You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This project implements a Zero Trust email security framework using Microsoft Defender for Office 365 Plan 2 across the Patchthecloud.onmicrosoft.com tenant. Email is treated as an untrusted entry point — every attachment is detonated before delivery, every link is inspected at click time, and sender identity is continuously validated against known impersonation patterns.
The implementation covers the full defence-in-depth stack: pre-delivery sandbox analysis (Safe Attachments), click-time URL inspection (Safe Links), identity-based phishing detection (Anti-Phishing with mailbox and spoof intelligence), user-reported threat visibility, and post-delivery automated remediation. Secure Score increased by +55 points across the two-day implementation window.
Business Problem
Layer
Problem
Attachment threats
Malicious files reach user mailboxes without pre-delivery analysis
URL-based attacks
Phishing links embedded in email bypass perimeter controls after delivery
Impersonation / BEC
CEO fraud and domain spoofing exploit trusted sender relationships
User behaviour gap
Users have no structured mechanism to report and escalate suspicious email
Visibility
SOC has no unified telemetry for email-borne threats, clicks, or remediation events
Objectives
Deploy Safe Attachments with Block action and quarantine using AdminOnlyAccessPolicy
Deploy Safe Links with full URL rewriting, real-time scanning, and Teams/Office app coverage
Configure anti-phishing with mailbox intelligence, domain impersonation protection, and spoof intelligence
Enable user-reported phishing and validate via attack simulation
Demonstrate measurable Secure Score improvement as evidence of controls applied
Environment
Component
Value
Tenant
Patchthecloud.onmicrosoft.com
Licence
Microsoft 365 Business Premium / Defender for Office 365 Plan 2
flowchart TD
A[External Sender] --> B[Exchange Online\nInbound Mail Flow]
B --> C{Defender for Office 365\nEmail Inspection Pipeline}
C --> D[Safe Attachments\nSandbox Detonation]
C --> E[Anti-Phishing\nImpersonation + Spoof Intelligence]
C --> F[Anti-Malware\nSignature Scan]
D -->|Clean| G[Deliver to Mailbox]
D -->|Malware detected| H[Block + Quarantine\nAdminOnlyAccessPolicy]
E -->|Legitimate| G
E -->|Impersonation / Spoof| I[Quarantine\nAdminOnlyAccessPolicy]
G --> J[User Mailbox\nPatchthecloud.onmicrosoft.com]
J --> K{User Action}
K -->|Click link| L[Safe Links\nReal-time URL Scan]
L -->|Safe URL| M[Allow — Redirect to destination]
L -->|Malicious URL| N[Block page displayed]
K -->|Report suspicious mail| O[User-Reported Phishing\nDefender Ingestion]
O --> P[Threat Intelligence\nDefender XDR Correlation]
subgraph PostDelivery["Post-Delivery Protection — Assume Breach"]
Q[Zero-Hour Auto Purge\nZAP]
R[Historical email scan\nRetroactive quarantine]
end
J --> PostDelivery
subgraph Visibility["Control & Visibility Plane"]
S[Defender XDR\nIncidents & Alerts]
T[Microsoft Secure Score\n+55 pts increase]
end
H --> S
I --> S
P --> S
PostDelivery --> S
Loading
Microsoft Technologies
Technology
Role
Microsoft Defender for Office 365 Plan 2
Unified email threat protection platform
Safe Attachments
Pre-delivery sandbox detonation of all email attachments
Safe Links
Click-time URL rewriting and inspection (Email, Teams, Office apps)
Converts user reports into Defender threat signals
Zero-Hour Auto Purge (ZAP)
Retroactive post-delivery removal of detected threats
Microsoft Secure Score
Measurable security posture improvement tracking
Attack Simulation Training
Real-world phishing simulation and user awareness validation
Configuration Overview
Safe Attachments — Safe Attachments
Setting
Value
Action
Block — current and future messages with detected malware
Quarantine policy
AdminOnlyAccessPolicy
Redirect attachments
Disabled
Applied to
All recipients
Date configured
10 January 2026
Enterprise rationale: Block action prevents any attachment from reaching users when malware is detected — including blocking subsequent messages from the same sender. AdminOnlyAccessPolicy ensures quarantined items require administrator review before release.
Safe Links — Safe Links Policy
Setting
Value
Priority
0 (highest)
Status
On
Email — Safe Links enabled
On
Apply to internal email
On
Real-time URL scanning
On
Wait for scan before delivery
On
Do not rewrite (API-only mode)
On
Teams
On
Office 365 Apps
On
Date configured
11 January 2026
Enterprise rationale: Wait for URL scanning before delivery eliminates the race condition where users receive email before links are evaluated. Teams and Office app coverage closes the gap where attackers pivot to non-email channels.
Safe Attachments Block mode delays delivery. Sandbox detonation adds latency. Communicate to users before enabling in production.
"Do not rewrite URLs" + API-only mode is not reduced security. Defender still evaluates every URL via the Safe Links API — this mode prevents URL modification in email body, improving compatibility with mail clients that break rewritten links.
Anti-phishing threshold 1 (Standard) is appropriate for most tenants. Increasing to 4 (Aggressive) significantly increases false positives on internal business email. Tune based on SOC capacity to review quarantine.
User-reported phishing single reports may not generate alerts. This is documented Defender behaviour — alerts are generated when reports correlate with other signals. Single-user reports still contribute to threat intelligence.
Secure Score is a lagging indicator. Points register after Defender detects and scores the control, not immediately after policy creation.
Troubleshooting
Symptom
Likely Cause
Resolution
Legitimate email quarantined
Anti-phishing false positive
Review quarantine → release + add sender to trusted senders list
URL not being rewritten
API-only mode enabled
Expected behaviour — Defender still scans via API
Safe Attachments delay
Sandbox detonation in progress
Inform users; configure Wait for scanning only on high-risk groups if latency unacceptable
Secure Score not updating
Score refreshes every 24 hours
Wait 24h; verify policy is saved and assigned
Attack simulation blocked by Safe Links
Safe Links evaluated the test URL
Use Microsoft-provided simulation URLs from Attack Simulation Training to avoid false blocks
Future Improvements
Increase anti-phishing threshold to 2 (Aggressive) for executive accounts
Add named VIP users to user impersonation protection list
Enable Attack Simulation Training recurring campaigns for user resilience measurement
Connect Defender for Office 365 alerts to Microsoft Sentinel for unified SOC visibility
Configure DMARC p=reject on Patchthecloud domain to prevent outbound spoofing
Enable Safe Documents (block exit from Protected View) for high-risk user groups
Zero Trust email security implementation using Microsoft Defender for Office 365 — Safe Attachments, Safe Links, anti-phishing, and automated post-delivery remediation.
