Forum Discussion

Sergg's avatar
Sergg
Iron Contributor
Mar 29, 2021

How to set Impersonation Protection users with Preset Policies?

Hello,

 

Microsoft suggesting using preset (Standard or Strict) policies for EOP and Defender for Office. Is there a list of settings to tune after applying presets?

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365 

 

For example  found that Impersonation Protection cone with ZERO protected users (i also read there is an overall 60 user limit per rule). How do i set my protected users? Microsoft link suggests:

The default anti-phishing policy in Microsoft Defender for Office 365 provides https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide#spoof-settings and mailbox intelligence for all recipients. However, the other available https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365 features and https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide#advanced-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365 are not configured or enabled in the default policy. To enable all protection features, modify the default anti-phishing policy or create additional anti-phishing policies.

But i thought one can not modify default policies. Here is how it looks in default strict settings:

 

3 Replies

  • tvisconti's avatar
    tvisconti
    Brass Contributor

    Sergg 

     

    I believe that for a given user you have to decide whether or not you are going to use the presets.  If you use the presets that you cannot make use of impersonated user protection at this time.
    https://www.reddit.com/r/Office365/comments/k65ip2/how_to_add_impersonation_settings_to_antiphishing/gej4ju1/

  • mspjax's avatar
    mspjax
    Copper Contributor

    Sergg Did you ever find an answer to this?  Have the exact same question.

    • Sergg's avatar
      Sergg
      Iron Contributor
      Sorry, I do not remember what was our final decision on that occasion.

Resources