Guards against senders posing as known people or domains using lookalikes, and draws on mailbox intelligence. Part of anti-phishing in Defender for Office 365, it isn't enabled in the default policy.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Impersonation protection in context, with comparison tables and the common traps.
Terms in this definition
- Mailbox intelligence
An anti-phishing option in Defender for Office 365 that builds a picture of who each user normally corresponds with, so genuine senders can be told apart from impersonators. It is enabled by default but does nothing until intelligence for impersonation protection is switched on as well.
- Microsoft 365
Formerly Office 365, Microsoft's software-as-a-service productivity suite. A Microsoft Entra tenant provides its identity, and its data is not governed by Azure RBAC.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.
Related terms
- Anti-phishing policy
Protects incoming mail in Microsoft 365 with spoof intelligence; with Defender for Office 365 it also offers impersonation protection plus adjustable phishing thresholds.
- Defender for Office 365 Plan 1
The entry tier of Defender for Office 365. Safe Links, Safe Attachments and impersonation protection guard mail and collaboration tools against phishing, business email compromise and zero-day malware. Bundled with Microsoft 365 Business Premium, and from 1 July 2026 with Office 365 E3 and Microsoft 365 E3 too.