Policies

Policies are the meat of Defender for Office 365 and where you will spend the most time during the initial months. It is important to understand the impact of these policies as they relate to inbound messages.

Quarantine policy

Quarantine policies provide a modular way to control what actions are taken on quarantine messages and files. Depending on the maturity of the organization, different quarantine policies can be applied depending on the environment (production versus test), user base (test users, regular users, and VIP), and even the use of groups of devices. Quarantine policies also work with other policies, including the anti-spam policy (discussed in the next section) and the anti-malware policies (discussed in Chapter 8). Let’s review the key settings, best practices, and user impact when customizing a policy.

Recipient message access options

This section specifies the access and actions users can perform on quarantine messages. We can see the...