---

Best Practice Anti-Spam Policy Settings for SMBs

For small and medium-sized businesses (SMBs), the goal is to strike a balance between strong protection and minimal disruption to legitimate communications. The following are recommended best practices:

1. Use Preset Security Policies (Standard or Strict)

Microsoft recommends starting with the built-in Standard or Strict preset security policies. These are optimised for most organisations and include anti-spam, anti-phishing, and anti-malware settings.

• Standard: Balanced protection with fewer false positives.
  
• Strict: Higher protection, suitable for high-risk users or domains.

You can assign these policies to all users or specific groups via the Microsoft Defender portal.

2. Custom Anti-Spam Policies

If you need more control, create custom anti-spam policies. These allow you to:

• Adjust thresholds for spam, high-confidence spam, phishing, and bulk email.
  
• Choose actions like:
  
  • Move to Junk Email folder
    
  • Quarantine
    
  • Add X-headers
    
  • Redirect to another mailbox

Custom policies override the default and can be prioritised as needed.

3. Outbound Spam Protection

Configure outbound spam policies to prevent compromised accounts from sending spam:

Set-HostedOutboundSpamFilterPolicy -Identity "Default" -NotifyOutboundSpam $true -OutboundSpamFilterAction Quarantine

This ensures that outbound spam is quarantined and alerts are generated.

4. Enable Advanced Threat Protection (ATP)

For SMBs using Microsoft 365 Business Premium or Defender for Office 365 Plan 2, enable:

• Safe Links: Time-of-click protection for URLs.
  
• Safe Attachments: Sandboxing for email attachments.
  
• Anti-Phishing Policies: Impersonation protection and spoof intelligence.

These features significantly enhance protection against sophisticated threats.

5. Disable Legacy Protocols

Block POP, IMAP, and SMTP AUTH unless explicitly needed. These protocols don’t support modern authentication and are often exploited.

6. Monitor and Adjust

Use tools like Threat Explorer, Quarantine Reports, and User Submissions to monitor effectiveness and adjust policies accordingly.

---

️ How to Configure These Settings in the Microsoft 365 Admin Console

Step-by-Step via Microsoft Defender Portal:

1. Go to: https://security.microsoft.com
2. Navigate to:
   Email & collaboration → Policies & rules → Threat policies
3. Anti-Spam Policies:
   
   • Click Anti-spam policies
   • Edit the Default policy or click + Create policy
   • Configure actions for spam, high-confidence spam, phishing, and bulk email
4. Safe Links & Safe Attachments:
   
   • Under Threat policies, configure Safe Links and Safe Attachments
   • Apply policies to users, groups, or domains
5. Anti-Phishing:
   
   • Enable impersonation protection
     
   • Configure spoof intelligence and thresholds
6. Outbound Spam:
   
   • Configure under Outbound spam filter policies
7. Monitoring:
   
   • Use Reports and Explorer to review detections and user reports

For PowerShell users, the following script configures best practice spam settings:

Connect-ExchangeOnline
Set-HostedContentFilterPolicy -Identity "Default" ` 
-EnableSafetyTips $true ` 
-EnableEndUserSpamNotifications $true ` 
-EndUserSpamNotificationFrequency 1 ` 
-SpamAction Quarantine ` 
-HighConfidenceSpamAction Quarantine ` 
-PhishSpamAction Quarantine ` 
-HighConfidencePhishAction Quarantine ` 
-BulkSpamAction Quarantine ` 
-BulkThreshold 6 ` 
-QuarantineRetentionPeriod 30 ` 
-InlineSafetyTipsEnabled $true ` 
-EnableRegionBlockList $true ` 
-RegionBlockList @("CN","RU","KP","IR") ` 
-EnableLanguageBlockList $true ` 
-LanguageBlockList @("zh-cn","ru","ko","fa") ` 
-IncreaseScoreWithImageLinks Off ` 
-IncreaseScoreWithNumericIps Off ` 
-IncreaseScoreWithRedirectToOtherPort Off ` 
-IncreaseScoreWithBizOrInfoUrls Off ` 
-MarkAsSpamEmptyMessages On ` 
-MarkAsSpamJavaScriptInHtml On ` 
-MarkAsSpamFramesInHtml On ` 
-MarkAsSpamObjectTagsInHtml On ` 
-MarkAsSpamEmbedTagsInHtml On ` 
-MarkAsSpamFormTagsInHtml On ` 
-MarkAsSpamWebBugsInHtml On ` 
-MarkAsSpamSensitiveWordList On ` 
-MarkAsSpamSpfRecordHardFail On ` 
-MarkAsSpamFromAddressAuthFail On ` 
-MarkAsSpamBulkMail On ` 
-TestModeAction None

This script ensures all spam types are redirected to quarantine

---