Internal Impersonation Protection

The Internal Impersonation Protection feature protects your email domain from impersonation. Internal impersonation occurs when an attacker sends emails that appear to come from one of your domains.

For example, an organization's domain is example.com and an attacker sends emails from HR@example.com.

Before enabling this feature, ensure that your email authentication parameters (SPF, DKIM, DMARC) are set up correctly. Internal emails with incorrect authentication parameters appear suspicious to Graphus AI. They might cause the AI to quarantine legit emails from internal senders falsely or to mark them as suspicious with a banner. 

To enable this feature for an organization, in the navigation pane select Settings > General Settings. Click the Internal Impersonation Protection tab and click the toggle to enable it. Click Save Changes.

Reference articles

The following articles provide the needed information to set up your email authentication correctly:

• Microsoft 365 SPF, DKIM, DMARC Guide
• Google Workspace SPF, DKIM, DMARC Guide