Add/Remove user to User Impersonation protection in th Anti Phishing policy

You can protect new onboarded users against impersonation, or remove offboarded users by editing the Anti-phishing policy configured for your tenant.

Important: To protect new users' mailboxes or Shared Mailboxes, you must make sure that the account has a Defender for Office Plan 1 or Plan 2 license, or any package that includes any of these licenses, like Microsoft 365 E5, or others.

Protect new user/mailbox againts Impersonation

1. In the Microsoft Defender portal at https://security.microsoft.com, go to Email & Collaboration > Policies & Rules > Threat policies
2. In the Policies section click over Anti-phishing
3. Select the policy you will be adding the user to. (Select your custom policy if you created one and is turned on) > click on Edit protection settings hyperlink
4. Click on Managed Sender(s) down below Enabled users to protect section
5. Select Add user. In the Add user flyout that opens
6. Start typing the user's email address > select the email address in the Suggested contacts dropdown list that appears.  When you're finished selecting the user, select Add
7. When you're finished on the Add user flyout, select Add button  
8. In the next flyout click Done > then Save

Removed offboarded or unlincesed user/mailbox

1. Repeat the first 4 steps above to make it to Manage Senders
2. Select the user account to remove and click the Remove selected users icon
3. Click the Done button > then Save