Prepare for SC-200 with a reference that remembers your progress.

Defender for Office 365 is a cloud email-security service providing zero-day malware protection, time-of-click URL defense, investigation, reporting, automated response, and user training. It can protect Exchange Online, on-premises SMTP environments, and hybrid deployments.

Office 365 AIR playbooks start automatically from alerts or manually from Explorer. The investigation graph correlates URLs, messages, users, sign-ins, devices, and activities.

• Possible actions: soft-delete messages/clusters, block URLs at time of click, disable external forwarding, and remove delegation.
• Compromised-user workflows can trigger password reset and MFA.
• Actions may run automatically or await approval in Pending actions.

Safe Attachments

Unknown attachments are detonated in an isolated environment. Actions include Off, Monitor, Block, Replace, and Dynamic delivery. Dynamic delivery releases the body first and attaches the file only after a safe verdict.

Safe Links

URLs are rewritten and checked at click time across email, Office apps, and Teams. Policies can scan downloadable content, protect internal messages, track clicks, prevent user click-through, and exclude trusted URLs.

Anti-phishing

Policies detect user/domain impersonation and spoofing using machine-learning models, protected users/domains, actions, safety tips, and trusted senders.

The agent analyzes user-reported suspicious messages, applies contextual LLM reasoning, and classifies alerts as true phishing threats or false positives. It records rationale, assigns itself, tags incidents, resolves false positives, and leaves true positives open for analyst action.

• Requires Security Copilot capacity, Defender for Office 365 Plan 2, unified RBAC, user-reported message monitoring, and the relevant alert policy.
• Suppressed alerts are not classified by the agent.
• Analyst feedback helps improve future classifications.

Threat Explorer analyzes recent threats, families, targeted users, sender data, delivery action, and user interaction. Attack Simulation Training runs realistic scenarios such as spear phishing, credential harvest, malicious attachments, password spray, and brute force to identify weaknesses and train users.