The three machines
- Spoof intelligence: catches senders using YOUR (or others') domains without authentication rights — driven by the auth trio's verdicts + Microsoft's cross-tenant intelligence. Its override surface is the spoofed-senders tab of the Tenant Allow/Block List.
- Impersonation protection (per anti-phish policy): similarity attacks — display names near your executives' ("Nikí Kalaru"), domains near yours (contoso-payments.com). You SEED it: protected users (execs, finance) and protected domains; it fuzzy-matches inbound against the seeds.
- Mailbox intelligence: per-recipient relationship graphs — 'this sender is new for THIS user despite looking familiar' — powering first-contact hints and smarter impersonation verdicts.
Why the distinction pays: a bypass/false-positive fix belongs to the machine that fired. Releasing a quarantined 'impersonation' by adding an SPF include does nothing (wrong machine); the trace/quarantine entry names WHICH verdict fired — read it first, always.
The false-positive economics
Impersonation is fuzzy by design, so its costs concentrate predictably: rebrands and lookalike sister companies (protect-domain collisions), common names (a real 'John Smith' vendor vs your protected CFO 'John Smith'), and newsletters with display names of seeded execs. Budget the tuning: seed the SHORT list that matters (10-30 users, not 500), review impersonation verdicts weekly for the first month, and use the policy's trusted-senders exceptions rather than global allows (smallest-scope override, per the pipeline concept's debt rules).
What to watch (proofs)
- Which machine fired: quarantine/trace verdict detail (phish/high-confidence/impersonation-user/impersonation-domain/spoof) — the routing label for every ticket.
- The policy truth: Get-AntiPhishPolicy | fl Enable*, Impersonation, TargetedUser*, TargetedDomain* (in the nightly scan — seeded-user drift is security-relevant: who REMOVED the CFO?).
- Spoof landscape: the spoof intelligence insight (Get-SpoofIntelligenceInsight — scanned) — who's sending as you, legitimately or not; the census feeding both TABL decisions and the DMARC journey.
- Tuning debt: impersonation false-positive rate over time (release patterns from quarantine data) — flat after month one or the seeding is wrong.