What presets actually are
Bundled EOP+Defender configurations (anti-spam, anti-phish incl. impersonation, Safe Links/Attachments) at two postures — Standard (balanced) and Strict (aggressive) — with three defining properties:
- Microsoft-maintained: settings track their evolving recommendations without your involvement — the anti-drift property; your custom policies fossilise, presets don't.
- Locked: you scope WHO, never WHAT — no tweaking a preset's thresholds.
- Top precedence: presets outrank all custom policies for included recipients (Strict > Standard > custom-by-priority > default) — the pipeline concept's step-5 rule, and the #1 cause of 'my policy does nothing' tickets.
The design pattern that works
Presets as the estate floor (Standard for the org; Strict for the phish-magnet population: execs, finance, IT admins — the same list you seeded into impersonation protection) + custom policies only for justified exceptions (the SOC mailbox that must receive malware samples; the app mailbox where bulk verdicts misfire) — each custom policy carrying a written reason and an owner, because each one is opted OUT of Microsoft's maintenance and starts rotting the day it's born.
The anti-pattern: a custom policy per historical complaint, nobody in presets, settings frozen at 2021's recommendations — the estate that discovers QR-phishing protection exists only during the incident.
Migration honesty
Moving a brownfield estate onto presets means some verdicts CHANGE (stricter bulk/spam thresholds): stage by population, watch quarantine deltas for a week per wave, and pre-brief the release-request queue (quarantine concept) for the transition bulge. The configuration-analyzer's preset-comparison view is the gap report to run first.
What to watch (proofs)
- Who's under which regime: preset rule scoping (Get-ATPProtectionPolicyRule / EOPProtectionPolicyRule — scanned) vs custom policy scopes — one grid, no recipient unaccounted for.
- The step-5 winner per disputed user: the effective-policy tooling — screenshot into every 'policy not applying' ticket (pipeline concept's discipline).
- Custom-policy debt: each custom policy's delta vs current Standard (configuration analyzer) — the rot metric, quarterly.
- Preset drift events: Microsoft updating preset contents lands as behaviour change without config change — the golden-canary logic (Copilot reliability concept) applies: watch verdict-mix trends after MC announcements on EOP.