Microsoft 365 E3 email security: are the new defaults enough?

TL;DR: Microsoft now folds Defender for Office 365 Plan 1 into Microsoft 365 E3 and Office 365 E3, adding Safe Links, Safe Attachments and anti-phishing coverage for many tenants, but IRONSCALES argues that a licence change is not the same as a tuned defence posture. The practical issue is whether organisations turn on and measure the new controls instead of assuming baseline protection equals effective protection.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “You just got Defender for Office 365 in E3. Here's how far it goes.”.

Key questions

Q: What breaks when email security defaults stay permissive after a Microsoft 365 E3 upgrade?

A: The main failure is that licensing creates a false sense of coverage while the actual enforcement remains weak.

Q: Why do phishing and impersonation attacks still succeed when Safe Links and Safe Attachments are enabled?

A: Because those controls inspect specific attack surfaces, not the full social-engineering chain.

Q: What are the signs that phishing controls are failing in the browser rather than in the email gateway?

A: A common sign is when suspicious messages are blocked but users still reach realistic-looking login pages and enter credentials.

Practitioner guidance

• Turn on impersonation and domain protection Enable user impersonation protection for high-value people such as executives and finance staff, and add domain impersonation coverage where trust abuse is most likely.
• Validate quarantine and reporting workflows Make quarantine visible, decide who can preview or release mail, and enable one-click phishing reporting so suspicious messages get routed into review quickly.
• Tune Safe Links and Safe Attachments separately Configure Safe Links for click-time inspection and Safe Attachments for sandbox detonation, then test how each behaves against archives, hosted payloads, and QR-code lures.

Bottom line: Microsoft’s bundled email controls raise the floor, but tenants still have to configure them before they materially reduce phishing risk.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →