Review Safe Links scope
Set supported protected-domain values and approved URL rewrite exceptions. Check inherited exclusions as well as customer entries. Confirm Microsoft licensing and the effective policy before relying on the setting.
Microsoft 365 email security
Keep phishing protection, spam settings, Safe Links exceptions and quarantine reporting in a repeatable customer workflow. Make it clear what was configured, what needs attention, and what Microsoft actually applied.
For MSP administrators and Microsoft 365 technicians. Self-hosted MSPControl; Microsoft services, licensing and authorized customer access are separate prerequisites.
It is the work of configuring, reviewing and maintaining the controls that protect a customer’s Microsoft 365 mail. MSPControl brings supported protection settings, report configuration and mailbox administration into customer context. Microsoft remains the underlying filtering and protection service; the operator still needs to verify effective policies, recipient scope and outcomes.
A repeatable protection review
Work through the customer’s actual configuration. A saved policy, a quarantine report and a resolved incident answer different questions.
Set supported protected-domain values and approved URL rewrite exceptions. Check inherited exclusions as well as customer entries. Confirm Microsoft licensing and the effective policy before relying on the setting.
Use the available anti-malware, anti-phishing and anti-spam settings in the customer organization. Inspect the policy source and exceptions; do not assume every customer should receive identical settings.
Review the supported impersonation-protection users, domains and exclusions. These targets are not the same as policy recipient assignment. Initialize Standard Protection in Microsoft when prompted, and check its recipient scope before applying changes.
Configure the intended report recipient and the Global Quarantine Report scheduled task. Verify the task result and delivered report. Missing or empty results require a source-access check, not an assumption that all mail is safe.
Use the separate mailbox rules and mail-flow settings to review delivery behavior. Confirm that forwarding and rule changes are authorized, and verify their actual effect on the mailbox.
After saving, review configuration indicators and task errors. Use the supported Repair action when appropriate, then confirm the Microsoft-side result. Hand suspicious activity into the incident-response workflow.
Configured does not mean every threat is blocked. Check effective Microsoft policy, recipient scope, exceptions and available evidence. An empty report or a successful save is not an all-clear.
Controlled changes
Review the intended MSPControl organization. Each Microsoft tenant has its own connection, permissions, licensing and resulting configuration.
Record why a URL, sender or domain needs an exception. Review inherited values and customer-specific entries before changing protection.
Saving can apply supported policy changes. Turning off a previously enabled protection setting can remove its managed configuration. Review the impact before saving or using Repair.
Confirm the effective policy and recipient scope in Microsoft. For Standard Protection, impersonation targets do not define who receives the policy.
Current boundary: this page does not promise zero phishing, automatic remediation of every mail-security issue, continuous all-tenant policy enforcement, automatic gateway IP synchronization, universal quarantine release, or complete coverage of every Defender for Office 365 feature. DNS authentication, gateway routing, investigations and unsupported controls need their own verified workflows.
Action ownership
| Need | MSPControl workflow | Verify separately |
|---|---|---|
| URL and phishing policy review | Supported Safe Links, spam filtering and Standard Protection settings. | Actual Microsoft entitlement, effective policy, exclusions and recipient scope. |
| Apply a supported setting | Save performs configuration checks and can apply changes; supported sections also expose Repair. | Task errors, refreshed status and the resulting Microsoft configuration. |
| Quarantine visibility | Report recipient settings and the Global Quarantine Report scheduled task. | Successful collection, customer mapping, delivery and any release decision. |
| Unexpected forwarding | Separate mailbox rules and mail-flow administration. | Authorized delivery behavior, investigation scope and the final mailbox state. |
| Suspected compromise | Customer context and the linked response workflow support follow-up. | Containment, persistence, evidence availability and recovery decisions. |
Before production changes
Confirm the connected Exchange Online service, required Microsoft license and write permissions. Record the current policy and exception list. Review the change on a test customer, inspect errors, check the effective Microsoft policy, and verify intended mail behavior before repeating the process for more customers.
Configuration and verification
Connected customer operations
Common questions
MSPControl provides customer-level administration of supported Safe Links, anti-malware, anti-phishing, anti-spam and Standard Protection settings, plus quarantine report configuration and separate mailbox rules and forwarding workflows. Microsoft provides the underlying protection services. Available controls depend on your installed version, connected services, permissions and licenses.
Saving can check and apply supported protection settings through the connected Microsoft service. Application can fail or be incomplete. Review task errors and configuration status, then verify the effective Microsoft policy and recipient scope. Reopening a saved field is not proof that mail is protected. Repair is available for supported sections that need configuration correction.
No. No configuration on this page guarantees that every threat will be blocked. Microsoft licensing, policy scope and precedence, supported clients, exceptions and message handling affect the result. Continue monitoring and investigate suspicious messages even when a policy is configured.
Microsoft licensing is a separate prerequisite. Check the current Microsoft requirements for Safe Links and advanced anti-phishing capabilities, and verify the actual customer subscription. Visibility of an MSPControl option or a product entitlement check is not a substitute for that verification.
Yes. Repeat the supported organization-level workflow in each customer context. Confirm its connection, policy source, approved exceptions and resulting Microsoft state. This page does not promise continuous all-tenant drift remediation or a universal one-click rollout.
The described workflow retrieves available quarantine information and sends configured reports through a scheduled task. Report delivery and release of a message are different operations. Review Microsoft quarantine permissions and policies before taking a release action.
Move from policy configuration into incident response: contain access, preserve available evidence, investigate persistence and recover carefully. Use the compromised-account guide and your approved response process; changing a spam setting alone does not resolve an incident.
Self-hosted. Free license available. No credit card required.