The core EOP and Defender for Office 365 mail policies in depth, spoof and impersonation protection, SCL and BCL verdicts, outbound limits, the common attachments filter, connection filtering, the Tenant Allow/Block List, quarantine policies, Standard versus Strict values side by side, and the order in which it all evaluates.
How Attack simulation training builds and reports on phishing simulations, how the Outlook Report button and the reporting mailbox are configured, and how the Priority account tag and custom user tags change protection and visibility in Defender for Office 365.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
The Microsoft 365 email protection stack in layers, Exchange Online Protection, Defender for Office 365 Plan 1 and Plan 2, what each adds, which SKUs carry which, the filtering pipeline, preset versus custom policies and the precedence order, the configuration analyzer and how to trial Plan 2 in audit mode.
Time-of-click URL scanning in email, Office apps and Teams, attachment detonation with Block and Dynamic Delivery, Safe Attachments for SharePoint, OneDrive and Teams, Safe Documents, ZAP for Teams, and which settings live in a policy versus the global switch.
How Exchange Online Protection evaluates inbound and outbound mail authentication, composite authentication and its reason codes, DKIM signing for custom domains, honouring DMARC in anti-phishing policy, trusted ARC sealers and Enhanced Filtering for third-party gateways, and a staged plan to reach p=reject.
Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.
The Defender for Office 365 investigation toolset, Threat Explorer and Real-time detections, the email entity page, quarantine and quarantine policies, admin and user submissions, automated investigation and response, message trace, and the Email tables in Advanced Hunting with working KQL.
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.