Forum Discussion
Block Display Name Spoof in EAC
You can try a mail flow rule, although there is no "display name" condition available, so you'll have to go with "header matches" or similar.
dgillespie-adf I have had success with the Impersonation policy under phishing wherein we tested with <Myname> myname@domain.com added to the list of users to protect and send an email from <Myname> xyz@somedomain.com . The policy detected it to be impersonation.
I wanted to test this safely with the Senior management email address and trying figure out a safe way to do that. documentation is here
Vaman-Kini that's great until the threat actor finds a variation of the employees name and uses that. For example, on linked in an employee might have First Middle Last name. But in MS only have First and Last. You cannot enter another entry to include the middle name as you will get an "Email already exists" for that email account you're trying to protect.
