The core EOP and Defender for Office 365 mail policies in depth, spoof and impersonation protection, SCL and BCL verdicts, outbound limits, the common attachments filter, connection filtering, the Tenant Allow/Block List, quarantine policies, Standard versus Strict values side by side, and the order in which it all evaluates.
How Attack simulation training builds and reports on phishing simulations, how the Outlook Report button and the reporting mailbox are configured, and how the Priority account tag and custom user tags change protection and visibility in Defender for Office 365.
Time-of-click URL scanning in email, Office apps and Teams, attachment detonation with Block and Dynamic Delivery, Safe Attachments for SharePoint, OneDrive and Teams, Safe Documents, ZAP for Teams, and which settings live in a policy versus the global switch.
The Defender for Office 365 investigation toolset, Threat Explorer and Real-time detections, the email entity page, quarantine and quarantine policies, admin and user submissions, automated investigation and response, message trace, and the Email tables in Advanced Hunting with working KQL.