Microsoft Defender for Office 365 documentation

Learn about the robust security solutions in Defender for Office 365 to better protect your email and collaboration tools.

Defender for Office 365 & Exchange Online Protection

Overview

• Office 365 Security overview
• Set up with Preset security policies in EOP and Defender for Office 365

Getting started with Defender for Office 365

Get Started

• Protect against threats
• Preset security policies in EOP and Microsoft Defender for Office 365
• What's new in Microsoft Defender for Office 365

Evaluate Defender for Office 365

How-To Guide

• Try Defender for Office 365
• Migrate to Defender for Office 365

Setting up Email Authentication protection

How-To Guide

• Set up SPF to help prevent spoofing
• Use DKIM to validate outbound email sent from your custom domain
• Use DMARC to validate email

Set up Exchange Online Protection

Overview

• Exchange Online Protection overview
• Recommended settings for EOP and Microsoft Defender for Office 365 security for set up

Prevent

Overview

• Configure your Microsoft 365 tenant for increased security
• Configuration analyzer in EOP and Defender for Office 365
• Gain insights through Attack simulation training

Detect

Overview

• Mail flow rules (transport rules) in Exchange Online
• Threat Trackers
• Email security reports in the Microsoft 365 Defender portal

Investigate

Overview

• Views in Threat Explorer and real-time detections
• Campaign Views in Microsoft Defender for Office 365
• Investigate malicious email that was delivered in Office 365
• View Defender for Office 365 reports

Investigate in EOP

Overview

• Reporting and message trace in EOP
• View the admin audit log

Respond

Overview

• Remediate malicious email delivered in Office 365
• Respond to a Compromised Email Account
• Remediate Outlook Rules and Custom Forms Injections Attacks
• Submit False Positives/False Negatives

Automate

Overview

• How Automated Investigation and Response (AIR) works in Defender for Office 365
• Get Started with AIR in Defender for Office 365
• Address compromised user accounts with AIR