I've taken over an M365 environment that's got a tangled mess of configurations and policies, especially around spam and phishing protection. We've had major issues with spam and phishing in the past, so I tried to tweak the threat policies after learning more about them. I even set up a trial for Defender for Office (MDO) P2, which did wonders for our spam and phishing problems. But now that the trial has ended, everything has gone haywire again! I noticed that while the trial was active, some additional phishing and spam policies were enabled, which have now reverted back to their previous, less effective settings. The standard security preset policies seem to apply first, but I'm worried those settings are too lenient. My main questions are: do I really need to keep multiple phishing and spam policies, what should I do with the standard presets, and should I just create one custom policy instead? Also, what's up with the phishing policy called 'Office365 anti phish default' that I didn't create? Did the trial trigger that? And why did our spam problems escalate again after the trial ended?
1 Answer
Honestly, if you're having these persistent challenges, consider investing in a dedicated email security gateway. Microsoft's built-in solutions aren't always the best for this stuff. It might sound harsh, but they often come up short compared to dedicated providers. A lot of tech folks will argue that proper setup of EOP (Exchange Online Protection) is 'enough' but I've found that a lot of users still struggle with spam and phishing. Just make sure you find a solution that suits your needs rather than relying solely on MS.
Yeah, you'll see people insisting that proper configuration can fix everything. I get it, but it just becomes a never-ending cycle of tweaking and hoping things improve. Sometimes you just need better tools.