Connect your organisation's Microsoft 365 mailboxes to Defend from Defend → Sense → Phishing → Mailbox connections. This is part of Defend Users — Email, the email side of Defend.
Before you start
- You need a Microsoft 365 Global Administrator (or an admin who can grant tenant-wide consent).
- You need Defend admin access in The One Stack.
Steps
- Go to Defend → Sense → Phishing (open Phishing).
- On the Mailbox connections card, select Connect next to Microsoft 365.
- Sign in with your Microsoft admin account and review the permissions requested.
- Select Accept to grant consent for your organisation.
- You're returned to Defend → Sense → Phishing. The Mailbox connections card shows Microsoft 365 as Connected.
Mailbox connections live only under Defend → Sense → Phishing. There is no separate mailbox settings page under Defend Settings.
If the connection doesn't show Connected
- Make sure the account that selected Accept can grant tenant-wide consent.
- Try Connect again from Defend → Sense → Phishing.
- If it still doesn't show Connected, contact support.
Disconnect
On Defend → Sense → Phishing, open Mailbox connections and select Disconnect next to Microsoft 365. This removes the connection in The One Stack. You can also revoke the app's consent in Microsoft Entra admin center → Enterprise applications.