects impersonation | Quarantine | | Quarantine policy (impersonation/mailbox intelligence) | AdminOnlyAccessPolicy | | Quarantine policy (user/domain impersonation) | DefaultFullAccessPolicy | | Safety tips (first-contact, similar-user, similar-domain, unusual-characters) | All On | | Unauthenticated sender marking | On | | Show "via" tag | On | ### Anti-Phishing - Most Aggressive Corresponds to Microsoft's **Strict** preset security policy tier — same structure as More Aggressive, with a higher threshold, a longer protected-domain list, and fully-automatic impersonation detection. | Setting | Value | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Phishing threshold | 4 | | Domain impersonation protection | On — protects 17 domains: the 8 above plus dropbox.com, docusign.com, salesforce.com, zoom.us, teams.microsoft.com, sharepoint.com, onedrive.com, office.com, outlook.com | | Impersonation protection mode | **Automatic** (vs Manual on More Aggressive) | | Everything else | Same as More Aggressive above | **Resolves posture check(s):** (applies to both default templates, at their respective aggressiveness levels) * **MDOANTIPHISHINGPOLICIES** — Secure-Score-sourced check confirming an anti-phishing policy exists and is enabled. Mapped to CMMC Level 1 (SI.L1-b.1.xiii), CMMC Level 2 (SI.L2-3.14.2), HIPAA §164.308(a)(5)(ii)(B), and NIST CSF 2.0 DE.CM-09. * **CIS\_M365 §2.1.7 — "Ensure that an anti-phishing policy has been created"** (CIS Microsoft 365 Foundations Benchmark v6/v7, Level 2). * **MDOPHISHTHRESHOLDLEVEL** — checks the threshold value itself; Most Aggressive (level 4) satisfies a stricter bar than More Aggressive (level 3). * **MDOENABLEDOMAINSTOPROTECT** — checks that impersonation-protected domains are configured; both templates pass, with Most Aggressive covering more domains. * **MDOENABLEMAILBOXINTELLIGENCE** and **MDOMAILBOXINTELLIGENCEPROTECTION** — mailbox intelligence enabled and actively protecting. * **MDOTARGETEDUSERSPROTECTION**, **MDOTARGETEDDOMAINPROTECTIONACTION**, **MDOTARGETEDUSERPROTECTIONACTION** — the impersonation-action sub-checks; all resolve to Quarantine in both templates. * **MDOSIMILARDOMAINSSAFETYTIPS**, **MDOSIMILARUSERSSAFETYTIPS**, **MDOUNUSUALCHARACTERSSAFETYTIPS** — the individual safety-tip checks, all on in both templates. {% hint style="warning" %} An anti-phishing recommendation in Compliance Audit is frequently a **composite** of several of the sub-checks above (threshold *and* impersonation protection *and* the Quarantine action, for example). Fixing only one sub-setting by hand in the tenant — rather than deploying the whole template — will often leave the roll-up at Partially Compliant. See the main [Defender](/modules/secure/defender.md) page's Troubleshooting section. {% endhint %} ## Deploying and troubleshooting Deployment mechanics are the same across Defender policy types — see the main [Defender](/modules/secure/defender.md) page. Anti-phishing needs at least **Exchange Administrator** on the connection to write. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/defender/anti-phishing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.