Getting started with email security in Microsoft 365 | Phishing protections 

Great work.

Great tips! One thing to keep in mind about Safe Links and Safe Attachments is that they are not included in all licences (like for exemple F3). So if you want to stay compliant you have to only include your Business Premium users in those policies. Microsoft makes it harder for us because you cannot use Security groups for that, only 365 groups. What I did was to create a 365 dynamic group for my BP users and disable the welcome email and hide the group.

One downside of that financial warning banner you explained at the end is it does ruin the message preview

In that financial warning banner you explained in the end, you can actually use CSS to apply more fancy graphics to that banner