BEC-ware the Phish (part 3): Detect and Prevent Incidents in M365

This guide outlines practical steps to harden Microsoft 365 against Business Email Compromise by configuring and tuning Exchange Online Protection and Defender for Office 365 threat and alert policies, using custom mail flow rules, and calibrating Defender for Cloud Apps anomaly detections (e.g., inbox manipulation, forwarding, impossible travel). It advises prioritizing technical controls over user training alone, applying KQL to identify and reduce noisy alerts, and leveraging Sentinel for centralized correlation and incident management.