How to Improve Phishing Protection with a Custom Anti-Phishing Policy in Defender for Office 365
Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?
Quick Answer
The answer is to create a custom anti-phishing policy with stricter settings. This is the correct approach because the default anti-phishing policy in Defender for Office 365 applies baseline protection, but it may not catch sophisticated or targeted phishing attempts that bypass its generic thresholds. A custom anti-phishing policy allows you to fine-tune impersonation protection, spoof intelligence, and advanced phishing thresholds specifically for your organization’s domains and users. On the SC-900 exam, this question tests your understanding of layered security controls—remember that phishing protection is distinct from spam filtering (which uses a spam confidence level) and from malware or attachment scanning. A common trap is confusing anti-phishing policies with anti-spam or anti-malware policies; the key distinction is that anti-phishing focuses on deceptive sender impersonation and domain spoofing. Memory tip: think “Phish = Person or Domain impersonation” to recall that custom policies target identity-based threats, not just message content.
⚠ Common exam trap
Test-takers frequently confuse anti-phishing policies with anti-spam or anti-malware policies, mistakenly thinking that increasing the SCL threshold or enabling Safe Attachments will address phishing, when in fact phishing protection requires dedicated impersonation and spoofing controls only available in a custom anti-phishing policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom anti-phishing policy.
The default anti-phishing policy in Microsoft Defender for Office 365 provides baseline protection, but it cannot be customized. To address specific threats like phishing emails that bypass default settings, you must create a custom anti-phishing policy. This allows you to fine-tune spoof intelligence, impersonation protection, and mailbox intelligence thresholds to catch sophisticated phishing attempts that evade the default policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom anti-phishing policy.
Why this is correct
A custom anti-phishing policy lets you tighten thresholds beyond the default policy's fixed settings, such as enabling impersonation protection for specific users and domains, adjusting mailbox intelligence sensitivity, and configuring spoof intelligence. This directly addresses the reported bypasses by applying stricter, organisation-specific detection rules to inbound mail.
- ✗
Enable Safe Attachments.
Why it's wrong here
Safe Attachments detonates email attachments in a sandbox to catch malicious payloads, but the reported messages are phishing emails that passed anti-phishing checks, not attachment-borne malware. It tempts because it is a core Defender for Office 365 control, and would be correct if users were opening weaponised attachments.
- ✗
Configure anti-malware policy.
Why it's wrong here
Anti-malware policies scan message bodies and attachments for malicious code; they do not evaluate sender impersonation or spoofing signals, so phishing messages that passed anti-phishing remain unaffected. It tempts because it is another Defender for Office 365 policy, and would be correct if the emails carried malware.
- ✗
Increase the spam confidence level (SCL) threshold.
Why it's wrong here
The SCL threshold governs bulk and spam classification, not the impersonation and spoofing checks in anti-phishing policies, so raising it does not address the bypass. It tempts because SCL tuning is a familiar mail-flow lever, and would be correct if the messages were ordinary spam rather than phishing.
Go deeper
Related to this question
Learn chapter
Microsoft Defender for Identity
Key term
Baseline
A baseline is a documented starting point for the normal performance and behavior of a system, network, or component, used to detect changes and troubleshoot issues.
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?
medium- A.Microsoft 365 Defender portal
- B.Microsoft Defender for Cloud Apps portal
- ✓ C.Exchange admin center
- D.Microsoft Entra admin center
Why C: To create a custom mail flow rule (also known as a transport rule) that blocks emails based on specific keywords in the subject line, you must use the Exchange admin center (EAC). Mail flow rules are processed by the Exchange Online transport pipeline and are configured within the EAC or via Exchange Online PowerShell, not through the Microsoft 365 Defender portal, which focuses on threat policies and incident response rather than transport-level rule creation.
Variation 2. Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?
medium- A.Safe Attachments policy
- B.Anti-spam policy
- C.Safe Links policy
- ✓ D.Impersonation protection in anti-phishing policy
Why D: The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.