In plain English
MDO is the layer of protection that sits on top of Exchange Online to catch threats that standard spam filtering misses. It detonates email attachments in a sandbox to test for malware, rewrites URLs to scan them in real time before you click, and uses AI to detect impersonation attacks targeting your executives.
Full definition
Standard spam filtering catches bulk mail and known malicious senders. Defender for sits on top of to catch the threats that basic filtering misses: attacks, malicious attachments that have never been seen before, and impersonation attempts designed to look like they came from your CEO or a trusted supplier.
Safe Attachments works by opening email attachments in an isolated sandbox before delivering them to the recipient. If the attachment tries to execute code, contact an external server, or behave suspiciously, it is blocked. Safe Links rewrites URLs in emails and scans the destination in real time at the moment you click, not at the time the email arrived. That matters because attackers frequently use clean URLs that only redirect to malicious content after initial delivery. Anti- policies detect when an email is impersonating a known contact or an external brand, even when the sender address looks legitimate.
is the most financially damaging cyber threat facing Australian SMEs, according to the ACCC's Scamwatch data. A convincing email appearing to come from a supplier, requesting a change to payment details, can result in significant funds transferred before anyone realises. Defender for Office 365 Plan 2 includes Attack Simulator, which lets you run controlled phishing campaigns against your own staff to measure susceptibility and feed results into .