cirsec Baselines
Esc
Microsoft 365 tenant · Logging & monitoring

Turn on key Microsoft 365 alert policies and route them to a monitored destination

When it fails: Key security alert policies are off or send their alerts to nobody. Suspicious forwarding, compromised sending, connector abuse or malicious URL clicks raise alerts that no one receives, so the response starts late or never.

CB-M365-AUDIT-008mediumactivemanualprofile baseline

Description

In the Microsoft Defender portal, at least the alert policies in {{ alert_policies }} are turned on. Their alerts reach the security team through a monitored mailbox or distribution list in the email notification settings, or through the SIEM connector for Microsoft Defender XDR incidents (CB-M365-AUDIT-002).

Rationale

These built-in policies detect common signs of a mailbox or tenant compromise: an account sending spam or phishing, a new or changed connector used to relay mail, mass forwarding of messages, a user clicking a malicious link. They cost nothing to keep on, but they are only useful if someone sees the alert.

Impact

Alerts add load to the security team. Tune notification thresholds and route them into the normal incident queue rather than personal mailboxes.

Parameters

ParameterBaselineHardenedBounds
alert_policieslist. Built-in alert policies that must be on and routed to the security team (names as shown in the Defender portal).Suspicious email sending patterns detected, Suspicious connector activity, Suspicious email forwarding activity, Messages have been delayed, Tenant restricted from sending unprovisioned email, Tenant restricted from sending email, A potentially malicious URL click was detected, User restricted from sending email, Elevation of Exchange admin privilege, Creation of forwarding/redirect ruleSuspicious email sending patterns detected, Suspicious connector activity, Suspicious email forwarding activity, Messages have been delayed, Tenant restricted from sending unprovisioned email, Tenant restricted from sending email, A potentially malicious URL click was detected, User restricted from sending email, Elevation of Exchange admin privilege, Creation of forwarding/redirect rule

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) with the View-Only Manage Alerts role (or Security Reader).
  2. Browse to Email & collaboration > Policies & rules > Alert policy.
  3. For each policy in {{ alert_policies }}, check that Status is On and open it to check Email recipients (a monitored mailbox or list), unless the alerts are consumed in the SIEM.
  4. If the SIEM is used, check with the SOC that Defender XDR alerts from these policies appear there.
  5. Alternative in Security & Compliance PowerShell: Get-ProtectionAlert | Where-Object Name -in @(<list>) | Format-List Name,Disabled,NotificationEnabled,NotifyUser,Severity.
  6. Fail if a listed policy is off, or if its alerts reach neither a monitored address nor the SIEM.

Remediation

  1. Sign in to the Microsoft Defender portal with the Manage Alerts role (or Organization Configuration).
  2. Browse to Email & collaboration > Policies & rules > Alert policy.
  3. Turn on each listed policy, and under Edit policy > Set your recipients add the security team's monitored mailbox.
  4. Alternative in Security & Compliance PowerShell: Set-ProtectionAlert -Identity "<policy>" -Disabled $false -NotificationEnabled $true -NotifyUser [email protected].
  5. Connect Microsoft Defender XDR to the SIEM (CB-M365-AUDIT-002).

Rollback

Turn the policy off or remove the recipient.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1SI-4(5)related
NIST SP 800-53 Rev. 55.1.1IR-5related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.SECURITYSUITE.4.1v1stricterDefault list includes the SCuBA alerts plus Exchange admin elevation, forwarding rule creation and restricted user.
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.SECURITYSUITE.4.2v1equivalent

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1114.003
MITRE ATT&CKT1562.006
  • related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC
  • related CB-M365-MAIL-031 Set outbound sending limits and notify administrators of blocked senders
  • related CB-M365-MAIL-033 Send user-reported messages to Microsoft and to a reporting mailbox
  • related CB-M365-MAIL-001 Block automatic forwarding of mail to external recipients

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr