How to Set Up Office 365 Advanced Threat Protection

In this blog post, we're going to walk you through the step-by-step process for setting up Office 365 Advanced Threat Protection (ATP). Although setting up ATP is a great move, it is only one portion (though an important one) of a comprehensive email security strategy.

This blog is the 4th post of a 5 post series titled Email Security: The Complete Guide. The 5 steps to email security are:

1. Configure DKIM, DMARC, SPF
2. Deploy EOP (Exchange Online Protection)
3. Set up Office Message Encryption
4. Enable Office 365 ATP (Advanced Threat Protection) - this blog
5. Enable Office 365 MFA with Authenticator App

There are three parts to setting up Office 365 Advanced Threat Protection:

1. Office 365 ATP Safe Attachments
2. Office 365 ATP Safe Links
3. Office 365 ATP Anti-Phishing

To enable Office 365 ATP you will need one of the follow licenses:

• Office 365 ATP Plan 1
• Office 365 ATP Plan 2
• Microsoft 365 Business Premium (formerly known as Microsoft 365 Business)
• Office 365 E5
• Microsoft 365 E5

OK, let's get started!

1. Go to https://protection.office.com/homepage using an 'incognito' (private) session on a Chrome browser
2. Sign In using your global admin credentials
3. Click on Threat Management
4. Click on Policy

Part 1 - Office 365 ATP Safe Attachments

Once the appropriate licenses are assigned to all of your users, follow these steps to implement the 'Safe Links' feature:

1. Click on ATP safe attachments
2. Enable the check box for Turn on ATP for SharePoint, OneDrive, and Microsoft Teams

1. Click on +

1. Give a name to your policy
2. Select the Replace option
3. Turn on Enable redirect and enter the alias of the IT Manager or IT team = service@bemopro.com so we receive a ticket

Option 1 - More restrictive policy

Option 2 - Less restrictive policy

Check the box for Apply the above selection if malware scanning for attachments times out or error occurs

Note: It can take from 5 sec to 5 min to apply settings to tenant

Part 2 - Office 365 ATP Safe Links

Click on ATP Safe Links, then Double-click on Default 

A popup window will open

1. Check the box for Office 365 Apps, Office for iOS and Android
2. Check the box for Do not track when users click safe links
3. Check the box for Do not let users click through safe links to original URL
4. Click Save

ATP Safe Links has been set up!

Part 3 - ATP Anti-phishing

1. Click on Anti-phishing
2. Click on Default policy

The following window will show up:

Within the Impersonation section, click Edit

1. Switch the button from Off to On
2. Click Add user
3. Add the Email address of the user and click Save (note: you cannot add more than one user at a time).
4. Repeat steps 5 and 6 until you have added all users
5. Click on Add domains to protect

1. Turn on Automatically include the domains I own and Include custom domains
2. Click on Actions

1. Under if email is sent by an impersonated user, select Move message to the recipients' Junk Email folders
2. Under if email is sent by an impersonated domain, select Move message to the recipients' Junk Email folders
3. Click on the link Turn on impersonation safety tips

1. Turn on all 3 switches (Show tip for impersonated users, Show tip for impersonated domains, and Show tip for unusual characters)
2. Click Save
3. Click on Mailbox Intelligence

1. Turn on Enable mailbox intelligence
2. Turn on Enable mailbox intelligence based impersonation protection
3. Under if email is sent by an impersonated user, select Move message to the recipients' Junk Email folder
4. Select Add trusted senders and domains. You should have nothing to do there
5. Click on Review your settings
6. Once you have reviewed the settings and everything looks good to you, click Save
7. Click Close

Congratulations! The settings for Anti-Phishing are now all set up!

Not looking to do this yourself? 

Schedule a meeting with us to learn more about implementing Office 365 ATP and all the other email security tools offered by Microsoft.