Defender for Office 365: highest-impact controls

Start with anti-phishing policies that explicitly block spoofing and impersonation.

Then enable safe links and safe attachments for additional payload protection.

Finally, review quarantine policy and incident routing to avoid unresolved alerts.