{
  "id": "CB-M365-MAIL-019",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-019",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-019.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-019.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-019",
    "title": "Apply the Standard preset security policy to all recipients",
    "finding": {
      "title": "Not every recipient is covered by the Standard or Strict preset security policies",
      "description": "Users outside the preset policies rely on default or hand-built settings that are often weaker than Microsoft's recommended values and drift over time."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "exchange-online-protection",
      "preset-security-policies",
      "anti-phishing",
      "anti-malware"
    ],
    "description": "The **Standard protection** preset security policy is turned on and applies to all recipients,\nboth for **Exchange Online Protection** (anti-spam, anti-malware, anti-phishing spoof settings)\nand, when the tenant has Defender for Office 365, for **Defender for Office 365** (impersonation,\nSafe Attachments, Safe Links). Sensitive accounts are in the **Strict protection** preset\n(CB-M365-MAIL-020), which takes precedence.\n\nRecipients are not excluded from the presets or from the **Built-in protection** preset, except\ndocumented service mailboxes (for example the SecOps mailbox of the advanced delivery policy).\n\nCustom policies remain acceptable for a population that needs other values, provided they meet\nthe values of CB-M365-MAIL-021 to CB-M365-MAIL-030; the preset is the simplest way to get and keep\nMicrosoft's recommended values, because Microsoft updates it.\n",
    "rationale": "Microsoft's Standard and Strict values are the reference for email threat protection, and the\npresets apply them as a whole, cannot be weakened by mistake and follow Microsoft's updates.\nHand-built policies tend to leave gaps: a missing domain in the recipient conditions, a disabled\npolicy, a forgotten setting after a new feature is released.\n",
    "impact": "Users may see more messages in Junk Email or quarantine, and quarantine notifications. Tell the\nhelp desk how to release messages and report false positives. Impersonation protection in the\nDefender for Office 365 part needs the list of protected users and domains\n(CB-M365-MAIL-029).\n",
    "notes": "The Defender for Office 365 part applies only with a Defender for Office 365 Plan 1 or Plan 2\nlicense; without it, only the Exchange Online Protection part is checked.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset\n   security policies**.\n3. Check that **Standard protection** is on, and open **Manage protection settings**: **Apply\n   Exchange Online Protection to** and **Apply Defender for Office 365 protection to** are set to\n   **All recipients**, with no exclusions other than documented service mailboxes.\n4. Check that **Built-in protection** has no excluded recipients.\n5. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-EOPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*\n   Get-ATPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*\n   Get-ATPBuiltInProtectionRule | Format-List Identity, Except*\n   ```\n   The Standard rule must be `Enabled` and either have no recipient condition or list every\n   accepted domain (`Get-AcceptedDomain`).\n6. Fail if the Standard preset is off, if it covers only part of the recipients without custom\n   policies meeting the same values for the others, or if recipients are excluded without a\n   documented reason.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, browse to **Preset security policies** and, under **Standard\n   protection**, select **Manage protection settings** (Security Administrator).\n2. **Apply Exchange Online Protection to**: **All recipients**. **Apply Defender for Office 365\n   protection to**: **All recipients**. Add exclusions only for documented service mailboxes.\n3. In **Impersonation protection**, add the users and domains to protect (see\n   CB-M365-MAIL-029), review the policy and select **Confirm**.\n4. Turn the **Standard protection** toggle on.\n5. PowerShell equivalent once the preset was set up in the portal:\n   ```powershell\n   Enable-EOPProtectionPolicyRule -Identity \"Standard Preset Security Policy\"\n   Enable-ATPProtectionPolicyRule -Identity \"Standard Preset Security Policy\"\n   ```\n",
      "rollback": "Turn the Standard protection toggle off; recipients fall back to custom or default policies.\n"
    },
    "references": [
      {
        "title": "Preset security policies in EOP and Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/preset-security-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommended settings for EOP and Microsoft Defender for Office 365 security",
        "url": "https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA removed policies (MS.DEFENDER.1.x)",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/removedpolicies.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-239)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.1.1v1",
        "relation": "partial",
        "note": "Removed from SCuBA; kept for traceability. The Strict preset part is covered by CB-M365-MAIL-020."
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.1.2v1",
        "relation": "equivalent",
        "note": "Removed from SCuBA; kept for traceability."
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.1.3v1",
        "relation": "equivalent",
        "note": "Removed from SCuBA; kept for traceability."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-020",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-021",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-025",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-028",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-029",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-030",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}