Zero Trust Email Security
Defence-in-depth email protection with Microsoft Defender for Office 365 — sandbox every attachment, inspect every URL at click time, and quarantine identity-based impersonation attacks.
Difficulty
Advanced
Environment
Microsoft 365 Business Premium / Defender for Office 365 Plan 2
Deployment
Home Lab
Est. Implementation
2 days
Executive Summary
This project implemented a Zero Trust email security framework using Microsoft Defender for Office 365 Plan 2 across the Patchthecloud.onmicrosoft.com tenant, treating email as an untrusted entry point at every stage rather than a perimeter-trusted channel.
Safe Attachments was deployed with a Block action and AdminOnlyAccessPolicy quarantine so every attachment is detonated in a cloud sandbox before delivery, while Safe Links was configured with real-time URL scanning, wait-for-scan delivery, and coverage across Email, Teams and Office apps so every link is re-evaluated at click time.
An anti-phishing policy layered mailbox intelligence, domain impersonation protection and spoof intelligence to catch identity-based attacks regardless of content, and the full stack was validated end-to-end: a live attack simulation confirmed a test user correctly reported a credential-harvesting email, and the Microsoft Secure Score history export confirmed a +55 point improvement directly attributable to these controls.
Business Problem
Malicious attachments reach mailboxes without pre-delivery analysis, phishing links embedded in email bypass perimeter controls once delivered, impersonation and business email compromise exploit trusted sender relationships, and there is no unified telemetry for email-borne threats, link clicks, or remediation events.
Without layered, identity-aware email controls, users have no structured way to report and escalate suspicious email, and the SOC cannot measure or demonstrate improvement in email security posture over time.
Business Risks
- Malware delivered via attachments with no pre-delivery sandbox analysis
- Phishing links that evade perimeter filtering and are clicked after delivery
- CEO fraud and domain spoofing exploiting trusted sender relationships
- No structured user-reporting path for suspicious email
- No unified SOC telemetry for email threats, clicks or remediation outcomes
Compliance Concerns
- Defence-in-depth email security control documentation for audit purposes
- Measurable Secure Score evidence of applied controls for governance reporting
Solution Overview
Deployed Safe Attachments with a Block action and AdminOnlyAccessPolicy quarantine so detected malware never reaches a mailbox and quarantined items require administrator review before release.
Configured Safe Links at Priority 0 with real-time URL scanning, wait-for-scan-before-delivery, and coverage extended to Teams and Office 365 apps, closing the gap where attackers pivot away from the inbox.
Layered an anti-phishing policy with mailbox intelligence, domain impersonation protection and spoof intelligence, then validated the full stack with a live attack simulation and confirmed a +55 point Secure Score improvement from the Secure Score history export.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Defender for Office 365 Plan 2
Unified email threat protection platform
Safe Attachments
Pre-delivery cloud sandbox detonation of all email attachments
Safe Links
Click-time URL rewriting and inspection across Email, Teams and Office apps
Anti-Phishing Policy
Mailbox intelligence, domain impersonation and spoof intelligence
User-Reported Phishing
Converts user reports into Defender threat signals
Zero-Hour Auto Purge (ZAP)
Retroactive post-delivery removal of detected threats
Microsoft Secure Score
Measurable security posture improvement tracking
Attack Simulation Training
Real-world phishing simulation and user awareness validation
Lab Environment
- Tenant
- Patchthecloud.onmicrosoft.com
- Licence
- Microsoft 365 Business Premium / Defender for Office 365 Plan 2
- Test mailbox
- Johnsen@Patchthecloud.onmicrosoft.com
- External test sender
- tara@msteamsexternalone.com
- Portal
- security.microsoft.com
- Implementation date
- 10–11 January 2026
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Deploy pre-delivery sandbox detonation for all attachments.
- Configure the Safe Attachments policy with a Block action for detected malware
- Set the quarantine policy to AdminOnlyAccessPolicy
- Disable attachment redirection and apply the policy to all recipients
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Deploy Defender email policies and export Secure Score / threat reports
# Deploy Safe Attachments, Safe Links and Anti-Phishing policies via Exchange Online PowerShell
.\New-DefenderEmailPolicies.ps1 -Tenant "Patchthecloud.onmicrosoft.com" -QuarantinePolicy "AdminOnlyAccessPolicy"
# Export Secure Score history and recommended actions to CSV via Microsoft Graph
.\Get-SecureScoreReport.ps1 -OutputPath ".\exports\Microsoft-Secure-Score.csv"
# Export email threat detection summary from Defender for Office 365 via Graph
.\Get-EmailThreatReport.ps1 -Days 2Configuration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Phase 1
Phase 2
Phase 3
Phase 4
Phase 5
Validation
Safe Attachments Active
Policy list confirms Safe Attachments On at Priority 0 with Block action and AdminOnlyAccessPolicy quarantine.
Safe Links Active
Policy list confirms Safe Links Policy On at Priority 0 with real-time scanning and Teams/Office coverage.
Anti-Phishing Policy Created
Confirmation banner shown; policy in effect immediately with mailbox and spoof intelligence enabled.
Attack Simulation Passed
Test user John Sen correctly identified and reported a simulated phishing email.
Secure Score Improvement Confirmed
+55 points verified via the Microsoft Secure Score history CSV export across 10–11 January 2026.
Challenges
Sandbox detonation adds delivery latency
Safe Attachments Block mode delays delivery while attachments are detonated, so users need to be informed before enabling this in production.
Secure Score is a lagging indicator
Secure Score points register only after Defender detects and scores the control, not immediately after the policy is saved, so validation required waiting for the scoring refresh.
Lessons Learned
- Safe Attachments Block mode delays delivery — sandbox detonation adds latency, so communicate this to users before enabling in production.
- "Do not rewrite URLs" in API-only mode is not reduced security — Defender still evaluates every URL via the Safe Links API, it just improves compatibility with mail clients that break rewritten links.
- Anti-phishing threshold 1 (Standard) is appropriate for most tenants — raising it to Aggressive significantly increases false positives on internal business email.
- Single user-reported phishing reports may not generate alerts on their own — this is expected Defender behaviour, since alerts fire when reports correlate with other signals, but every report still contributes to threat intelligence.
- Secure Score is a lagging indicator — points register after Defender detects and scores the control, not immediately after policy creation.
Business Impact
+55 pts
Secure Score Improvement
Passed — phish reported
Attack Simulation Result
100% sandboxed pre-delivery
Attachment Protection
2 days
Implementation Window
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
lokeshm-it/Zero-Trust-Email-Security
PublicZero Trust email security using Microsoft Defender for Office 365 — Safe Attachments, Safe Links, anti-phishing with mailbox and spoof intelligence, and a verified +55 Secure Score improvement.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon