defender-for-office-365

name	defender-for-office-365
description	Guidance for Microsoft Defender for Office 365 (MDO) — protection for email and collaboration (Teams, SharePoint, OneDrive) against phishing, malware, spoofing, and business email compromise. Covers Plan 1 vs Plan 2 selection, preset security policies (Standard/Strict), Safe Links, Safe Attachments, anti-phishing impersonation protection, configuration analyzer drift detection, Submissions portal triage, Threat Explorer hunting, AIR, and attack simulation training. WHEN: Defender for Office 365, MDO, email security policy, Safe Links, Safe Attachments, anti-phishing, anti-spoofing, impersonation protection, preset security policies, Standard preset, Strict preset, configuration analyzer, phishing protection, attack simulation training, Threat Explorer, Submissions portal, tenant allow block list, BEC, business email compromise, DMARC, MDO Plan 1 vs Plan 2. DO NOT USE for endpoint protection (use defender-for-endpoint) or M365 oversharing (use purview-copilot-oversharing).
license	MIT
metadata	{"author":"Microsoft","version":"0.1.0"}

Microsoft Defender for Office 365

Microsoft Defender for Office 365 (MDO) protects email and collaboration workloads against phishing, malware, spoofing, and business email compromise. It provides preset policies, detonation (Safe Attachments), time-of-click URL protection (Safe Links), post-delivery detection and hunting (Threat Explorer + AIR), and attack simulation training.

When to use

Securing Exchange Online mail flow and Microsoft 365 collaboration (Teams, SharePoint, OneDrive). Use this skill for plan/preset decisions, control configuration, drift detection, and SOC operations on email incidents.