Over the last several months, we have made many advancements to Office 365 Advanced Threat Protection (ATP). Due to our impressive malware catch effectiveness, threat actors have altered attack meth...
A new option called "Enable mailbox intelligence based impersonation protection" is now available in the Mailbox Intelligence > Impersonation Policy settings.
Additionally, there is a new setting within Mailbox Intelligence to apply an action "If email is sent by an impersonated user".
Can you you share some details about these new features, and how this action relates to already existing "If email is sent by an impersonated user" setting in the Actions section?
It seems these policy settings are similar, it would be good to understand the precedence of each and what circumstanced would trigger these actions to apply.
Also posed the question in the Feedback section of https://docs.microsoft.com/en-us/office365/securitycompliance/set-up-anti-phishing-policies#phishpolicyoptions, which directed me to this page.