Exam MS-500 topic 2 question 13 discussion

To meet the second requirement, it is necessary in Default Antiphishing policy settings to scroll down and find Advanced settings. Edit it and set Advanced phishing threshold to "Most Aggressive" instead of "Standard"

* Phishing email messages must be quarantined if the messages are sent from a spoofed domain. * AS MANY phishing email messages AS POSSIBLE must be identified. Default Policy * Impersonation -> Edit * Add domains to protect -> Automatically Include the Domains I own -> ON * Actions -> If email is sent by an impersonated user: QUARANTINE * Actions -> If email is sent by an impersonated domain: QUARANTINE * Mailbox Intelligence -> If email is sent by an impersonated user: QUARANTINE * Advanced Settings -> Edit * Advanced phishing thresholds -> MOST AGGRESSIVE

couldn't edit default phishing policy --> work around ? Go to Security admin --> policy and rules --> phishing policy --> new policy , add name /description, add users and select your own domain --> phishing email threshold ...max 4--> enable domains to protect , select your own --> enable mailox intelligence, enable intelligence for impersonaion, enable spoof intelligence, under ACTIONS if messge detected as spoof select quarantine, save policy, and then move it up as priority against other policies...would this work??

From the M365 admin center: Go to Security admin center > Policies & rules (under Email & collaboration) > Threat policies > Anti-phishing

I agree with Toyo on this one, although Oz is being more cautious, the increased number of false positives is not a good for production or accuracy. However here is the new reference link as of 06/04/2021: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies?view=o365-worldwide

What about Spoof settings? Default here is move to junk. === Editing Spoofing filter settings Editing Actions If the person spoofing your domain isn't an allowed sender, we'll apply the action you choose here. ===

Walk though with video... https://support.microsoft.com/en-us/office/protect-against-phishing-attempts-in-microsoft-365-86c425e1-1686-430a-9151-f7176cce4f2c Make sure you also also complete Oz's recommendation to change the threshold too.

I don't think the Advanced Phishing Threshold should be raised because the question did not request the threshold be raised. Raising the threshold to "Most Aggressive" may result in high number of false positives.