🎯 Security Course · Module 2 of 6
Defender for Office 365 — EOP, Anti-Spam & Anti-Phishing
SC-200 Exam Alignment
SC-200
Mitigate threats using Defender for Office 365: Configure and manage Exchange Online Protection policies — anti-spam, anti-malware, anti-phishing — and understand the EOP filtering pipeline, spoof intelligence, authentication (SPF/DKIM/DMARC), and preset security policies.
- Know the EOP filtering pipeline order: connection filtering → anti-malware → mail flow rules → anti-spam → anti-phishing
- Know that all Microsoft 365 tenants get Exchange Online Protection (EOP) at no additional cost — Defender for Office 365 Plan 1 and Plan 2 add extra layers
- Understand the difference between SCL (Spam Confidence Level) — a numeric score (−1 to 9) assigned during anti-spam filtering — and BCL (Bulk Complaint Level) for bulk email
- Know that Standard and Strict preset security policies configure EOP + Defender for Office 365 settings in bulk — Strict is more aggressive and should be applied to high-value targets
Exam Tip: SC-200 tests whether you understand why a message was delivered or blocked, not just where policies live. Focus on the EOP filtering pipeline and understand what SCL values mean: SCL −1 = bypass spam filter; SCL 0–4 = not spam; SCL 5–6 = likely spam → Junk folder; SCL 7–9 = high confidence spam → Junk or Quarantine; SCL 9 = quarantine. Also know that spoof intelligence detects senders whose domain does not match the From address — distinct from impersonation protection.
Exchange Online Protection (EOP) is the email filtering service that underpins every Microsoft 365 mailbox. It processes every inbound and outbound message through a layered filtering pipeline. Microsoft Defender for Office 365 (MDO) adds URL detonation (Safe Links), file detonation (Safe Attachments), advanced anti-phishing with impersonation detection, and Threat Explorer on top of EOP’s baseline filtering.
🔄 EOP Filtering Pipeline
Every email message entering an Exchange Online mailbox passes through this pipeline in order. Understanding the sequence is essential for diagnosing why a message was delivered, quarantined, or rejected.
| # | Filter Layer | What It Checks | Outcome if Triggered |
|---|---|---|---|
| 1 | Connection filtering | Sender IP address against Microsoft’s global block list and your custom IP Allow/Block lists | Block at SMTP connection (message never enters the pipeline) |
| 2 | Anti-malware scanning | Email attachments and body for known malware signatures using multiple scan engines | Quarantine the message; replace attachment with alert text |
| 3 | Mail flow rules (transport rules) | Admin-defined conditions on headers, subject, sender, recipient, or attachment type | Any configured action — reject, redirect, stamp header, set SCL |
| 4 | Anti-spam filtering | Content analysis, sender reputation, SPF/DKIM/DMARC authentication results → assigns SCL | Deliver, Junk folder, or Quarantine based on SCL and policy thresholds |
| 5 | Anti-phishing filtering | Spoof intelligence (EOP), user impersonation, domain impersonation, mailbox intelligence (MDO P1/P2) | Move to Junk, Quarantine, or deliver with safety tip banner |
| 6 | Safe Attachments (MDO) | Detonates attachments in a sandbox to detect zero-day malware not caught by signature scanning | Block or deliver based on detonation result (MDO P1 required) |
| 7 | Safe Links (MDO) | Rewrites URLs; performs time-of-click reputation check at the moment the user clicks | Block malicious URL or redirect to safe page (MDO P1 required) |
🚫 Anti-Spam Policies
Anti-spam policies define what happens to messages at different SCL values. The default policy covers all users; custom policies can target specific users, groups, or domains with higher priority.
security.microsoft.com › Email & collaboration › Policies & rules › Threat policies › Anti-spam
| SCL Value | Classification | Default Action | Policy Setting |
|---|---|---|---|
| −1 | Skip spam filter (safe sender / IP allow) | Deliver to Inbox | Connection filter allow list or mail flow rule |
| 0 – 4 | Not spam | Deliver to Inbox | No action required |
| 5 – 6 | Spam | Move to Junk Email folder | Spam action: Move to Junk / Quarantine |
| 7 – 8 | High confidence spam | Move to Junk Email folder | High confidence spam action: Quarantine recommended |
| 9 | High confidence spam (bulk/phish) | Quarantine | Quarantine retention: 30 days by default |
⚠️ Outbound Spam Policy
Outbound spam policies limit how many messages users can send per hour and per day. If a user’s account is compromised and used for bulk spam, the outbound policy automatically restricts the account and alerts administrators. Configure the Action when a user exceeds the limits to “Restrict the user from sending email” to prevent your domain from being blocklisted by external mail services.
🦠 Anti-Malware Policies
Anti-malware policies control how EOP handles messages containing known malware signatures. They apply before the message reaches the user’s mailbox.
| Setting | Description | Recommended Value |
|---|---|---|
| Enable the common attachments filter | Automatically blocks file types commonly used to deliver malware (.exe, .bat, .ps1, .js, .vbs, .dll, .lnk and more) regardless of content scanning | Enabled (strict) — add custom extensions as needed |
| Zero-hour auto purge (ZAP) | Retroactively moves messages already delivered to mailboxes when a previously unknown threat is later classified as malware | Enabled always — critical for catching late-identified threats |
| Quarantine vs Delete | Quarantine preserves the message for admin review; Delete permanently removes it | Quarantine — gives admin ability to recover false positives |
| Admin notification | Send an alert to a mailbox when malware is detected | Enable for the security team mailbox |
🎣 Anti-Phishing Policies
Anti-phishing policies provide multiple layers of protection against spoofed and impersonated senders. EOP provides spoof intelligence (free). Defender for Office 365 P1/P2 adds user impersonation, domain impersonation, and mailbox intelligence.
| Protection Type | What It Detects | Requires |
|---|---|---|
| Spoof intelligence (EOP) | Sender domain in the From header doesn’t match the actual sending infrastructure — external spoofing of your domain or cross-domain spoofing | EOP (all tenants) |
| User impersonation (MDO) | Someone pretending to be a specific user you define (e.g. your CEO’s name in the From field with a different email address) | Defender for Office 365 P1+ |
| Domain impersonation (MDO) | Look-alike domain of your organisation (e.g. cont0so.com vs contoso.com) — typosquatting and homograph attacks | Defender for Office 365 P1+ |
| Mailbox intelligence (MDO) | Uses sending patterns and communication history to identify unusual senders — detects first-time senders or senders not normally communicating with this mailbox | Defender for Office 365 P1+ |
🔐 Email Authentication: SPF, DKIM, DMARC
Email authentication standards let receiving mail servers verify that email claiming to come from your domain was actually sent by an authorised server. EOP checks all three on inbound mail and uses results in anti-spam and anti-phishing scoring.
| Standard | What It Does | DNS Record Type | Configured In |
|---|---|---|---|
| SPF | Publishes which IP addresses are authorised to send email for your domain. Receivers check the sending IP against this list | TXT record at root domain | DNS (your domain registrar) |
| DKIM | Adds a cryptographic signature to outgoing messages. Receivers verify the signature matches a public key in DNS — proves message integrity and origin | CNAME records (Microsoft publishes the keys) | Microsoft 365 admin center → Email authentication → DKIM |
| DMARC | Tells receiving servers what to do when SPF or DKIM fails: none (monitor), quarantine, or reject. Also requests aggregate reports (rua) and forensic reports (ruf) | TXT record at _dmarc subdomain | DNS (your domain registrar) |
🛡️ Preset Security Policies
Preset security policies (Standard and Strict) configure all EOP and Defender for Office 365 settings in a single step. Microsoft maintains the settings — they update automatically as new threats emerge.
💡 Standard vs Strict Protection
- Standard protection: Balanced settings suitable for most users. Recommended minimum for all mailboxes. Spam goes to Junk; high confidence phish goes to Quarantine
- Strict protection: More aggressive — higher false positive rate but better detection. Quarantines more categories. Recommended for executives, finance, IT admins, and high-value targets
- Preset policies override individual custom policies for the users they target — you cannot mix preset settings with custom overrides for the same policy type
PowerShell — View & Manage Anti-Spam Policies
# Connect to Exchange Online Connect-ExchangeOnline # List anti-spam policies and key settings Get-HostedContentFilterPolicy | Select-Object Name,SpamAction,HighConfidenceSpamAction,BulkThreshold,QuarantineRetentionPeriod # Anti-phishing policy settings including spoof intelligence Get-AntiPhishPolicy | Select-Object Name,Enabled,EnableSpoofIntelligence,EnableMailboxIntelligence,PhishThresholdLevel # Check DKIM signing status for all domains Get-DkimSigningConfig | Select-Object Domain,Enabled,Status # Enable DKIM for a domain (CNAME records must exist in DNS first) Set-DkimSigningConfig -Identity contoso.com -Enabled $true
💡 Best Practices
- Apply Standard preset security policy to all users as your baseline — then layer Strict protection on top for executives, finance teams, and IT admins
- Enable DKIM for every custom domain you send from — it’s one of the highest-value Secure Score improvements and directly strengthens email deliverability
- Set your DMARC policy to
p=quarantineinitially, then move top=rejectafter monitoring the aggregate reports for 2–4 weeks to ensure no legitimate mail streams are failing authentication - Enable Zero-hour Auto Purge (ZAP) for both spam and phishing — it silently remediates messages that were delivered before the threat was classified without requiring user action
- Review the Spoof intelligence insight (Email & collaboration → Policies & rules → Threat policies → Anti-spam → Spoof intelligence insight) monthly — it lists all cross-domain spoofing activity so you can allow legitimate senders and block the rest
🎓 Interview Q&A
Q: A user reports receiving an email that appears to be from the CEO (ceo@contoso.com) asking for an urgent wire transfer. The security team investigates and finds the email’s actual sending address is ceo@c0ntoso.com (zero instead of O). Which anti-phishing feature should be configured to catch this in future?
Domain impersonation protection — available in Defender for Office 365 P1 and above. In the anti-phishing policy, enable “Protect against impersonation of domains” and add contoso.com to the list of protected domains. The filter uses fuzzy matching (homograph detection) to identify look-alike domains like c0ntoso.com and flags or quarantines messages from them. Additionally, enable mailbox intelligence which learns that the CEO doesn’t normally receive emails from that sending domain. For the highest protection, apply the Strict preset security policy to executives — it includes domain impersonation protection out of the box.
🎯 SC-200 Mock Test
Module 2 — EOP, Anti-Spam & Anti-Phishing
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A message arrives with SCL 8. The organisation’s anti-spam policy has the following actions: Spam → Junk, High confidence spam → Quarantine. What happens to this message?
ADelivered to the Inbox — SCL 8 is below the spam threshold
BMoved to the Junk Email folder — SCL 8 is classified as standard spam
CQuarantined — SCL 7–9 is High confidence spam, which maps to the Quarantine action
DPermanently deleted — SCL 8 triggers the malware delete action
✅ C. SCL 7–9 is classified as High confidence spam. In the anti-spam policy, the “High confidence spam” action is set to Quarantine, so the message is quarantined rather than delivered or moved to Junk. SCL 5–6 is standard Spam (mapped to the “Spam action”). Understanding SCL ranges is an SC-200 exam staple.
Q2 of 5
Which email authentication standard cryptographically signs outgoing messages so receiving servers can verify message integrity and sender identity?
ADKIM — signs the message header and body with a private key; receivers validate using the public key published in DNS
BSPF — publishes authorised sending IP addresses in DNS but does not sign the message content
CDMARC — instructs receivers what to do when SPF/DKIM fail but does not itself sign messages
DTLS — encrypts the connection between mail servers but does not authenticate message origin
✅ A. DKIM (DomainKeys Identified Mail) is the authentication standard that applies a cryptographic signature to outgoing messages. The signature is created using a private key held by the sending mail server; receivers look up the corresponding public key in the sender’s DNS to validate the signature. If the message is altered in transit, the signature breaks. SPF checks IPs, DMARC enforces policy, and TLS is transport encryption — none of these sign message content.
Q3 of 5
An organisation wants the most aggressive email protection settings for their executive team without manually tuning individual policies. What is the recommended approach?
ACreate a custom anti-spam policy with SCL threshold set to 1 and apply to all users
BApply the Standard preset security policy to executives — Standard is the highest available protection
CEnable connection filtering only for executive IP ranges
DApply the Strict preset security policy to the executive group — it’s Microsoft’s most aggressive pre-built configuration and self-updates automatically
✅ D. The Strict preset security policy is Microsoft’s most aggressive pre-configured email protection profile. It quarantines more message categories, uses lower SCL thresholds, and enables the maximum MDO impersonation settings. It’s the correct choice for high-value targets like executives. Microsoft maintains and updates these preset policies as the threat landscape changes, removing the need for manual tuning. Standard preset is less aggressive — used as the baseline for all other users.
Q4 of 5
Zero-hour Auto Purge (ZAP) detects a message previously delivered to a user’s Inbox that has now been reclassified as phishing. What does ZAP do with the message by default?
ASends the user an email warning to delete the message manually
BSilently moves the message from the Inbox to Quarantine without user interaction
CBlocks the user’s mailbox until an admin reviews the message
DPermanently deletes the message from all mailboxes in the tenant
✅ B. ZAP silently and automatically moves the message from the user’s Inbox (or Junk folder) to Quarantine with no user action or notification required. This is critical because threats are often classified after delivery — ZAP retroactively remediates the breach. ZAP for phishing is enabled by default and quarantines retroactively; ZAP for spam moves to Junk. Admins can review and release quarantined messages from the Defender portal.
Q5 of 5
Which anti-phishing feature in the EOP base layer (available to all M365 tenants without Defender for Office 365) detects when an external sender’s domain in the From header doesn’t match the actual sending infrastructure?
ASpoof intelligence — detects cross-domain spoofing using EOP’s built-in authentication analysis
BUser impersonation — protects against someone using a look-alike display name to impersonate your CEO
CDomain impersonation — detects look-alike domains of protected domains (typosquatting)
DMailbox intelligence — uses communication history to flag unusual sender-recipient pairs
✅ A. Spoof intelligence is part of EOP (base layer, all tenants) and detects when the From domain doesn’t align with the actual sending MX/IP infrastructure — classic cross-domain spoofing where attacker@gmail.com forges the From as ceo@yourcompany.com. User impersonation (B), domain impersonation (C), and mailbox intelligence (D) all require Defender for Office 365 P1 or higher.
🔒
Locked — Complete Module 1 first to unlock this module.