Email Security

Email security is primarily supported through the Microsoft Office 365 Email service.  All email is filtered and sanitized by this service before delivering to users and other services including O365 mailboxes, Gmail, and other forwarding services.  User experience and functionality may be slightly different depending on where your mailbox is maintained and this document is intended to provide a high-level overview only.

Microsoft Defender for Office 365 Service

Safe Attachments

Safe Attachments protects against unknown malware and viruses, and provides zero-day protection to safeguard your messaging system. All messages and attachments that don't have a known virus/malware signature are routed to a special environment where Defender for Office 365 uses a variety of machine learning and analysis techniques to detect malicious intent. If no suspicious activity is detected, the message is released for delivery to the mailbox.

Safe Links

The Safe Links feature proactively protects your users from malicious URLs in a message or in an Office document. The protection remains every time they select the link, as malicious links are dynamically blocked while good links can be accessed.

Safe Links is available for URLs in the following apps:

  • Microsoft 365 Apps for enterprise on Windows or Mac

  • Office for the web (Word for the web, Excel for the web, PowerPoint for the web, and OneNote for the web)

  • Word, Excel, and PowerPoint on Windows

  • Microsoft Teams channels and chats

Anti-phishing policies

Anti-phishing checks incoming messages for indicators that a message might be a phishing attempt. When users are covered by Defender for Office 365 policies (Safe Attachments, Safe Links, or anti-phishing), incoming messages are evaluated by multiple machine learning models that analyze messages and the appropriate action is taken, based on the configured policies.

Real-time detections

Real-time detection is a real-time report that lets authorized users identify and analyze recent threats.  By default, this report shows data for the past seven days.

Real-time detections contain views, such as Malware (for email and content), Submissions, and Phish. 




Article ID: 132901
Wed 6/2/21 11:18 AM
Wed 6/2/21 11:21 AM