Contoso uses Microsoft Defender for Office 365 Plan 2. The security team has enabled the built-in Standard preset security policy for all users. Separately, an administrator created a custom Anti-phishing policy scoped to the finance department with a higher spoof-intelligence threshold. A finance user reports that a phishing email that should have matched the custom finance policy was instead evaluated by different settings. What is the most likely reason the custom policy did not apply?