Module 5 of 9

🧠 AB-650 Course · Module 5 of 9

Securing M365 with Defender for Office 365

📂 Course: AB-650: Administering Microsoft 365 and AI Services
📦 Module: 5 of 9
🎯 Exam: AB-650
📑 Domain: 2 — Govern and Secure M365 Tenants & Workloads (40–45%)
⌛ Read time: ~26 min

AB-650 Exam Alignment
AB-650

Domain 2 — Secure Microsoft 365 with Defender for Office 365: manage alerts in Microsoft 365 Defender; configure threat policies (anti-phishing, Safe Links, Safe Attachments, anti-spam); investigate and respond to email and collaboration threats; configure and manage Attack Simulation Training campaigns.

Know the three main Defender for Office 365 threat policy types: Safe Links, Safe Attachments, and Anti-phishing
Understand the Microsoft Secure Score and how improving Defender threat policies improves it
Know the difference between Defender for Office 365 Plan 1 vs Plan 2 features
Know Attack Simulation Training — how to create and assign phishing simulation campaigns and view user vulnerability reports

Exam Tip: AB-650 tests email investigation using Threat Explorer (real-time) and Email entity page. Know that ZAP (Zero-hour Auto Purge) retroactively removes malicious emails from mailboxes after delivery when new threat intelligence identifies them as malicious — it works automatically with no admin action required when enabled.

Microsoft Defender for Office 365 (formerly ATP) is the threat protection service for Exchange Online, SharePoint, OneDrive, and Teams. It prevents phishing, malware, and business email compromise attacks that bypass standard email filtering. AB-650 Domain 2 requires deep knowledge of Defender threat policies, alert management, and Attack Simulation Training to teach users to recognise phishing attempts.

🔒 Defender for Office 365 Plan 1 vs Plan 2

Feature	Plan 1	Plan 2
Safe Attachments	✅	✅
Safe Links	✅	✅
Anti-phishing (advanced)	✅	✅
Real-time detections	✅	✅
Threat Explorer	❌	✅ (real-time hunting)
Attack Simulation Training	❌	✅
Automated Investigation & Response (AIR)	❌	✅
Threat Trackers	❌	✅
Included in	M365 Business Premium, M365 E3 (add-on)	M365 E5, Office 365 E5

🔌 Key Threat Policies

Microsoft 365 Defender › Email & Collaboration › Policies & rules › Threat policies

☰
Microsoft Defender portal
|
Email & Collaboration › Threat policies

Email & Collaboration

Explorer

Attack simulation

Policies & rules

Incidents & alerts

Incidents

Alerts

Reports

Email security

Security reports

Threat policies — Active policies

Policy Name	Type	Priority	Status
Anti-phishing policy	Anti-phishing	1	● On
Safe Attachments	Safe Attachments	1	● On
Safe Links	Safe Links	1	● On
Default anti-spam	Anti-spam	Default	● On

ⓘ Preset security policies (Standard/Strict) automatically configure all threat policies at recommended levels — use these as a baseline before customising.

Policy	What It Protects Against	Key Settings
Anti-phishing	Impersonation attacks (spoofed sender domains, fake executive emails), mailbox intelligence, spoof intelligence	Impersonation protection: add specific users/domains to protect; Action: move to quarantine or junk. Enable mailbox intelligence for AI-based impersonation detection.
Safe Attachments	Unknown malware in email attachments — detonates attachments in a sandbox before delivery	Action: Block (quarantine and replace), Dynamic Delivery (deliver email immediately, placeholder for attachment until scanned). Enable for SharePoint, OneDrive, and Teams.
Safe Links	Malicious URLs in emails and Office documents — rewrites and re-evaluates links at click-time	Enable “Do not allow users to click through to original URL”. Enable URL detonation for Teams and Office 365 apps. Block the “Do not rewrite URLs” list abuse.
Anti-spam	Bulk email, spam, and phishing that doesn’t meet the higher-confidence anti-phishing threshold	Configure spam confidence level (SCL) thresholds. Enable quarantine for high-confidence phishing. Review allowed/blocked sender lists.
Anti-malware	Known malware and viruses in email attachments	Enable ZAP (Zero-hour Auto Purge). Configure notification settings. Apply common attachments filter to block dangerous file types.

🎯 Attack Simulation Training

Attack Simulation Training (Microsoft Defender for Office 365 Plan 2) lets administrators run simulated phishing campaigns to measure user vulnerability and identify who needs additional security awareness training.

🔥 Attack Simulation Training — Key AB-650 Facts

Access: Microsoft 365 Defender → Email & Collaboration → Attack simulation training
Simulation techniques: credential harvest, malware attachment, link in attachment, drive-by URL, OAuth consent grant
After simulation, users who clicked are automatically assigned training content — configurable by admin
Reports show: click rate, compromise rate by department/location, repeat offenders, improvement over time
Requires Microsoft Defender for Office 365 Plan 2 (included in M365 E5 and Office 365 E5)
Simulation emails are exempt from anti-phishing and Safe Links policies — they bypass filters intentionally

PowerShell — Defender for Office 365 Management

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# View anti-phishing policies and key settings
Get-AntiPhishPolicy | Select-Object Name,Enabled,EnableMailboxIntelligence,EnableSpoofIntelligence | Format-Table -AutoSize

# Create an anti-phishing policy protecting executive accounts
New-AntiPhishPolicy -Name 'Executive Protection' -EnableTargetedUserProtection $true -TargetedUsersToProtect @('ceo@contoso.com','cfo@contoso.com') -TargetedUserProtectionAction Quarantine -EnableMailboxIntelligence $true

# View quarantined messages from the last 7 days
Get-QuarantineMessage -StartReceivedDate (Get-Date).AddDays(-7) -QuarantineTypes AntiPhish | Select-Object SenderAddress,RecipientAddress,Subject,QuarantineType | Format-Table -AutoSize

# Release a quarantined message
Release-QuarantineMessage -Identity [MessageIdentity] -ReleaseToAll

💡 Best Practices

Apply the Strict preset security policy to high-value users (executives, finance, IT admins) and the Standard policy to all others — preset policies auto-update as Microsoft improves recommendations
Enable Safe Attachments in Dynamic Delivery mode rather than Block mode — Dynamic Delivery releases the email body immediately and replaces the attachment with a placeholder while scanning, avoiding delivery delays
Enable Safe Links for Office applications (Word, Excel, PowerPoint) and Teams in addition to email — attacks increasingly use documents and chat to deliver malicious URLs
Run Attack Simulation Training quarterly and target the simulation at departments that handle sensitive data (Finance, HR, Legal) — compare click rates across campaigns to measure improvement
Configure impersonation protection for the top 10–20 most targeted internal users (executives, CFO, IT admin names) — these are the most common Business Email Compromise targets
Enable ZAP (Zero-hour Auto Purge) for both spam and malware — this retroactively removes malicious emails already delivered to mailboxes when new threat intelligence identifies them

🎓 Interview Q&A

Q: What is the difference between Safe Links and Safe Attachments?

Safe Links protects against malicious URLs. When a user receives an email with a link, Defender rewrites the URL to route through Microsoft’s threat intelligence service. When the user clicks the link, it is re-evaluated in real-time — if malicious, the user is redirected to a warning page. Safe Links also checks URLs in Office documents and Teams messages. Safe Attachments protects against malware in email attachments. Attachments are detonated in a sandbox environment before delivery — the email is held while the attachment is analysed. If malicious, the attachment is removed or replaced. Both policies must be configured separately and work together as a comprehensive email protection stack.

Q: What is ZAP (Zero-hour Auto Purge) and when does it trigger?

ZAP retroactively removes or moves emails that have already been delivered to user mailboxes when Microsoft’s threat intelligence subsequently identifies them as malicious. It operates silently without user impact. ZAP triggers when: (1) a URL or file in an already-delivered email is later identified as malicious by Microsoft’s threat intelligence; (2) a message classified as spam is found in an inbox (spam ZAP moves it to Junk); or (3) a message classified as phishing or malware is found anywhere in the mailbox. ZAP works for Exchange Online mailboxes and is enabled by default in Defender for Office 365 — verify it’s not disabled in anti-spam and anti-malware policies.

Q: What is the purpose of Attack Simulation Training and what does the data from simulations help administrators do?

Attack Simulation Training sends simulated phishing emails to real users (who are aware it’s a training programme) to measure how many click links, submit credentials, or open attachments. The data helps administrators: (1) identify repeat clickers (high-risk users who consistently fall for phishing) for targeted training; (2) see which departments or roles are most vulnerable; (3) measure improvement over multiple simulation campaigns; (4) automatically enrol users who clicked in mandatory training modules; and (5) meet compliance requirements for regular security awareness training. The simulation is designed to be educational — users who click are immediately shown an educational page explaining what just happened and how to recognise phishing.

🎯 AB-650 Mock Test

Module 5 — Securing M365 with Defender for Office 365

5 questions · Scenario-based · AB-650 exam style · Pass mark: 70%

Question 1 of 5

Users are complaining that important emails with attachments are delayed by 15–20 minutes when Safe Attachments is enabled. They need emails delivered immediately. Which Safe Attachments action resolves this while maintaining protection?

ADisable Safe Attachments for the affected users to eliminate delays

BSet the action to “Block” — this delivers emails faster than other modes

CSwitch to “Dynamic Delivery” — delivers the email body immediately with a placeholder for the attachment while it’s being scanned

DAdd the senders to the Safe Senders list to bypass attachment scanning

✅ Correct: C. Dynamic Delivery is specifically designed to eliminate delivery delays while maintaining scanning. It releases the email body immediately and replaces the attachment with a placeholder stub. Once scanning completes (typically 1–3 minutes), the real attachment replaces the placeholder — the user gets a notification. If the attachment is found malicious, it is quarantined and never delivered. Option A disables protection. Block (B) also holds the email during scanning. Safe Senders (D) bypasses protection entirely.

Question 2 of 5

An executive receives an email appearing to come from the CEO asking for an urgent wire transfer. The domain is slightly different (ceo@c0ntoso.com instead of ceo@contoso.com). Which Defender policy should be configured to prevent this type of attack?

ASafe Links — configure URL protection to detect typosquatted domains in links

BAnti-malware — block all emails from external domains with similar names

CAnti-spam — set the spam confidence level threshold to block external emails

DAnti-phishing — enable domain impersonation protection for contoso.com and targeted user protection for the CEO and CFO

✅ Correct: D. This is a domain impersonation attack — a look-alike domain (c0ntoso.com vs contoso.com) is used to impersonate a trusted sender. The Anti-phishing policy with domain impersonation protection enabled detects domains similar to the protected domains and takes action (quarantine/warning). Additionally, enable targeted user protection for high-value targets like the CEO and CFO. Safe Links (A) protects URLs in content, not sender domain impersonation. Anti-malware (B) targets file-based threats. Anti-spam (C) uses content scoring, not domain impersonation detection.

Question 3 of 5

After running an Attack Simulation Training campaign, the administrator sees 23% of Finance department users clicked the simulated phishing link. What should the administrator do next within Attack Simulation Training?

AImmediately block email access for the 23% of users who clicked until they complete mandatory training

BConfigure automatic training assignment for users who clicked, enrol them in phishing awareness training modules, and schedule a follow-up campaign in 30–60 days to measure improvement

CReport the 23% to senior management as security violations

DIncrease Safe Links strictness settings for the Finance department to block all external links

✅ Correct: B. Attack Simulation Training is a training tool — not a disciplinary mechanism. The correct response is to automatically assign phishing awareness training to users who clicked (configurable in the simulation settings), then run a follow-up campaign in 30–60 days to see if the click rate improves. Blocking access (A) is punitive and counterproductive. Reporting to management (C) can damage security culture. Adjusting Safe Links (D) doesn’t address the human behaviour risk revealed by the simulation.

Question 4 of 5

A user reports receiving a suspicious email two days ago with a link that now appears to be a known phishing site. The email was initially delivered to the inbox. How does Defender for Office 365 address this retroactively?

AZAP (Zero-hour Auto Purge) retroactively moves or deletes the email from the inbox when the link is subsequently identified as malicious

BSafe Links rewrites the URL retroactively so the user cannot click it next time

CThe email cannot be addressed retroactively — Defender only scans emails at delivery time

DAutomated Investigation and Response (AIR) creates a ticket for the security team to manually remove the email

✅ Correct: A. ZAP continuously monitors delivered emails. When Microsoft’s threat intelligence subsequently identifies a URL or attachment as malicious (even days after delivery), ZAP retroactively moves the email to the Junk Email folder or quarantine depending on configuration. This works for phishing and malware ZAP. The process is automatic — no admin action needed. Safe Links (B) rewrites at delivery time, not retroactively. Option C is incorrect — ZAP is exactly the retroactive capability. AIR (D) investigates threats and can take automated actions, but ZAP is the specific mechanism for retroactive email handling.

Question 5 of 5

Which Defender for Office 365 Plan 2 feature allows an administrator to search for and investigate all emails sent from a specific domain over the past 30 days in real-time?

AMessage trace in Exchange Admin Center

BMicrosoft Purview Audit Log Search

CReal-time detections (Plan 1 only)

DThreat Explorer — provides real-time threat hunting and email flow investigation for the past 30 days

✅ Correct: D. Threat Explorer (available in Defender for Office 365 Plan 2) provides real-time threat hunting with a 30-day lookback. Administrators can filter by sender domain, URL, file hash, recipient, or threat type to investigate campaigns. Plan 1 has “Real-time detections” (C) which is a read-only subset of Threat Explorer. Message trace (A) is useful for delivery tracking but not threat hunting. Audit Log Search (B) shows admin and user activity but not email threat content.