Configuring Microsoft Defender for Office 365

Even with the ascendance of Microsoft Teams, Exchange Online remains one of the core features of the Microsoft 365 platform. The majority of businesses with a Microsoft 365 tenant rely heavily on email as one of their primary methods of communication, both internally and with customers, suppliers, and other external correspondents. In the ever-changing security landscape where attackers are becoming more sophisticated and more determined to cause chaos and disruption, it is crucial to provide as much protection to your users as possible when they are using Exchange Online for their emails. Microsoft Defender for Office 365 addresses this requirement.

Microsoft Defender for Office 365 is a cloud-based email filtering service designed to safeguard your organization and protect you from threats within emails, links, and even collaboration tools such as Microsoft Teams. Microsoft Defender for Office 365 includes extensive reporting and URL...

Protecting users and domains with anti-phishing protection and policies

Phishing is a practice utilized by malicious actors to trick email users into revealing personal or sensitive information, such as passwords or credit card numbers. Phishing is a form of what is known as social engineering. In this type of attack, emails are sent by what appear to be genuine and reputable email domains from well-known and trusted organizations, but in fact originate from malicious sources.

It is extremely difficult to prevent phishing attacks, as the average email user is not trained to look for clues and signs that would alert trained IT professionals that an email is not genuine. Educating your users on the principles of phishing and what they need to be aware of is certainly a good start in trying to minimize phishing attacks within your environment. However, education alone is not enough, and this is where Microsoft Defender for Office 365 comes in.

Microsoft Defender for Office 365 includes...

Configuring Safe Attachments options and policies

Safe Attachments is a Microsoft Defender for Office 365 feature that allows you to protect your users from opening attachments that may contain malicious code. This works through the use of a virtual environment that Safe Attachments uses to check the attachments in inbound emails. This takes place after the attachment has been scanned by Exchange Online anti-malware protection. Safe Attachments policies are configured either in the Microsoft 365 Defender portal or in PowerShell.

A Safe Attachments policy comprises the following:

• Safe Attachments policy: Defines and sets actions for unknown malware detection and can be set to send messages with malware attachments to a specific email address. The policy will also determine whether to deliver messages if attachment scanning cannot be completed.
• Safe Attachments rule: Defines the priority and filters to which recipients the policy will apply.

In this section, we...

Configuring Safe Links options, blocked URLs, and policies

Safe Links is a feature that allows you to protect your users from links they receive that may contain malicious code. You can manage Safe Links in Microsoft 365 by setting up a Safe Links policy that will be targeted to specific users, groups, or domains. Safe Links policies can be managed both in the Microsoft 365 Defender portal and by using Windows PowerShell.

Creating a new Safe Links policy

To create a new Safe Links policy, complete the following steps:

1. From the Microsoft 365 Defender portal at https://security.microsoft.com, navigate to Policies & Rules | Threat policies | Policies | Safe links. This will show you the following screen:

Figure 8.21: Safe links

2. You will again see that there is a built-in protection policy that applies to the entire organization, and you can also once again view Global settings. For this example, however, create a new policy by clicking...

Monitoring and remediating with Microsoft Defender for Office 365 reports

With Microsoft Defender for Office 365, you can access a selection of security-related reports. To view and use these reports, you need to be a member of one of the following role groups:

• Organization Management
• Security Administrator
• Security Reader
• Global Reader

You can then view and download the reports from the Microsoft 365 Defender portal as follows:

1. Go to https://security.microsoft.com and navigate to Reports | Email & collaboration | Email & collaboration reports or access it directly via https://security.microsoft.com/emailandcollabreport:

Figure 8.28: Email & collaboration reports

2. Click on View details to view any report, as per the example of the Mailflow status summary report that follows:

Figure 8.29: Mailflow status report

From here, you can export the details to a .csv file...

Running simulated attacks with Microsoft Defender for Office 365

One of the great features available to global and security administrators with Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 is the ability to carry out simulated attack training to run realistic attack scenarios in your organization. These simulations can help you identify your most vulnerable users and educate them before a real attack could cause a serious compromise.

To use these capabilities, take the following steps:

1. From the Microsoft 365 Defender portal at https://security.microsoft.com, navigate to Email & collaboration | Attack simulation training, or you can access this directly from https://security.microsoft.com/attacksimulator. This takes you to the following page:

Figure 8.30: Attack simulation overview page

When using the attack simulator section for the first time, you can access helpful resources to guide you to create a simulation and...

Further attack simulation configuration options

There are three other tabs on the attack simulation page that have not been discussed yet. These are listed and described as follows:

• Automations: There are two types of automation available:
  • Simulation automations are flows that are automated and use specific techniques and payloads that run when the specified conditions are met and launch simulations
  • Payload automations are automated flows that can be used to collect payloads to launch simulations
• Content library: The Content library section contains Payloads, which are phishing emails and web pages available for you to use when launching simulations. Payloads can be manually created or automatically collected with automation. Also within Content library are login pages, which are the entities used in the credential harvesting and link in attachment techniques to create a phishing login page. Finally, End user notifications are messages delivered to users during simulated...

Summary

In this chapter, we examined how Microsoft Defender for Office 365 can be used to protect your organization’s users, groups, and domains from malicious content. We then learned how anti-phishing policies can be created to protect your users from spoofing. We also created Safe Attachments and Safe Links policies to protect users, groups, and domains by using the Microsoft 365 Defender portal and also by using Exchange Online PowerShell. Additionally, we learned about the reporting options within Microsoft Defender for Office 365 and how to configure and execute attack simulation training for users to improve their awareness of threats and vulnerabilities within emails and attachments.

In the next chapter, we will examine the principles of Microsoft Sentinel and learn how to plan and implement Microsoft Sentinel in your organization to monitor Microsoft 365 security. We will also learn how to configure playbooks and manage and monitor them using Microsoft Sentinel and...

Questions

1. Which of the following is not a feature of Microsoft Defender for Office 365?
   1. Safe Attachments
   2. Safe Emails
   3. Safe Links
   4. Simulated Attacks
2. True or false? One of the delivery methods for Safe Attachments is called Static Delivery.
   1. True
   2. False
3. Which of the following is a valid PowerShell command for creating a Safe Links rule?
   1. Set-SafeLinksRule
   2. New-SafeLinksRule
   3. Get-SafeLinksRule
   4. Start-SafeLinksRule
4. Which of the following are technique options within an attack simulation (choose three)?
   1. Link in attachment
   2. Dynamic delivery
   3. Link to malware
   4. Credential harvest
   5. Monitor
5. True or false? Safe Links can be enabled for Microsoft Teams.
   1. True
   2. False
6. Which section of the Microsoft 365 Defender portal would you access to manage anti-phishing policies?
   1. Threat management | Activity alerts
   2. Threat management | Alert policy
   3. Policies & rules | Threat policies
   4. Threat management | Manage advanced alerts
7. Where in the Microsoft 365 Defender portal would you go to configure/examine reports for...

Further reading

Please refer to the following links for more information:

• Microsoft Defender for Office 365: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-worldwide#microsoft-defender-for-office-365-plan-1-and-plan-2
• Introduction to Microsoft Defender for Office 365: https://learn.microsoft.com/en-us/training/modules/m365-threat-remediate/introduction
• Microsoft Defender for Office 365 Security Operations Guide: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/mdo-sec-ops-guide?view=o365-worldwide
• Configure anti-phishing policies in Microsoft Defender for Office 365: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies?view=o365-worldwide
• Anti-spoofing protection: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide
• Manage the tenant allow...