---
title: "Microsoft 365 email security | DataRoad IT"
description: "Fake CEO requests, fake logins and QR codes get past the Microsoft 365 filter. Four managed security settings close the door. No-obligation proposal."
language: en
url: https://www.dataroad-it.com/en/microsoft-365-email-fraud-managed-security/
source: https://www.dataroad-it.com/en/microsoft-365-email-fraud-managed-security/
publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal
---

> Fake CEO requests, fake logins and QR codes get past the Microsoft 365 filter. Four managed security settings close the door. No-obligation proposal.

# Microsoft 365 email security: what the filter lets through

At a glance For decision-makers short on time.

- 01 Microsoft 365's native filter stops spam and known viruses, not credible payment requests.
- 02 In 2025, fake CEO and altered invoices made up 18% of social engineering reported to CERT.PT.
- 03 MFA, external forwarding off, SPF/DKIM/DMARC and phone checks close almost everything.
- 04 DataRoad runs a Microsoft 365 email diagnosis in 5 working days.

### In this article

A single payment to the wrong IBAN is enough to wipe out a quarter's profit. The **Microsoft 365 email security** that comes switched on out of the box was not built to prevent that: it stops junk, catalogued viruses and links already reported. A credible message from a genuine mailbox gets through without an alarm. Closing that gap takes configuration and internal discipline, and that is exactly where DataRoad's managed cybersecurity comes in.

## How big is the risk in Portugal?

The Centro Nacional de Cibersegurança (CNCS), Portugal's national cybersecurity centre, published the previous year's figures in 2026. CERT.PT recorded 3,864 incidents in 2025, a 40% rise on 2024. Of the social engineering cases reported, 18% were frauds in which someone impersonated a director or a supplier.

These attacks carry no virus. They carry a routine, well-written request: settle an invoice or validate a password.

## Why does Microsoft's filter not detect them?

The filtering engine looks for similarities with already known threats. It does that very well. It does not read intent. A real supplier announcing a change of bank writes from its own domain, with no infected attachment and no suspicious address. Technically, everything checks out.

## Which three scams get through most often?

### 1. The diverted payment

The criminal gains access to a mailbox, yours or a supplier's, and watches in silence. When a high-value invoice comes up, they write in the same thread giving a new IBAN. Sometimes they use an almost identical domain, with one character different.

The defence costs nothing: a written policy that forbids accepting new bank details by email. You call the supplier on the contact already on file, never the one in the message. We detail the procedure in the guide to [invoices with an altered IBAN](https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/).

### 2. The cloned sign-in screen

A "shared file" or "mailbox full" notice leads to a replica of the Microsoft login. The employee enters their credentials and hands over the account. The attacker then creates a rule that diverts everything mentioning payments to an outside address. Scam 1 is now launched from inside your company.

The answer here is multi-factor authentication. Even with the password in hand, the intruder stays locked out without the employee's phone. No other single measure reduces account theft as much.

### 3. The QR code that slips past the filter

With links under ever closer scrutiny, attackers hide the destination in a QR code inside a PDF, an image or an encrypted attachment the filter cannot open. It is scanned on a personal phone, far from corporate defences, and what appears is usually a variation of scam 2.

## Which settings close the door, and what do they cost?

None of them requires buying another product. They are settings in the tenant itself and company rules.

| Setting | Scam blocked | Business result |
| --- | --- | --- |
| Multi-factor authentication for everyone | 2 and 3 | Stolen credentials become useless. |
| External forwarding switched off | 1 and 2 | No compromised mailbox exports mail without anyone knowing. |
| SPF, DKIM and DMARC records | 1 | Recipients can reject imitations of your domain. |
| Phone verification of IBANs | 1 | Bank details do not change by message. |
| Regular training sessions | 1, 2 and 3 | The team recognises manufactured urgency and requests for secrecy. |

### External forwarding: who decides?

By default, this policy is set to "automatic, system-controlled". Microsoft advises setting the option explicitly, because behaviour varies from tenant to tenant. For most SMEs, switching it off and approving exceptions individually is the safe choice.

### What are SPF, DKIM and DMARC, in two lines each?

- **SPF**: declares which servers may send mail using your domain.
- **DKIM**: signs each message to prove it arrived intact.
- **DMARC**: tells the recipient to reject, quarantine or just flag failures, and sends you reports on who is using your name.

According to Microsoft, enabling only one or two of these mechanisms leaves protection half done. The right path is gradual: list every platform that sends email on the company's behalf (invoicing, newsletter, CRM) and only then tighten the policy. A poorly planned DMARC can block your own invoices.

The foundation is [MFA on every account](https://www.dataroad-it.com/en/mfa-business-14-day-plan/). Before investing in extra tools, see [which protections your Microsoft 365 licence already includes](https://www.dataroad-it.com/en/managed-microsoft-365-sme-licences-backup/).

## What lesson do we draw from a 50-mailbox migration?

Through a public tender, the União das Freguesias de Massamá e Monte Abraão entrusted DataRoad with the [migration of around 50 mailboxes to Exchange Online](https://www.dataroad-it.com/en/massama-monte-abraao-exchange-online-migration/). We moved emails, folders and data, reconfigured computers and phones and validated the result.

A migration is the ideal moment to harden security. Setting the right rules once, for 50 mailboxes, is far cheaper than fixing them mailbox by mailbox after a fraud.

## What can you do this week?

- Confirm MFA on every account, including shared and admin accounts.
- Demand the list of active forwards and investigate any unexplained external destination.
- Find out which mode your domain's DMARC is in.
- Put the phone confirmation rule for IBANs in writing.
- Schedule a session to [train the team against phishing and deepfakes](https://www.dataroad-it.com/en/phishing-deepfakes-team-awareness-plan/).

## Questions from decision-makers

### Is the protection included in Microsoft 365 enough?

Not for financial fraud. It handles catalogued spam and malware, but lets through requests that are legitimate in form and fraudulent in intent. The difference comes from configuration and procedures.

### Do we need to buy an additional solution?

In most cases, not straight away. The first gain comes from tuning what the licence already pays for; extra tools are assessed afterwards, according to sector and risk.

### How do we check whether the domain has DMARC active?

Ask your IT partner to read the domain's DNS records. Without DMARC, or with DMARC in monitoring mode only, anyone can imitate your company with very little effort.

### Someone gave their password on a fake page. What is the first step?

Change the password immediately and end all open sessions. Then confirm MFA, audit recent rules and forwards and ask accounts to freeze payments to IBANs changed in the last few days.

## A diagnosis of your Microsoft 365 email in 5 working days

We audit MFA, forwards, mailbox rules and SPF, DKIM and DMARC and return a prioritised remediation plan, with no commitment. Continuous oversight is included in [IT Unlimited Premium](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/), in our [Microsoft 365 for business](https://www.dataroad-it.com/en/microsoft-365-management/) service and in [DataRoad's managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/).

**More than 10 workstations · support contract · remote, on-site and telephone support.** Call +351 211 459 950 * or write to sales@dataroad.pt.

**Call to a Portuguese landline.*

## Sources

- [Renascença: CNCS: fake CEO accounted for 18% of social engineering incidents reported in 2025](https://rr.pt/noticia/pais/2026/04/21/fraudes-que-imitam-ceos-estao-a-disparar-em-portugal-veja-como-evitar-perder-dinheiro/467760/)
- [Lusa / DNoticias: CERT.PT recorded 3,864 incidents in 2025 (+40%)](https://www.dnoticias.pt/2026/4/28/490057-incidentes-de-seguranca-informatica-em-portugal-aumentaram-40-em-2025/)
- [Microsoft Learn: Email authentication in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about)
- [Microsoft Learn: Controlling external email forwarding](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding)

Chosen by respected and international companies

★★★★★ 5,0 · 52 Google reviews

★★★★★ 5,0 · 52 Google reviews

DataRoad

## Related articles

[Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/)

Numbers you can verify

**11** years in business

**232** clients

**< 10 min** average response time

**15+** IT vendor certifications

**10+** Countries with clients supported

**5.0 ★** 52 Google reviews

Transparency

## What many providers hide, we publish.

[See plans and prices →](https://www.dataroad-it.com/it-unlimited/)

- **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200.
- **No lock-in** Annual contract, no lock-in and no joining fees.
- **Everything in writing** What is included, the scope and the price, before you sign.
- **Support without counted hours** Remote and phone in every plan; on-site support from Premium.

Partners and certifications

DataRoad · Managed cybersecurity

## One StepAhead of IT.

Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client.

- **11** years in business, since 2015
- **0** DataRoad security incidents in 11 years
- **Top 5%** SMEs · scoring.pt

We do **IT** right.

DataRoad IT Unlimited

## Does your IT depend on a single person?

Documentation, inventory and one contact who answers for everything.

[Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente)

---
Versão HTML desta página: https://www.dataroad-it.com/en/microsoft-365-email-fraud-managed-security/