Locking Down Exchange Online: Ten Settings Most Tenants Miss

Exchange Online includes strong built-in filtering, but a default Microsoft 365 tenant is not necessarily a fully hardened email environment.

Many organisations enable multifactor authentication and assume the mailbox is protected. Meanwhile, automatic forwarding remains poorly governed, SMTP AUTH is still available to unnecessary accounts, impersonation protection covers too few people and email-authentication records have never reached DMARC enforcement.

Attackers look for exactly these gaps.

The good news is that improving Exchange Online security does not require dozens of complicated policies. A focused review of ten commonly missed settings can significantly reduce phishing, mailbox compromise, data leakage and business email fraud.

1. Apply a Preset Security Policy

Microsoft provides Standard and Strict preset security policies in Microsoft Defender for Office 365. These combine recommended anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments settings into managed policy packages. Microsoft recommends using these presets rather than relying only on the editable default policies. 

For many small and medium-sized businesses:

• Apply Standard protection to most users.
• Apply Strict protection to administrators, directors, finance staff and other high-risk users.
• Test affected workflows before broad enforcement.

Preset policies also reduce configuration drift because Microsoft maintains their recommended settings as threats and product features change.

Do not assume the default anti-spam policy provides the same protection as the Standard preset.

2. Configure Impersonation Protection

Spoofing and impersonation are related but different threats.

Spoofing typically involves falsifying a sender domain or address. Impersonation may use a similar-looking address, display name or domain to make a message appear to come from a director, supplier or trusted brand.

Microsoft’s basic anti-phishing protections are available for cloud mailboxes, including spoof intelligence. Defender for Office 365 adds advanced user, domain and mailbox-intelligence impersonation protections. 

Prioritise protection for:

• Directors and executives
• Finance and payroll employees
• HR
• IT administrators
• Employees who authorise payments
• Frequently impersonated suppliers
• Your accepted email domains

Review the impersonation insight regularly rather than creating the policy and forgetting it. A newly targeted executive or supplier may need to be added later.

3. Block Automatic External Forwarding

Automatic forwarding gives attackers a quiet way to keep receiving email after compromising a mailbox.

They may create an inbox rule or administrator-level mailbox forwarding configuration that redirects invoices, password resets and customer conversations to an external address.

In the outbound spam policy, set automatic forwarding explicitly to:

Off — Forwarding is disabled

This blocks external automatic forwarding through both user inbox rules and administrator-configured mailbox forwarding for the covered users. Internal forwarding is unaffected. Microsoft notes that the former Automatic — System-controlled setting now behaves like Off, but an explicit setting is clearer for auditing and administration. 

Where a legitimate application requires forwarding, use a narrowly scoped exception policy instead of enabling it tenant-wide.

4. Disable SMTP AUTH Where It Is Not Needed

SMTP AUTH is commonly left enabled for printers, scanners, websites and older business applications.

The protocol itself can use OAuth, but many older implementations still rely on stored usernames and passwords. Every unnecessary mailbox with SMTP AUTH enabled creates another authentication route to monitor.

Review the organisation-level and mailbox-level settings:

Get-TransportConfig |

    Format-List SmtpClientAuthenticationDisabled

Get-CASMailbox user@company.co.uk |

    Format-List SmtpClientAuthenticationDisabled

Disable SMTP AUTH across the organisation where possible, then enable it only for documented accounts that genuinely require it. Replace Basic authentication with OAuth, an appropriate relay design or a purpose-built email service.

Microsoft is continuing its retirement of Basic authentication for SMTP AUTH, so old dependencies should be identified and modernised rather than left until they fail. 

5. Complete SPF, DKIM and DMARC

SPF, DKIM and DMARC work together to help receiving systems confirm whether messages claiming to come from your domain are legitimate.

• SPF identifies permitted sending systems.
• DKIM adds a cryptographic signature to outbound messages.
• DMARC checks domain alignment and tells recipients what to do when authentication fails.

Microsoft recommends configuring all three for the strongest email-authentication posture. SPF alone is not enough, particularly when several cloud applications send mail using your domain. 

A sensible DMARC rollout is:

1. Inventory every legitimate email sender.
2. Configure SPF and DKIM correctly.
3. Publish DMARC with p=none.
4. Review aggregate reports.
5. Fix legitimate failures.
6. Progress to p=quarantine.
7. Move to p=reject when confident.

DMARC enforcement helps prevent attackers from directly spoofing your domain, but a rushed p=reject deployment can block legitimate services that were never added to the inventory.

6. Turn On Safe Links

Safe Links provides time-of-click URL checking for supported email, Teams and Microsoft 365 applications. It supplements normal spam and malware filtering by evaluating links when users select them, helping protect against websites that become malicious after the original message was delivered. 

Review whether Safe Links covers:

• Email messages
• Internal messages
• Microsoft Teams
• Supported Office applications
• High-risk users
• URLs that users cannot click through after detection

Avoid adding broad allow lists simply because one legitimate campaign was incorrectly blocked. Investigate the sender and URL first, then create the narrowest possible exception if required.

Safe Links requires suitable Defender for Office 365 licensing.

7. Turn On Safe Attachments

Safe Attachments opens suspicious files in a virtual environment to analyse their behaviour before or after delivery, depending on the selected policy action. It is designed to identify threats such as malware and ransomware that may evade ordinary signature-based scanning. 

For most organisations, use the Standard or Strict preset rather than designing a completely separate Safe Attachments policy without a specific reason.

Test:

• Delivery delays
• Dynamic Delivery behaviour
• Shared-mailbox coverage
• Attachment-heavy business processes
• Notifications and quarantine handling

Also review Safe Attachments protection for SharePoint, OneDrive and Teams where your licensing supports it. A malicious attachment is not safe merely because it arrived through a shared document link instead of email.

8. Review Quarantine Policies and User Release Rights

Quarantine is not simply a place where suspicious mail waits. Its policy determines what users can view, preview, release or report.

Microsoft 365 retains many quarantined phishing, malware and spam messages for defined periods, often 30 days depending on the threat and policy. 

Review whether users can release:

• High-confidence phishing
• Malware
• Messages quarantined by Safe Attachments
• Bulk or ordinary spam

Employees generally should not be able to release the most dangerous categories without administrator review.

At the same time, make sure administrators:

• Review quarantine regularly
• Receive useful notifications
• Understand false-positive procedures
• Release messages only after inspecting authentication and message details

A secure quarantine policy should reduce risk without turning every harmless newsletter into an IT ticket.

9. Audit Mail-Flow Rules and Bypass Lists

Exchange mail-flow rules are powerful. They can redirect, reject, quarantine, modify or bypass filtering for messages.

That power also makes them risky.

Review rules that:

• Set the spam confidence level to -1
• Bypass spam filtering
• Bypass Safe Links or Safe Attachments
• Redirect messages externally
• Blind-copy another recipient
• Add broad sender or domain exceptions
• Apply based only on easily forged headers

Microsoft warns that mail-flow rules can bypass much of the built-in spam filtering, even though spam protection cannot be completely disabled. 

Every bypass should have:

• A documented business reason
• A named owner
• Narrow conditions
• An expiry or review date
• Evidence that the sender is authenticated securely

Also check the Tenant Allow/Block List and spoof-intelligence overrides. A permanent allow entry created during troubleshooting may later provide an attacker with a trusted route into the organisation.

10. Configure Alerts and Review Restricted Entities

Exchange Online security should not depend entirely on administrators manually checking reports.

Microsoft provides alert policies for activity such as phishing campaigns, malware, unusual message behaviour and administrative changes. 

Make sure somebody receives and investigates alerts involving:

• Suspicious outbound email
• Users restricted from sending
• New forwarding rules
• Unusual inbox-rule creation
• Administrative policy changes
• Malware or phishing campaigns
• Unexpected connector activity

Review the Restricted entities page when a user or connector is blocked for suspicious outbound activity. Do not simply remove the restriction to restore mail flow. First determine whether the account was compromised, revoke sessions, reset authentication and remove any malicious rules or application consent. 

A Practical Exchange Online Hardening Order

Trying to change all ten areas at once can create unnecessary disruption.

A sensible sequence is:

1. Apply Standard preset protection to a pilot group.
2. Configure impersonation protection for executives and finance.
3. Block automatic external forwarding.
4. Review SMTP AUTH and legacy dependencies.
5. Complete SPF, DKIM and DMARC.
6. Roll out Safe Links and Safe Attachments.
7. Tighten quarantine permissions.
8. Audit transport rules and allow lists.
9. Configure alerts and escalation procedures.
10. Expand the hardened policy set across the tenant.

Use pilot groups and change records. Email is business-critical, so every security improvement should be tested against legitimate mail flow.

Common Exchange Online Security Mistakes

Assuming Microsoft’s Defaults Are Enough

Exchange Online includes strong built-in protection, but default policies may not include every recommended advanced setting. 

Allowing Whole Domains to Fix One False Positive

A broad allow entry can permit malicious mail from another compromised account in that domain.

Enabling DMARC Reject Too Early

Unknown legitimate senders may be blocked before SPF and DKIM alignment has been corrected.

Leaving SMTP AUTH Enabled for Everyone

One old scanner becomes the reason every mailbox retains an unnecessary authentication route.

Letting Users Release High-Confidence Phishing

The quarantine stops the attack, then the employee delivers it to themselves.

Creating Permanent Exceptions

Temporary migration, testing and supplier exceptions remain in place long after the original need ends.

Exchange Online Security Checklist

• Apply Standard and Strict preset security policies appropriately.
• Protect executives, finance staff and trusted domains from impersonation.
• Block automatic external forwarding.
• Disable SMTP AUTH unless specifically required.
• Configure SPF, DKIM and DMARC.
• Enable Safe Links.
• Enable Safe Attachments.
• Restrict quarantine release permissions.
• Review mail-flow rules and bypass entries.
• Configure alerts and investigate restricted users properly.

Repeat the review after licensing changes, migrations, new email platforms or major security incidents.

Final Thoughts

Exchange Online security is rarely weakened by one dramatic mistake.

The larger risk is a collection of small gaps: an unused SMTP route, an overlooked forwarding setting, an overly broad allow rule and an executive who was never added to impersonation protection.

Closing those gaps creates a much stronger email environment without making everyday communication unnecessarily difficult.

Start with Microsoft’s preset protections, then review forwarding, authentication, impersonation, email authentication, quarantine and administrative exceptions.

The objective is not to block more email.

It is to make sure genuine messages arrive while phishing, malware and unauthorised data movement do not.

Need Help Locking Down Exchange Online?

Hamilton Group can help your organisation review and harden Microsoft 365 email security.

Our experts can help you:

• Deploy Standard and Strict preset policies
• Configure anti-phishing and impersonation protection
• Block external auto-forwarding
• Audit and disable SMTP AUTH
• Configure SPF, DKIM and DMARC
• Deploy Safe Links and Safe Attachments
• Review quarantine permissions
• Audit mail-flow rules and allow lists
• Configure security alerts
• Investigate compromised mailboxes and outbound spam

Visit hgmssp.com, call Hamilton Group on 0330 043 0069, or book a meeting with one of our experts to close the Exchange Online security gaps most tenants overlook.