Question

Your organization uses Microsoft Defender for Office 365. Several user mailboxes were recently compromised and used to send high volumes of spam to external recipients before you regained control. You want Defender to automatically stop compromised internal accounts from sending outbound mail once they exceed sending limits, and you want the security team notified when this happens. Which configuration should you implement?

Accepted Answer

Configure an outbound spam filter policy with automatic forwarding disabled and set recipient/message limits with the action to restrict the user from sending mail, adding the security team to the notification settings

Answer

Create an anti-phishing policy with mailbox intelligence impersonation protection and add the security team as recipients of impersonation alerts

Answer

Add the affected mailboxes to the Tenant Allow/Block List as blocked senders so their outbound mail is quarantined

Answer

Enable Zero-hour auto purge (ZAP) for outbound messages in the anti-malware policy and configure a mail flow rule to notify the security team