A reproducible walkthrough: turn on collaboration protection and close the download door, make the Safe Links rewrite decision explicit, and set the anti-phishing engine to act, with self-tests that prove each engine is live.
A reproducible walkthrough: enable and scope the Standard preset, populate the impersonation lists by hand, carve one custom exception, and wire quarantine notifications, validated end to end.
Prevention is bought once. Operations is the part that never stops, and it is where Defender for Office 365 either earns its place or gathers dust.
Three engines do the real catching, and each hides one decision that matters more than the rest. Teams is now inside the same blast radius.
The mail policy layer is a precedence order, not a pile of settings, and the first policy to match a user wins outright. Knowing which policy speaks for whom is the whole discipline.
Email is still the way in, but the part you configure has collapsed into a layered platform Microsoft tunes for you. This is where authority over mail and collaboration actually sits, and what is left to own.
The capstone: which workloads move to Azure Files directly, which sit behind a cache, and which honestly belong somewhere else, with the criteria stated plainly enough to argue with.
Vaulted backup, a snapshot schedule, soft delete verified, three alert rules, and the restore drill that turns the backup policy from hypothesis into fact.
