cirsec Baselines
Esc
Microsoft 365 tenant · Exchange Online, Defender for Office 365 & mail DNS

Apply the Standard preset security policy to all recipients

When it fails: Not every recipient is covered by the Standard or Strict preset security policies. Users outside the preset policies rely on default or hand-built settings that are often weaker than Microsoft's recommended values and drift over time.

CB-M365-MAIL-019highactivemanualprofile baseline

Description

The Standard protection preset security policy is turned on and applies to all recipients, both for Exchange Online Protection (anti-spam, anti-malware, anti-phishing spoof settings) and, when the tenant has Defender for Office 365, for Defender for Office 365 (impersonation, Safe Attachments, Safe Links). Sensitive accounts are in the Strict protection preset (CB-M365-MAIL-020), which takes precedence.

Recipients are not excluded from the presets or from the Built-in protection preset, except documented service mailboxes (for example the SecOps mailbox of the advanced delivery policy).

Custom policies remain acceptable for a population that needs other values, provided they meet the values of CB-M365-MAIL-021 to CB-M365-MAIL-030; the preset is the simplest way to get and keep Microsoft's recommended values, because Microsoft updates it.

The Defender for Office 365 part applies only with a Defender for Office 365 Plan 1 or Plan 2 license; without it, only the Exchange Online Protection part is checked.

Rationale

Microsoft's Standard and Strict values are the reference for email threat protection, and the presets apply them as a whole, cannot be weakened by mistake and follow Microsoft's updates. Hand-built policies tend to leave gaps: a missing domain in the recipient conditions, a disabled policy, a forgotten setting after a new feature is released.

Impact

Users may see more messages in Junk Email or quarantine, and quarantine notifications. Tell the help desk how to release messages and report false positives. Impersonation protection in the Defender for Office 365 part needs the list of protected users and domains (CB-M365-MAIL-029).

Audit

  1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
  2. Browse to Email & collaboration > Policies & rules > Threat policies > Preset security policies.
  3. Check that Standard protection is on, and open Manage protection settings: Apply Exchange Online Protection to and Apply Defender for Office 365 protection to are set to All recipients, with no exclusions other than documented service mailboxes.
  4. Check that Built-in protection has no excluded recipients.
  5. In Exchange Online PowerShell (read-only): 
    Get-EOPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
Get-ATPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
Get-ATPBuiltInProtectionRule | Format-List Identity, Except*
    The Standard rule must be Enabled and either have no recipient condition or list every accepted domain (Get-AcceptedDomain).
  6. Fail if the Standard preset is off, if it covers only part of the recipients without custom policies meeting the same values for the others, or if recipients are excluded without a documented reason.

Remediation

  1. In the Defender portal, browse to Preset security policies and, under Standard protection, select Manage protection settings (Security Administrator).
  2. Apply Exchange Online Protection to: All recipients. Apply Defender for Office 365 protection to: All recipients. Add exclusions only for documented service mailboxes.
  3. In Impersonation protection, add the users and domains to protect (see CB-M365-MAIL-029), review the policy and select Confirm.
  4. Turn the Standard protection toggle on.
  5. PowerShell equivalent once the preset was set up in the portal: 
    Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Enable-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"

Rollback

Turn the Standard protection toggle off; recipients fall back to custom or default policies.

References

Mappings

FrameworkIDRelationNote
NIST SP 800-53 Rev. 55.1.1SI-3related
NIST SP 800-53 Rev. 55.1.1SI-8related
NIST SP 800-53 Rev. 55.1.1CM-6related
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.DEFENDER.1.1v1partialRemoved from SCuBA; kept for traceability. The Strict preset part is covered by CB-M365-MAIL-020.
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.DEFENDER.1.2v1equivalentRemoved from SCuBA; kept for traceability.
CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0MS.DEFENDER.1.3v1equivalentRemoved from SCuBA; kept for traceability.

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1566
  • related CB-M365-MAIL-020 Tag priority accounts and protect them with the Strict preset security policy
  • related CB-M365-MAIL-021 Turn on the common attachments filter in every anti-malware policy
  • related CB-M365-MAIL-025 Detonate email attachments with Safe Attachments set to Block for all recipients
  • related CB-M365-MAIL-028 Check links at time of click with Safe Links in email, Teams and Office for all recipients
  • related CB-M365-MAIL-029 Configure anti-phishing impersonation protection, mailbox intelligence and safety tips
  • related CB-M365-MAIL-030 Apply the recommended inbound anti-spam actions with no allowed senders or domains

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr