📄 Article

Microsoft Defender for Office 365: Complete Administration Guide

✍️ Author: Techcareers
📂 Category: Microsoft Defender for Office 365
👥 Audience: M365 Administrators, Security Engineers
📅 Last Reviewed: 5 July 2026

Microsoft Defender for Office 365 (MDO) is the advanced threat protection layer that sits on top of Exchange Online Protection (EOP). It defends against phishing, malware, and business email compromise using Safe Links, Safe Attachments, ZAP, and automated investigation — all essential knowledge for any M365 administrator interview.

🔒 MDO and How It Works with EOP

💡 Overview

Exchange Online Protection (EOP) is the built-in filtering layer included with every Exchange Online mailbox — it handles anti-spam, anti-malware, and connection filtering. Microsoft Defender for Office 365 adds advanced capabilities on top: Safe Links (time-of-click URL scanning), Safe Attachments (detonation sandboxing), anti-phishing with impersonation protection, Threat Explorer, and Automated Investigation and Response. Mail flows through EOP first, then MDO policies apply.

⚡ Zero-Hour Auto Purge (ZAP)

✅ How ZAP Works

ZAP retroactively removes malicious emails that were already delivered to mailboxes
When Microsoft’s threat intelligence identifies a message as spam, phishing, or malware after delivery, ZAP moves it to Junk or Quarantine automatically
Works on unread messages in Exchange Online mailboxes — no admin action required
Actions follow the verdict in your anti-spam and anti-malware policies

🤖 Automated Investigation and Response (AIR)

💡 What AIR Does

AIR (available in Defender for Office 365 Plan 2) automatically investigates well-known threats — a user-reported phish, a malware detection, a suspicious click — and produces recommended remediation actions such as soft-deleting messages or blocking URLs. An admin reviews and approves the actions in the Action Center, keeping humans in control while cutting investigation time dramatically.

🎣 Responding to Bulk Phishing — Search and Delete

Identify the Campaign

Use Threat Explorer in the Defender portal to find all recipients by sender, subject, or URL. For 6,000+ message campaigns, export the affected recipient list.

Purge with Content Search or Threat Explorer

Take direct action from Threat Explorer (soft delete), or use Security & Compliance PowerShell for large-scale purges.

PowerShell — Security & Compliance

Connect-IPPSSession

# Create a search for the phishing campaign
New-ComplianceSearch -Name "PhishPurge" -ExchangeLocation All -ContentMatchQuery ((subject:"Invoice Overdue") AND (received:today))

Start-ComplianceSearch -Identity "PhishPurge"

# Soft delete all matches
New-ComplianceSearchAction -SearchName "PhishPurge" -Purge -PurgeType SoftDelete

✉️ SPF, DKIM, and DMARC

Record	What It Does	DNS Record Type
SPF	Lists which servers are allowed to send email for your domain	TXT on the root domain
DKIM	Cryptographically signs outgoing messages so recipients can verify integrity	Two CNAME selector records
DMARC	Tells recipients what to do when SPF/DKIM fail (none, quarantine, reject) and sends reports	TXT on _dmarc subdomain

⚠️ Hard Fail vs Soft Fail in SPF

Soft fail (~all): Unauthorised senders are marked suspicious but usually still delivered — recommended while onboarding or for new organisations still discovering all their legitimate senders
Hard fail (-all): Unauthorised senders should be rejected — use once you are confident every legitimate sending source is in the SPF record

👤 Impersonation Protection for Executives

💡 Configuration

In the anti-phishing policy (Defender portal → Email & collaboration → Policies → Anti-phishing), enable user impersonation protection and add up to 350 high-value users (CEO, CFO, executives). Also enable domain impersonation for your own and partner domains, and mailbox intelligence so machine learning detects unusual senders posing as known contacts.

📥 SCL -1 and Safe Senders

✅ What SCL -1 Means

A Spam Confidence Level of -1 means the message skipped spam filtering — it came from a safe sender, a trusted recipient, an allowed IP, or a transport rule that set SCL to -1. The message is delivered straight to the inbox. This is also how “bypass spam filtering” transport rules for trusted partners work.

🚚 Advanced Delivery

💡 When to Use It

Advanced Delivery (Defender portal → Policies → Advanced delivery) tells filtering to deliver phishing simulations and SecOps mailbox messages unfiltered without weakening protection for everyone else. Use it for third-party phishing simulation platforms and dedicated security operations mailboxes — never for ordinary partner mail (use allow entries or transport rules for that).

🚫 Creating a Spam Filter Exception (Tenant Allow/Block List)

⚠️ Common Interview Scenario

“The detection technology shows ‘spam filter’ on a quarantined message, and we don’t want this specific sender quarantined — where do you create the exception?” This is a Tenant Allow/Block List scenario, not a transport rule — allow entries are the Microsoft-recommended way to override a specific spam filter verdict without disabling filtering tenant-wide.

✅ Where to Configure It

Defender portal → Policies & rules → Threat policies → Tenant Allow/Block List → Domains & addresses tab → add the sender as an allow entry. Unlike a transport rule that sets SCL -1 tenant-wide, allow entries in the Tenant Allow/Block List are scoped, auditable, and expire automatically after 30 days by default (extendable), which avoids permanent blind spots in spam filtering.

💡 Best Practices & Recommendations

Deploy preset security policies (Standard/Strict) instead of hand-tuning every setting
Publish SPF, DKIM, and DMARC for every sending domain — start DMARC at p=none, review reports, then move to quarantine/reject
Add all executives to impersonation protection and enable mailbox intelligence
Use Threat Explorer weekly to review campaigns targeting your tenant
Prefer the Tenant Allow/Block List over transport rules for sender exceptions — entries expire automatically
Enable user-reported message settings so employees can report phish directly to your SecOps mailbox

🎓 Common Interview Questions

Q: What is ZAP in Microsoft Defender for Office 365 and how does it work?

Zero-Hour Auto Purge retroactively neutralises messages that were already delivered before being identified as malicious. When threat intelligence updates the verdict on a delivered message, ZAP automatically moves it to Junk or Quarantine based on your policy — protecting users even when a threat slips past the initial filter.

Q: What are the uses of SPF, DKIM, and DMARC records?

SPF authorises which servers may send for your domain; DKIM adds a cryptographic signature proving the message wasn’t altered and genuinely came from your domain; DMARC binds them together — it tells receiving servers what to do when authentication fails (none/quarantine/reject) and provides aggregate reports so you can monitor abuse of your domain.

Q: What does an SCL value of -1 mean?

An SCL (Spam Confidence Level) of -1 means the message bypassed spam filtering entirely and goes straight to the inbox. This happens because the sender is on a safe senders list, the message came from an allowed IP, the recipient trusts the sender, or a transport rule explicitly set SCL to -1 for that sender — commonly used to guarantee delivery from trusted partners or internal systems.

Q: What is the difference between soft fail and hard fail in SPF? Which should a new organisation use?

Soft fail (~all) asks receivers to mark unauthorised mail as suspicious but still accept it; hard fail (-all) asks them to reject it outright. A new organisation should start with soft fail while it discovers all legitimate sending systems (marketing tools, printers, apps), then move to hard fail once the SPF record is complete.

Q: Your organisation received 6,000 bulk phishing emails. Walk me through your response.

(1) Use Threat Explorer to identify the campaign by sender/subject/URL and see all recipients. (2) Block the sender/URL in the Tenant Allow/Block List. (3) Purge delivered messages — via Threat Explorer actions or a Compliance Search with -Purge -PurgeType SoftDelete. (4) Check who clicked using URL click data, reset credentials and revoke sessions for affected users. (5) Let AIR investigate related messages, and review why the filter missed it.

Q: We work with critical partners whose emails must always be delivered. How do you ensure that?

Verify the partner has proper SPF/DKIM/DMARC first. Then either create a transport rule that sets SCL to -1 for their authenticated domain, or add allow entries. For phishing simulation vendors or SecOps mailboxes specifically, use Advanced Delivery. Avoid broad IP allow-listing, which attackers can abuse.

Q: If detection technology is “spam filter” and we don’t want it quarantined, where do you create the exception?

In the Defender portal under Policies & rules → Threat policies → Tenant Allow/Block List, add the sender’s domain or email address as an allow entry. This is the correct place for a “spam filter” verdict specifically — it’s more targeted and auditable than a broad transport rule, and entries expire automatically after 30 days by default so exceptions don’t become permanent blind spots.

Q: What is Advanced Delivery in Microsoft Defender and when would you use it?

Advanced Delivery tells Defender to deliver specific categories of mail — third-party phishing simulations and SecOps mailbox messages — completely unfiltered, so they reach their destination exactly as sent for testing or investigation purposes. It should only be used for those two scenarios; using it for regular partner mail would create a security gap, since Advanced Delivery bypasses all filtering rather than just adjusting the spam verdict.

📚 References & Further Reading

🔗 Microsoft Defender for Office 365 overview — Microsoft Learn
🔗 Zero-hour auto purge (ZAP) — Microsoft Learn
🔗 Email authentication: SPF, DKIM, DMARC — Microsoft Learn

🎓 View Interview Prep Guide →