Apply Microsoft’s Standard or Strict email protection presets to the right users and review the effect on mail handling.
Choose the protection level
Microsoft’s Standard and Strict presets apply maintained email security settings. Strict is more aggressive and can flag more legitimate mail, so use it for highly targeted users only if an administrator can review release requests. The Microsoft step-by-step guide lists Defender for Office 365 Plan 1 or higher and a Security Administrator role as prerequisites.
Configure Standard protection
- In Microsoft Defender at https://security.microsoft.com, open Email & collaboration → Policies & rules → Threat policies → Preset security policies.
- Select Manage for Standard protection.
- Choose all recipients or specific users, groups, or domains for the built-in protection and Defender for Office 365 protection sections.
- Configure impersonation protection for relevant addresses and domains. Review trusted senders carefully, then confirm the policy.
Configure Strict where appropriate
Return to Preset security policies and manage Strict protection for the selected higher-risk users. Apply the same recipient and impersonation review. Check how Standard and Strict assignments interact in Microsoft’s policy documentation before overlapping groups.
Verify and maintain
Send test messages that reflect normal business mail and review quarantined or blocked messages. Assign someone to process release requests. Microsoft recommends Configuration analyzer to identify protection settings below its recommended profiles. Revisit exclusions and recipient groups as staff and mail flows change.
Sources
Microsoft Learn: Set up Standard or Strict preset policies; Microsoft Learn: Preset security policies.
