# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-MAIL-019
title: Apply the Standard preset security policy to all recipients
finding:
  title: Not every recipient is covered by the Standard or Strict preset security policies
  description: Users outside the preset policies rely on default or hand-built settings that are often weaker than Microsoft's recommended values and drift over time.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [defender-for-office-365, exchange-online-protection, preset-security-policies, anti-phishing, anti-malware]

description: |
  The **Standard protection** preset security policy is turned on and applies to all recipients,
  both for **Exchange Online Protection** (anti-spam, anti-malware, anti-phishing spoof settings)
  and, when the tenant has Defender for Office 365, for **Defender for Office 365** (impersonation,
  Safe Attachments, Safe Links). Sensitive accounts are in the **Strict protection** preset
  (CB-M365-MAIL-020), which takes precedence.

  Recipients are not excluded from the presets or from the **Built-in protection** preset, except
  documented service mailboxes (for example the SecOps mailbox of the advanced delivery policy).

  Custom policies remain acceptable for a population that needs other values, provided they meet
  the values of CB-M365-MAIL-021 to CB-M365-MAIL-030; the preset is the simplest way to get and keep
  Microsoft's recommended values, because Microsoft updates it.
rationale: |
  Microsoft's Standard and Strict values are the reference for email threat protection, and the
  presets apply them as a whole, cannot be weakened by mistake and follow Microsoft's updates.
  Hand-built policies tend to leave gaps: a missing domain in the recipient conditions, a disabled
  policy, a forgotten setting after a new feature is released.
impact: |
  Users may see more messages in Junk Email or quarantine, and quarantine notifications. Tell the
  help desk how to release messages and report false positives. Impersonation protection in the
  Defender for Office 365 part needs the list of protected users and domains
  (CB-M365-MAIL-029).
notes: |
  The Defender for Office 365 part applies only with a Defender for Office 365 Plan 1 or Plan 2
  license; without it, only the Exchange Online Protection part is checked.

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset
       security policies**.
    3. Check that **Standard protection** is on, and open **Manage protection settings**: **Apply
       Exchange Online Protection to** and **Apply Defender for Office 365 protection to** are set to
       **All recipients**, with no exclusions other than documented service mailboxes.
    4. Check that **Built-in protection** has no excluded recipients.
    5. In Exchange Online PowerShell (read-only):
       ```powershell
       Get-EOPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
       Get-ATPProtectionPolicyRule | Format-List Identity, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
       Get-ATPBuiltInProtectionRule | Format-List Identity, Except*
       ```
       The Standard rule must be `Enabled` and either have no recipient condition or list every
       accepted domain (`Get-AcceptedDomain`).
    6. Fail if the Standard preset is off, if it covers only part of the recipients without custom
       policies meeting the same values for the others, or if recipients are excluded without a
       documented reason.

remediation:
  manual: |
    1. In the Defender portal, browse to **Preset security policies** and, under **Standard
       protection**, select **Manage protection settings** (Security Administrator).
    2. **Apply Exchange Online Protection to**: **All recipients**. **Apply Defender for Office 365
       protection to**: **All recipients**. Add exclusions only for documented service mailboxes.
    3. In **Impersonation protection**, add the users and domains to protect (see
       CB-M365-MAIL-029), review the policy and select **Confirm**.
    4. Turn the **Standard protection** toggle on.
    5. PowerShell equivalent once the preset was set up in the portal:
       ```powershell
       Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
       Enable-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"
       ```
  rollback: |
    Turn the Standard protection toggle off; recipients fall back to custom or default policies.

references:
  - title: Preset security policies in EOP and Microsoft Defender for Office 365
    url: https://learn.microsoft.com/defender-office-365/preset-security-policies
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Recommended settings for EOP and Microsoft Defender for Office 365 security
    url: https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA removed policies (MS.DEFENDER.1.x)
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/removedpolicies.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
  - title: ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-239)
    url: https://github.com/cammurray/orca
    publisher: Microsoft (community project)
    kind: tool
    accessed: 2026-10-24
mappings:
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.1.1v1
    relation: partial
    note: Removed from SCuBA; kept for traceability. The Strict preset part is covered by CB-M365-MAIL-020.
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.1.2v1
    relation: equivalent
    note: Removed from SCuBA; kept for traceability.
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.1.3v1
    relation: equivalent
    note: Removed from SCuBA; kept for traceability.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-3
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-8
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-6
    relation: related
threats:
  - framework: mitre-attack
    id: T1566
related_controls:
  - id: CB-M365-MAIL-020
    type: related
  - id: CB-M365-MAIL-021
    type: related
  - id: CB-M365-MAIL-025
    type: related
  - id: CB-M365-MAIL-028
    type: related
  - id: CB-M365-MAIL-029
    type: related
  - id: CB-M365-MAIL-030
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24