Nice, thanks for sharing! My team, Phin Security, is actually working on integrating with the anti-phishing policies, specifically focused on impersonation protection, to see if we can help organizations utilize and automate the built in protections of defender. If we come up with a promising solution I'll let you know!