Alerting on Changes to Exchange Online threat policies

The Microsoft 365 landscape provides a significant number of security features that an organization can configure to protect themselves against constantly evolving threats. These protections are often available based on the license version you have purchased from Microsoft as opposed to being available by default to all customers. In the case of Exchange Online, the following threat policies are available to all customers, without requiring extra license (e.g. Defender for Office 365 Plan 1/2):

• Anti-malware protection – capability that identifies malware in exchange online mailboxes. It is comprised of layered defenses including ability to directly block attachments that are of a certain file type (e.g. block all inbound emails with .HTML file attachments). This is especially useful for preventing application file types from executing when double-clicked in Windows—by ensuring they are never delivered in the first place. A good example here is .js file – it runs automatically in windows when double clicked – similar to EXE files. While EXE files are by default blocked by the policy, JS files are not.
• Anti-spam protection – capability that identifies junk messages (which continuously improves based on emails flagged by users, including the consumer emails on outlook.com). It blocks not just single spam messages but also bulk delivered spam across multiple mailboxes. You can configure these policies to be quite aggressive – in fact you can configure it in a way that all emails from certain countries are automatically flagged as spam.
• Anti-Phishing protection – capability that helps against spoofed (forged) senders. Spoofed messages appear to originate from someone or somewhere other than the actual source.
• Outbound spam protection – capability that may deny email sending if certain suspicious sending patterns occur or email sending reaches a limit. This policy also controls whether email forwarding in the organization is allowed or not (e.g. you may want to disable this feature to avoid GDPR-related data from being leaked outside the organization).
• Quarantine (incl associated policies) – capability that holds malicious/dangerous or unwanted messages. For example, if the anti-malware protection flags a message as malware, it will be held in this quarantine and not delivered to the user (unless released by the user/admin depending on configuration).
• Allow and block domains / URLs / senders – this is a capability that gives admins an ability to override Exchange Online’s behavior as to whether to allow or block emails depending on certain characteristics, such as sender address.

If you also have Defender for Office 365 Plan 1/2 in your license, you will also get threat policies for:

• Safe attachments – capability that provides an additional layer of protection for email attachments that have already been scanned by the anti-malware protection but were not flagged as malicious. Safe Attachments uses a virtual environment to check attachments in email messages for harmful attachments (eg. malware and phishing) before they’re delivered to recipients (a process known as detonation).
• Safe links – a capability that provides a layer of protection against malicious links that are used in phishing attacks. Safe Links provides URL scanning and rewriting of inbound email messages during mail flow, and time-of-click verification of URLs and links in email messages, Teams, and supported Office 365 apps. Safe Links scanning occurs in addition to regular anti-spam and anti-malware protection.
• Added features in the anti-phishing policies (such as impersonation protection)