Moderate confidence applies to the recommendation to verify recipient coverage before changing policy or purchasing additional protection. It does not mean that the current configuration, recipient coverage or effectiveness has been verified.
Use this read-only check before changing email policy or approving another product. Pick a control and a few representative recipients. Include an exception or a high-risk group where it affects your decision.
Why it matters
A licence does not prove policy application. An applicable configuration does not prove the outcome.
Before you start
Use an account approved to view the relevant Microsoft 365 licence and Defender policy information. Identify the recipients, intended protection and any gateway or routing dependency. Keep notes inside your organisation and redact addresses and policy identifiers before sharing.
What to check
1. Licensed or available
Check the applicable subscription, add-ons and licence assignments for the recipients in scope. Microsoft distinguishes built-in protection for cloud mailboxes from additional Defender for Office 365 capabilities. Record what is licensed or available and the date. This establishes entitlement only.
2. Configured and applicable
Inspect the relevant threat policies in the Microsoft Defender portal. The presence of a policy in the portal does not prove that it applies to a particular recipient. Check recipient scope, exclusions, policy precedence, licence assignment and mail routing, including any gateway. Record which policy and settings apply to each recipient and control in scope.
3. Observed or verified in operation
Where the outcome affects the decision, use permitted evidence such as an existing message trace or quarantine record. Either can corroborate the handling of a specific event. Neither can establish a general detection rate or prove comprehensive protection. Record the evidence source, the recipient and event in scope, and what you could not check.
What the results mean
Verify in your environment. Record entitlement, applicable configuration and observed behaviour separately. Keep any missing evidence Unverified, and record the owner and the evidence needed before deciding whether a change or additional protection is justified.
Evidence limitations
No tenant was assessed for this guide. No recipient assignment, policy scope, policy exception or gateway routing was inspected. No message trace or quarantine record was reviewed. The guide makes no claim about detection rates or effectiveness and assumes no licence entitlement for any particular tenant. The suggested checks are illustrative and represent no observed findings.
Microsoft documentation
Primary sources for the verification sequence. Built-in cloud mailbox protection, preset security policies and email policy precedence.
Entitlement and assignment. Exchange Online Protection service description, Defender for Office 365 service description and Microsoft 365 licence assignment.
Policy configuration and scope. Safe Links, Safe Attachments, Anti-phishing policies, Anti-spam protection and Anti-malware protection.
Event evidence and mail routing. Quarantine policies, Message trace and Enhanced Filtering for Connectors.
Corrections and decision history
No material changes are recorded.