How to stop phishing emails in Office 365

Phishing still reaches Office 365 inboxes when native filters miss novel or evasive techniques, or when coverage gaps go undetected. The most effective response combines proper configuration of Microsoft's built-in controls, faster investigation and response after delivery, and an additional detection layer that generates org-specific coverage for attacks Defender doesn't catch.

78% of email threats detected by Microsoft in Q1 2026 were link-based, as attackers increasingly favored hosted credential phishing infrastructure (Microsoft Threat Intelligence, 2026). Despite that visibility, phishing still reaches inboxes every day, and security teams are left figuring out why.

This guide covers the practical steps organizations can take to stop phishing emails from reaching Office 365 users, what to do when messages get through existing protections, and when to consider adding a detection layer that goes beyond what Defender provides. For the architectural view before the configuration work, see email security for Microsoft 365.

What to know:

• Phishing gets through Office 365 for two reasons: configuration gaps in native controls, and attack techniques that evade filters even when those controls are properly set up.
• Investigating and remediating delivered messages quickly limits how far an attack spreads, but it doesn't address the detection gap that let the message through.
• When phishing continues to reach users despite proper configuration, the gap is usually a lack of org-specific, adaptive detection logic that accounts for how your environment actually behaves.
• Adding a detection layer that covers inbound, internal, and outbound email closes exposure windows that a single vendor's centralized model cannot address on its own.
• When phishing keeps reaching users despite proper configuration, evaluate the detection layer: transparent verdicts, org-specific coverage, and the ability to deploy new detections in hours are the capabilities that close persistent gaps.

Why phishing emails still get through Office 365

Most organizations have anti-phishing policies, Safe Links, and email authentication in place. Phishing still gets through. There are two distinct reasons for that, and knowing which one applies shapes the right response.

Configuration and coverage gaps. Defender for Office 365's built-in controls require deliberate setup to perform well. Anti-phishing policies need to be tuned for impersonation protection, Safe Links needs to be scoped to the right users and policies, and DMARC, DKIM, and SPF each need to be configured correctly for your domain. When any of these are misconfigured or missing, the coverage floor drops. Gaps here are worth closing before assuming the problem is something else.

Evasive attack techniques. Even with every native control properly configured, a meaningful share of targeted phishing reaches the inbox. Attackers have adapted specifically to evade centralized detection models:

• Link-based attacks using trusted infrastructure. Phishing links hosted on legitimate platforms (SharePoint, OneDrive, Google Docs, Dropbox) pass Safe Links scanning because the domain is trusted. The malicious redirect or credential harvest page sits behind the legitimate URL.
• QR code phishing. QR code phishing embeds a phishing URL inside an image, bypassing text-based link scanning entirely. The URL is never parsed as a link by the mail filter.
• Multi-stage attacks. Attackers increasingly use multi-step redirect chains, time-delayed payload delivery, or geographic blocking to ensure the phishing page resolves differently during scanning than it does when a user clicks.
• Relationship-based social engineering. Business email compromise (BEC) and vendor impersonation attacks often contain no malicious links or attachments. They rely on convincing context: a familiar sender name, a plausible request, a reference to an ongoing project. That context is hard to score with signature-based or link-scanning approaches.

Understanding which of these is driving phishing through your environment is the first step toward the right fix. Native tuning addresses the first category; org-specific detection logic is what closes the second. For a fuller picture of the attack categories reaching your environment, see types of phishing attacks.

How to stop phishing emails in Office 365, step by step

1. Audit and harden your anti-phishing policy

Microsoft's default anti-phishing policy provides a baseline, but it leaves several high-value controls off or under-configured. Before assuming the problem is evasion, confirm these are set:

• Impersonation protection covers specific users (executives, finance roles) and domains you want to protect. This isn't automatic; it requires adding those users and domains explicitly..
• Mailbox intelligence should be enabled. It builds sender relationship models based on communication history, which improves accuracy on BEC-style attacks that don't carry obvious technical indicators.
• Spoof intelligence should be reviewed, not just enabled. Confirm the allow and block lists reflect your actual sending patterns so legitimate mail isn't swept up and legitimate-looking spoofs aren't missed.
• Action settings for impersonation and spoof detections should be set to quarantine or move to junk, not just add a warning. Warning banners on phishing emails are easy to click past.

For organizations with Defender for Office 365 Plan 2, review the Preset Security Policies (Standard and Strict). These pre-configure the controls above at recommended levels and are easier to maintain than fully custom policies.

2. Configure Safe Links and Safe Attachments correctly

Safe Links and Safe Attachments provide meaningful protection against known-malicious URLs and weaponized file attachments, but their coverage depends on how they're scoped.

Safe Links:

• Ensure the policy applies to all users, not just a subset.
• Enable "Do not allow users to click through to the original URL" to prevent users from bypassing warnings.
• Enable URL scanning for email messages AND Office applications. Safe Links doesn't cover links in Word, Excel, and Teams by default.
• Review the "Do not rewrite" list: any domains added here are excluded from scanning. Audit this list periodically.

Safe Attachments:

• Enable Dynamic Delivery where possible to reduce mail delay while attachments are scanned.
• Confirm the policy applies to all domains you receive mail for, not just your primary domain.

Note the coverage limits: Safe Links cannot scan QR codes or URLs embedded inside images. Links hosted on trusted platforms (SharePoint, Dropbox, Google) pass scanning because the platform itself is not flagged. These are structural gaps in the scanning approach, not configuration errors.

3. Enforce email authentication across your sending domains

SPF, DKIM, and DMARC form the authentication layer that prevents attackers from spoofing your domain or closely related domains. All three need to be correctly configured:

• SPF: Ensure your SPF record includes all authorized sending IPs and services. An outdated or incomplete SPF record can create false spoof positives and leave gaps.
• DKIM: Enable DKIM signing for all domains you send from. Microsoft 365 provides DKIM keys, but they need to be explicitly activated and published in DNS.
• DMARC: Set a DMARC policy of p=quarantine or p=reject for your primary domain. p=none only generates reports; it doesn't take action. Monitor DMARC aggregate reports to catch legitimate senders you may have missed before moving to enforcement.

Authentication controls don't stop all phishing. An attacker using a lookalike domain (microsoft-securityalert.com instead of microsoft.com) passes SPF and DKIM because the email is legitimately sent from that domain. Authentication is a floor, not a ceiling.

4. Investigate and remediate phishing that reaches the inbox

Even with proper controls in place, some phishing will be delivered. How quickly you can find and remove those messages matters.

Microsoft 365 tools for post-delivery investigation:

• Threat Explorer (Defender for Office 365 Plan 2) lets you search for delivered messages by sender, subject, URL, and other criteria. Use it to find other messages from the same sender or campaign that may have reached additional mailboxes.
• Admin Submission lets you submit suspicious messages to Microsoft for analysis. This helps improve detection over time and can trigger a review of messages held in quarantine.
• Automated Investigation and Response (AIR) can automatically investigate phishing alerts and trigger remediation. Review AIR actions to confirm they're configured to act, not just flag.

Manual remediation with Search and Purge: For confirmed phishing that reached multiple users, use Content Search or eDiscovery in the Microsoft 365 Compliance Center to locate all copies of the message across mailboxes. Soft-delete removes messages from user views without permanently deleting them; hard-delete removes them from the Recoverable Items folder. Understand which you're using before proceeding.

Automation through the abuse mailbox: Microsoft 365 doesn't process abuse mailbox submissions automatically. If your organization relies on a user-reported phishing inbox, those submissions pile up and get triaged manually. A platform like Sublime can automate this: triaging submissions, cross-referencing them against active campaigns, and prioritizing the ones that need immediate action. See abuse mailbox automation for how this works in practice.

5. Build or refine detection for recurring attack patterns

When a phishing campaign reaches your users, the most important question isn't just "how do we clean this up." It's "what detection would have caught it, and can we deploy that before the next wave?"

Microsoft Defender allows custom detections through Microsoft Sentinel and Defender XDR, but writing and deploying them typically involves multiple teams, approval cycles, and time. The gap between "we saw this attack" and "we have detection deployed" is the window attackers reuse.

Organizations that close this gap fastest have a way to go from incident observation to deployed detection in hours, not days. That usually means either a dedicated detection engineering function or a platform that generates and deploys coverage automatically based on what it observes in your environment. ADÉ (Autonomous Detection Engineer) is built for exactly this: when a new attack pattern reaches your environment, it generates and deploys new detection logic automatically, without manual rule-writing or waiting on a vendor update cycle.

What to do when phishing emails keep getting through Office 365

If phishing continues to reach users after you've addressed the configuration items above, the problem is almost certainly in the detection layer, not the enforcement layer.

Here's what to evaluate:

Are your verdicts transparent? When a message gets through, can you see exactly why Defender didn't flag it? Or does the explanation end at "no threats detected"? Without visibility into the actual signals that informed the verdict, tuning is guesswork. Security teams that can read the detection logic behind every decision can close gaps deliberately, not reactively.

Is your detection coverage org-specific? Defender applies the same detection model to every Microsoft 365 tenant. It's optimized for the average threat landscape, not your organization's specific environment, vendors, communication patterns, or industry. Attacks that exploit relationships, trusted vendors, or org-specific context are harder to catch with generic coverage. Detection that accounts for how your specific environment behaves catches more of these.

How fast can you close new gaps? When a novel attack technique is identified, how long does it take to get new detection in place? If the answer is "we wait for Microsoft to update their models," every gap has an exposure window measured in weeks, not hours. The ability to generate and deploy new detections quickly, without filing a vendor support ticket, is what separates teams that stay ahead from teams that stay reactive.

What does your abuse mailbox backlog look like? User-reported phishing is signal. If submissions pile up unreviewed, you're losing intelligence about what's actively evading your filters. Automation that triages, deduplicates, and prioritizes those reports converts them from overhead into detection input.

When these gaps are present, additional protection worth considering includes:

• A detection layer that adds org-specific coverage on top of native Microsoft filters, without rerouting mail
• Automated detection generation for novel or recurring attack patterns
• Transparent verdict logic that security teams can read, audit, and tune without vendor involvement
• Abuse mailbox automation that converts user reports into structured detection input

For a broader look at what to evaluate when assessing layered protection, see best email security solutions for Office 365 and email security best practices. And if you want to see what those agents surface in your own environment, the passive evaluation requires no changes to how your mail flows.

How Sublime helps stop phishing emails in Office 365

Sublime works alongside Microsoft 365 as an API-connected detection layer with no MX record change and no mail rerouting. It analyzes every inbound, internal, and outbound message against a combination of shared community detections and org-specific coverage that builds to your environment from day one. For the full picture of what inbound email security looks like on the Sublime platform, see the use-case overview.

Tailored detection that accounts for your environment. Sublime's coverage isn't one-size-fits-all. Detection logic accounts for your organization's specific vendors, communication patterns, and behavioral baselines. A message that looks normal in most environments but anomalous in yours gets handled accordingly.

Transparent verdict logic. Every Sublime verdict traces to readable detection logic: the specific signals, the exact content evaluated, the detection that fired. Security teams can see exactly why a message was flagged or cleared, without waiting on a vendor to explain it. This transparency is what makes deliberate tuning possible.

ADÉ closes gaps in hours. When a new attack pattern reaches your environment, ADÉ generates new detection logic and deploys it across your tenant without waiting on a vendor release cycle. What once took weeks takes hours. Elastic, for example, detected and blocked 20x more attacks in its first month after adding Sublime alongside existing defenses.

ASA (Autonomous Security Analyst) handles triage at scale.** ASA investigates flagged messages in seconds, surfaces the relevant signals, and prioritizes what needs human review. It also processes abuse mailbox submissions automatically, converting user reports into structured intelligence rather than a queue that grows.

Full coverage across every direction email moves. Sublime covers inbound threats, internal email (which native filters often skip), and outbound DLP. One platform for the full email attack surface. Credential phishing attempts that arrive externally, spread internally, and exfiltrate data outbound are all visible in the same platform.

For organizations still seeing phishing reach users despite a properly configured Microsoft 365 environment, a passive evaluation alongside Defender shows exactly what additional coverage looks like in your specific environment, without changing anything about how your mail flows. It's API-connected and read-only: mail flows exactly as it does today.

Get a demo to see what a passive evaluation surfaces alongside Defender.

FAQs about how to stop phishing emails in Office 365

How can security teams investigate phishing emails that reach Microsoft 365 inboxes?

Use Threat Explorer (Defender for Office 365 Plan 2) to search for the message across your tenant by sender, subject, URL, or file hash. This surfaces other users who may have received the same campaign. For messages already delivered to inboxes, Admin Submission lets you report them to Microsoft for analysis, and Automated Investigation and Response (AIR) can trigger an automated review. Teams running Sublime alongside Defender use ASA to handle this automatically: it investigates flagged and user-reported messages in seconds, surfaces the relevant signals, and cuts the manual queue work out of the process. If you have a SIEM connected to Microsoft 365, correlating Defender alerts with email telemetry gives a fuller picture of what arrived and when.

How can you remove phishing emails from multiple Office 365 inboxes after delivery?

Use Content Search in the Microsoft 365 Compliance Center to locate all copies of the message across mailboxes, matching by sender, subject, or message ID. Once identified, use the Purge action to soft-delete (removes from user view, retains in Recoverable Items) or hard-delete (removes from Recoverable Items). For large-scale campaigns, the eDiscovery purge workflow handles bulk removal. Confirm which action you're using before running it, because the difference between soft and hard delete matters for compliance. Sublime can automate post-delivery remediation for confirmed campaigns, removing the need to run a manual content search every time a phishing message reaches multiple inboxes.

How can you reduce false positives without weakening phishing protection in Microsoft 365?

False positives in Microsoft 365 usually come from one of two places: a policy misconfiguration or a detection model that doesn't account for your environment's specific senders and communication patterns. Start with the Microsoft Secure Score recommendations for your anti-phishing policies and tune spoof intelligence against your actual sending patterns. For users reporting false positives, submit them through Admin Submissions; Microsoft uses these to improve filtering. Targeted allow entries can reduce noise on specific senders or domains without weakening protection broadly. If false positives persist despite clean configuration, the underlying cause is often generic coverage that can't distinguish your legitimate vendors from suspicious lookalikes. Sublime's org-specific detection logic addresses this at the source: because coverage is built around how your environment actually behaves, it produces fewer false positives structurally rather than requiring ongoing manual exceptions.

How can you prevent the same phishing campaign from reaching more users?

Act on the first confirmed message quickly. Use Threat Explorer to identify all users who received the same campaign. For campaigns using a specific URL or file hash, create a block entry in Tenant Allow/Block Lists. For persistent campaigns using varied infrastructure, write a detection based on the behavioral pattern (sender relationships, subject line structure, payload type) rather than a single indicator. Platforms that can generate and deploy org-specific detections in hours give you the fastest path from confirmed attack to deployed coverage. ADÉ does this automatically: when a new attack pattern reaches your environment, it generates and deploys a detection without waiting on a vendor update cycle or manual rule-writing.

How does Sublime detect phishing attacks that existing Microsoft 365 protections miss?

Sublime adds a detection layer on top of Defender that generates org-specific coverage for your environment. Rather than applying a single centralized model to every tenant, Sublime builds detection logic that accounts for your organization's vendors, communication patterns, and behavioral baselines. This is what catches attacks that exploit relationships, trusted infrastructure, or context specific to how your organization operates. Every detection is transparent: analysts can read the exact logic behind each verdict. See phishing protection software and email security for Microsoft 365 for more on what layered detection adds.

How does Sublime help security teams respond to and prevent new phishing campaigns?

When a new attack pattern reaches your environment, ADÉ (Autonomous Detection Engineer) generates new detection logic and deploys it across your tenant without a vendor release cycle. ASA (Autonomous Security Analyst) triages flagged messages in seconds and processes abuse mailbox submissions automatically, so user reports become detection input instead of backlog. For teams that want to write or refine their own detections, Sublime's detection language gives full visibility into the logic, and ADÉ can backtest new detections against historical mail before deploying them. Together, these capabilities shorten the gap between identifying a campaign and having coverage deployed.

‍