defender-for-office-365

Name: defender-for-office-365
Author: vinayaklatthe

57installs34forks

How to install defender-for-office-365?

vinayaklatthe/microsoft-security-skills/defender-for-office-365

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-office-365

Installs into the current project.

Summary

Guidance for Microsoft Defender for Office 365 (MDO) — protection for email and collaboration (Teams, SharePoint, OneDrive) against phishing, malware, spoofing, and business email compromise. Covers Plan 1 vs Plan 2 selection, preset security policies (Standard/Strict), Safe Link

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Office 365
2
3	Microsoft Defender for Office 365 (MDO) protects email and collaboration workloads against
4	phishing, malware, spoofing, and business email compromise. It provides preset policies,
5	detonation (Safe Attachments), time-of-click URL protection (Safe Links), post-delivery
6	detection and hunting (Threat Explorer + AIR), and attack simulation training.
7
8	## When to use
9	Securing Exchange Online mail flow and Microsoft 365 collaboration (Teams, SharePoint,
10	OneDrive). Use this skill for plan/preset decisions, control configuration, drift detection,
11	and SOC operations on email incidents.
12
13	Do not use this skill for endpoint protection (`defender-for-endpoint`), broader
14	cross-workload investigation (`defender-xdr`), or SharePoint oversharing before Copilot
15	rollout (`purview-copilot-oversharing`).
16
17	## Pick the plan, then the preset
18
19	\| If you need... \| Plan / SKU \| Notes \|
20	\|---\|---\|---\|
21	\| Safe Links, Safe Attachments, anti-phish, anti-spam, anti-malware \| MDO Plan 1 \| Bundled with M365 Business Premium and E3 add-on \|
22	\| Threat Explorer, Real-time detections, AIR, attack simulation training, automated investigation \| MDO Plan 2 \| Bundled with M365 E5 / MDO P2 \|
23	\| Cross-tenant secure collaboration (B2B/B2C with MDO) \| MDO P1 or P2 \| Apply preset to guest senders too \|
24
25	\| Posture \| Preset to apply \| Who it fits \|
26	\|---\|---\|---\|
27	\| Default healthy baseline, low admin overhead \| Standard preset \| Most enterprises - apply to all users \|
28	\| High-target, regulated, or executive-heavy estate \| Strict preset \| Tier-0 admins, finance, exec mailboxes \|
29	\| Custom carve-out (e.g. vendor with broken SPF) \| Custom policy with priority above preset \| Use sparingly - documents drift risk \|
30
31	> Rule of thumb: apply Standard preset to all users as the floor, **Strict preset to
32	> high-risk groups** (executives, finance, IT admins, legal) as the ceiling. Custom policies
33	> only where presets genuinely don't fit - every custom policy is a future drift source.
34
35	## Approach
36
37	1. Confirm licensing and mail flow — Verify MDO P1 vs P2 in admin centre. Confirm
38	Exchange Online accepts mail directly (or via an upstream gateway). MDO with a third-party
39	secure email gateway (SEG) in front is a common pattern but reduces some detections - use
40	Enhanced Filtering for Connectors to preserve original sender IP.
41	Verify: `Get-EnhancedFilteringConfig` shows your inbound connector configured.
42
43	2. Enable email authentication — SPF, DKIM, and DMARC for every sending domain.
44	DMARC starts at `p=none` (monitor), moves to `quarantine`, then `reject`. Without DMARC,
45	spoofing detections are weaker.
46	Verify: DMARC at `p=reject` with aggregate reports flowing for 30+ days.
47
48	3. Apply preset security policies — Standard preset to all users. Strict preset to a
49	targeted group (executives, finance, IT admins). Presets auto-update to Microsoft's
50	recommendations; custom policies do not.
51	Verify: Preset policy report shows ≥ 95% of users covered by Standard or Strict.
52
53	4. Configure impersonation protection — In the anti-phishing policy (Strict preset
54	includes this), add the specific users (executives, CFO, exec assistants) and domains
55	(your own, partner domains often impersonated) to impersonation protection. Mailbox
56	intelligence on automatically learns the rest.
57	*Verify: anti-phishing policy shows 5-15 protected users (don't list everyone - dilutes
58	detection) and 1-3 trusted domains.*
59
60	5. Tenant allow/block lists (TABL) - block first, allow rarely — Use TABL to block
61	confirmed bad senders/URLs/files. Allow entries are temporary (30-day max) and override
62	detections, so use sparingly and review weekly.
63	Verify: allow list has < 20 entries and no permanent allows for high-risk domains.
64
65	6. Configuration analyzer monthly — In security.microsoft.com →

People who liked this also viewed

6 picks

Type

defender-for-office-365

57installs34forks

View on GitHub

How to install defender-for-office-365?

vinayaklatthe/microsoft-security-skills/defender-for-office-365

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-office-365

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Office 365
2
3	Microsoft Defender for Office 365 (MDO) protects email and collaboration workloads against
4	phishing, malware, spoofing, and business email compromise. It provides preset policies,
5	detonation (Safe Attachments), time-of-click URL protection (Safe Links), post-delivery
6	detection and hunting (Threat Explorer + AIR), and attack simulation training.
7
8	## When to use
9	Securing Exchange Online mail flow and Microsoft 365 collaboration (Teams, SharePoint,
10	OneDrive). Use this skill for plan/preset decisions, control configuration, drift detection,
11	and SOC operations on email incidents.
12
13	Do not use this skill for endpoint protection (`defender-for-endpoint`), broader
14	cross-workload investigation (`defender-xdr`), or SharePoint oversharing before Copilot
15	rollout (`purview-copilot-oversharing`).
16
17	## Pick the plan, then the preset
18
19	\| If you need... \| Plan / SKU \| Notes \|
20	\|---\|---\|---\|
21	\| Safe Links, Safe Attachments, anti-phish, anti-spam, anti-malware \| MDO Plan 1 \| Bundled with M365 Business Premium and E3 add-on \|
22	\| Threat Explorer, Real-time detections, AIR, attack simulation training, automated investigation \| MDO Plan 2 \| Bundled with M365 E5 / MDO P2 \|
23	\| Cross-tenant secure collaboration (B2B/B2C with MDO) \| MDO P1 or P2 \| Apply preset to guest senders too \|
24
25	\| Posture \| Preset to apply \| Who it fits \|
26	\|---\|---\|---\|
27	\| Default healthy baseline, low admin overhead \| Standard preset \| Most enterprises - apply to all users \|
28	\| High-target, regulated, or executive-heavy estate \| Strict preset \| Tier-0 admins, finance, exec mailboxes \|
29	\| Custom carve-out (e.g. vendor with broken SPF) \| Custom policy with priority above preset \| Use sparingly - documents drift risk \|
30
31	> Rule of thumb: apply Standard preset to all users as the floor, **Strict preset to
32	> high-risk groups** (executives, finance, IT admins, legal) as the ceiling. Custom policies
33	> only where presets genuinely don't fit - every custom policy is a future drift source.
34
35	## Approach
36
37	1. Confirm licensing and mail flow — Verify MDO P1 vs P2 in admin centre. Confirm
38	Exchange Online accepts mail directly (or via an upstream gateway). MDO with a third-party
39	secure email gateway (SEG) in front is a common pattern but reduces some detections - use
40	Enhanced Filtering for Connectors to preserve original sender IP.
41	Verify: `Get-EnhancedFilteringConfig` shows your inbound connector configured.
42
43	2. Enable email authentication — SPF, DKIM, and DMARC for every sending domain.
44	DMARC starts at `p=none` (monitor), moves to `quarantine`, then `reject`. Without DMARC,
45	spoofing detections are weaker.
46	Verify: DMARC at `p=reject` with aggregate reports flowing for 30+ days.
47
48	3. Apply preset security policies — Standard preset to all users. Strict preset to a
49	targeted group (executives, finance, IT admins). Presets auto-update to Microsoft's
50	recommendations; custom policies do not.
51	Verify: Preset policy report shows ≥ 95% of users covered by Standard or Strict.
52
53	4. Configure impersonation protection — In the anti-phishing policy (Strict preset
54	includes this), add the specific users (executives, CFO, exec assistants) and domains
55	(your own, partner domains often impersonated) to impersonation protection. Mailbox
56	intelligence on automatically learns the rest.
57	*Verify: anti-phishing policy shows 5-15 protected users (don't list everyone - dilutes
58	detection) and 1-3 trusted domains.*
59
60	5. Tenant allow/block lists (TABL) - block first, allow rarely — Use TABL to block
61	confirmed bad senders/URLs/files. Allow entries are temporary (30-day max) and override
62	detections, so use sparingly and review weekly.
63	Verify: allow list has < 20 entries and no permanent allows for high-risk domains.
64
65	6. Configuration analyzer monthly — In security.microsoft.com →

People who liked this also viewed

6 picks

Type