Microsoft 365 email security: what the filter lets through

The Centro Nacional de Cibersegurança (CNCS), Portugal's national cybersecurity centre, published the previous year's figures in 2026. CERT.PT recorded 3,864 incidents in 2025, a 40% rise on 2024. Of the social engineering cases reported, 18% were frauds in which someone impersonated a director or a supplier.

These attacks carry no virus. They carry a routine, well-written request: settle an invoice or validate a password.

The filtering engine looks for similarities with already known threats. It does that very well. It does not read intent. A real supplier announcing a change of bank writes from its own domain, with no infected attachment and no suspicious address. Technically, everything checks out.

1. The diverted payment

The criminal gains access to a mailbox, yours or a supplier's, and watches in silence. When a high-value invoice comes up, they write in the same thread giving a new IBAN. Sometimes they use an almost identical domain, with one character different.

The defence costs nothing: a written policy that forbids accepting new bank details by email. You call the supplier on the contact already on file, never the one in the message. We detail the procedure in the guide to invoices with an altered IBAN.

2. The cloned sign-in screen

A "shared file" or "mailbox full" notice leads to a replica of the Microsoft login. The employee enters their credentials and hands over the account. The attacker then creates a rule that diverts everything mentioning payments to an outside address. Scam 1 is now launched from inside your company.

The answer here is multi-factor authentication. Even with the password in hand, the intruder stays locked out without the employee's phone. No other single measure reduces account theft as much.

3. The QR code that slips past the filter

With links under ever closer scrutiny, attackers hide the destination in a QR code inside a PDF, an image or an encrypted attachment the filter cannot open. It is scanned on a personal phone, far from corporate defences, and what appears is usually a variation of scam 2.

None of them requires buying another product. They are settings in the tenant itself and company rules.

Through a public tender, the União das Freguesias de Massamá e Monte Abraão entrusted DataRoad with the migration of around 50 mailboxes to Exchange Online. We moved emails, folders and data, reconfigured computers and phones and validated the result.

A migration is the ideal moment to harden security. Setting the right rules once, for 50 mailboxes, is far cheaper than fixing them mailbox by mailbox after a fraud.

1. Confirm MFA on every account, including shared and admin accounts.
2. Demand the list of active forwards and investigate any unexplained external destination.
3. Find out which mode your domain's DMARC is in.
4. Put the phone confirmation rule for IBANs in writing.
5. Schedule a session to train the team against phishing and deepfakes.

We audit MFA, forwards, mailbox rules and SPF, DKIM and DMARC and return a prioritised remediation plan, with no commitment. Continuous oversight is included in IT Unlimited Premium, in our Microsoft 365 for business service and in DataRoad's managed cybersecurity.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• Renascença: CNCS: fake CEO accounted for 18% of social engineering incidents reported in 2025
• Lusa / DNoticias: CERT.PT recorded 3,864 incidents in 2025 (+40%)
• Microsoft Learn: Email authentication in Microsoft 365
• Microsoft Learn: Controlling external email forwarding