Configuring Microsoft Defender to Detect and Block SharePoint Based Phishing Emails

Question

Configuring Microsoft Defender to Detect and Block SharePoint Based Phishing Emails

Shantae Adams 0

Our organization has been receiving phishing emails that appear to come from legitimate SharePoint sources. While we cannot block the actual SharePoint sender, these emails are often cc'ing random addresses. How can we configure Microsoft Defender to detect and block these phishing attempts before they reach our users? User's image

Nobuo 0 Reputation points

2025-10-02T15:46:59.5733333+00:00

Detection is difficult because the sender domain is legitimate. The CC recipient's address (thibaut...in your case) I would add in Defender to the Threat Policies > Tenant Block/Allow list and the URL that you are taken to when you hover your cursor over the Open link, which can be added as well. Lastly, I would hard delete all the emails your users have received, so that people that have not submitted this to your phishing team don't see it later and do not go to the link and give their credentials or enter the Code sent to them.

Your answer

Nobuo 0 Reputation points

2025-10-02T15:46:59.5733333+00:00

Detection is difficult because the sender domain is legitimate. The CC recipient's address (thibaut...in your case) I would add in Defender to the Threat Policies > Tenant Block/Allow list and the URL that you are taken to when you hover your cursor over the Open link, which can be added as well. Lastly, I would hard delete all the emails your users have received, so that people that have not submitted this to your phishing team don't see it later and do not go to the link and give their credentials or enter the Code sent to them.