Defender for Office 365 preset security policies set a better baseline

In a lot of the Microsoft 365 tenants I review, email protection is still driven by old, hand-built transport rules and custom policies nobody has touched in years. When I bring up Defender for Office 365 preset security policies, I usually find the organization is relying on filters that never kept pace with newer attack techniques or with Microsoft's best practices. The preset security policies have been around for years and offer a much simpler and more effective baseline. They are quick to deploy, Microsoft keeps them updated, and there is far less room for misconfiguration.

Microsoft offers three preset levels with Standard, Strict and Built-In Protection

For Exchange Online Protection (EOP) and Defender for Office 365, Microsoft provides three levels of preset security policies: Standard, Strict, and Built-In Protection. They are meant as a solid baseline for most environments and are assigned tenant-wide. Standard covers all regular users. Strict is intended for groups that attackers target heavily, such as executives or admins. Built-In Protection is the fallback for any mailbox that hasn't been explicitly assigned to a policy. The diagram below shows the precedence and how assignment flows:

flowchart TD
  A["Custom Policy"] --> B["Preset Strict"]
  B --> C["Preset Standard"]
  C --> D["Built-In Protection"]
  D --> E["No Protection"]

Figure: The order in which Defender for Office 365 processes policies, from most specific to least specific.

This order matters a lot. Custom policies always take precedence over the presets, and in real tenants that often leaves people stuck with outdated or incomplete protection. Microsoft's guidance is unambiguous here: use the preset security policies wherever you can and add custom rules only sparingly for special cases (Microsoft's documentation on preset policies).

The presets bundle several layers of protection

A preset security policy combines anti-spam, anti-malware and anti-phishing (impersonation protection included). With Defender for Office 365 licences you also get Safe Links and Safe Attachments. Impersonation protection is particularly strong, because it catches senders who try to pass themselves off as executives or trusted partners. You can keep your own allow lists for user and domain impersonation, though I'd go easy on them. The presets also apply quarantine policies and user notifications by default, and that is something I regularly find missing or set up inconsistently in older custom policies.

Practical tip: Check your impersonation allow lists on a regular schedule. Any domain or address that ends up on that list is extremely valuable to an attacker, so keep it short, review every change and keep a close eye on how it's used.

Built-In Protection catches every mailbox nobody assigned

Built-In Protection gets overlooked easily, yet it matters. It automatically protects every mailbox that isn't assigned to a custom or preset policy, which includes newly created users, shared mailboxes and accounts that simply slipped through. You can't adjust its settings, but it is clearly better than having nothing. To see which mailboxes fall under which policy, the Microsoft 365 Defender portal gives you a clear overview.

The configuration analyzer shows where your policies fall short

Because custom policies override the presets, you should compare your actual configuration with Microsoft's recommendations on a regular basis. The configuration analyzer helps with that and shows how your current custom policies measure up against Microsoft's best practices (configuration analyzer). In many environments I look at, the gap is obvious: old spam filters, phishing controls that are missing, or Zero-Hour Auto Purge (ZAP) not turned on at all. Microsoft also publishes a compact overview of the recommended settings for EOP and Defender for Office 365 (recommended settings).

A short PowerShell check shows you which policies are actually in place:

Get-HostedContentFilterPolicy | Select Name, IsDefault

If the output is full of old custom rules, you have some cleaning up to do.

Quarantine policies and user notifications handle what happens after detection

This is another benefit people tend to miss. Preset policies don't stop at detecting threats, they also deal with the next step. Reasonable quarantine policies and user notifications are included out of the box, so users actually find out when a suspicious message has been blocked or held back. Under the Standard and Strict presets, malicious mail is consistently sent to quarantine, which keeps it out of the inbox and leaves the decision to release it with the admins. IT and SOC teams benefit from this directly, and it closes a blind spot I see far too often in legacy setups.

Policy sprawl keeps many tenants stuck on legacy rules

In my experience the main reason is policy sprawl. Custom filters pile up over the years, nobody revisits them, and many were created before Defender for Office 365 even existed. A lot of admins worry about false positives and never updated their rules for newer features like Safe Links or the improved impersonation detection, which are only guaranteed in the presets. Keeping custom policies current means copying every new setting by hand, and hardly anyone manages that over time. SPF, DKIM and DMARC (SPF/DKIM/DMARC setup) are another classic case: if the alignment isn't right, even the best preset policy can be undermined. You need regular reviews and a move to modern, recommended policies.

I treat presets as the new baseline

Defender for Office 365 preset security policies won't solve everything, but every M365 tenant needs them as its foundation. Holding on to old custom rules leads to security gaps and constant manual maintenance. The presets are updated regularly by Microsoft, so your baseline protection keeps up with new threats. If you have unique requirements, add targeted custom policies for those and let the presets cover the rest. My advice is to audit your configuration with the configuration analyzer, retire the legacy custom rules and only add your own policies where you really need them. That keeps your email protection strong and still manageable.