---
name: Exchange Anti-Phishing Coverage
description: Audit Microsoft Defender for Office 365 anti-phishing, spoof and impersonation protection policy coverage across all mailboxes.
---

# Exchange Anti-Phishing Coverage

> **TL;DR:** This read-only skill audits Microsoft Defender for Office 365 anti-phishing, spoof intelligence and impersonation protection policies, then scores how completely your Exchange Online mailboxes are covered.

## How Microsoft Defender for Office 365 protects Exchange Online

Microsoft Defender for Office 365 layers anti-phishing protection on top of Exchange Online Protection to defend mailboxes against spoofing and impersonation. Anti-phishing policies in Microsoft Defender XDR combine spoof intelligence, mailbox intelligence and user or domain impersonation protection. Signals also surface in Microsoft Defender XDR and can be forwarded to Microsoft Sentinel for correlation, while Microsoft Purview retains the audit trail.

## When should you run this skill?

- "Are all my mailboxes covered by an anti-phishing policy?"
- "Which users have no impersonation protection configured?"
- "Is spoof intelligence enabled across the tenant?"
- "Do my anti-phishing policies leave gaps in coverage?"
- "Show me the priority order of my Defender for Office 365 anti-phish policies."
- "Are quarantine and safety tip actions set for detected phishing?"
- "What is our anti-phishing posture before an Essential Eight assessment?"

## How this skill works, step by step

1. Read the tenant anti-phishing policies and their associated rules to map which policies are enabled.
2. Enumerate the recipient, group and domain conditions on each policy rule to determine which mailboxes are in scope.
3. Read all Exchange Online mailboxes and reconcile them against the in-scope sets to find uncovered or default-only mailboxes.
4. Inspect each policy for spoof intelligence, mailbox intelligence and first-contact safety tip settings.
5. Inspect user impersonation and domain impersonation protection lists, including protected domains and trusted senders.
6. Check the configured actions for detected spoofing and impersonation, such as quarantine, move to junk, or redirect.
7. Evaluate policy priority order to identify whether higher-priority policies leave weaker settings effective.
8. Derive a coverage risk score from the percentage of mailboxes covered, weighted by whether impersonation protection, spoof intelligence and strong actions are enabled; gaps and disabled policies raise the score.
9. Output a ranked findings table with remediation guidance, highest risk first.

## Output format

| Mailbox or domain | Covering policy | Impersonation protection | Spoof intelligence | Risk |
| --- | --- | --- | --- | --- |
| `exec@contoso.com` | Default only | Not protected | On | High |
| `sales@contoso.com` | Strict Anti-Phish | Protected | On | Low |

Summary of the audit:

- Total mailboxes assessed and the count covered only by the default policy.
- Number of users and domains flagged for missing impersonation protection.
- Overall tenant coverage percentage and aggregate risk rating.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Anti-phishing spoof and mailbox intelligence | Microsoft Defender for Office 365 Plan 1 |
| User and domain impersonation protection | Microsoft Defender for Office 365 Plan 1 |
| Exchange Online mailbox enumeration | Exchange Online Plan 1 |

### Least-privilege roles

- Global Reader (read-only visibility of security and Exchange configuration)
- Security Reader (read-only access to Defender for Office 365 policies)

### Microsoft Graph permissions (read-only)

- `User.Read.All` - reads mailbox-enabled user accounts to reconcile coverage
- `Group.Read.All` - reads groups used as policy recipient conditions
- `Domain.Read.All` - reads accepted domains used in domain impersonation scope
- Anti-phishing policy and rule settings are not exposed in Microsoft Graph; read them via the Microsoft Defender portal or the Exchange Online PowerShell cmdlets `Get-AntiPhishPolicy` and `Get-AntiPhishRule`.

## Scope and safety

This skill is read-only by default. It inspects policy, rule and mailbox configuration and reports findings without altering tenant state.

This skill does NOT:

- Create, modify, enable, disable or delete any anti-phishing policy or rule.
- Change impersonation lists, trusted senders, or spoof intelligence allow or block entries.
- Read, release or purge messages from quarantine.
- Alter mailbox, group or domain configuration.

## Sources and compliance

- [Anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Anti-phishing protection in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-protection-about)
- Supports the ASD Essential Eight mitigation strategy of restricting and hardening email-borne threats, complementing user application hardening and reducing phishing-led compromise.
- Aligns with ISM controls for email filtering and protective email gateway configuration.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.