Tag priority accounts and protect them with the Strict preset security policy

Description

The organization's sensitive users ({{ priority_accounts }}) are:

• tagged as Priority account (up to 250 users);
• covered by Priority account protection, turned on for the tenant (EnablePriorityAccountProtection $true), which applies extra detection heuristics to them;
• assigned to the Strict protection preset security policy, for both Exchange Online Protection and Defender for Office 365, ideally through a group;
• listed as protected users for user impersonation in the Standard and Strict presets (CB-M365-MAIL-029).

Rationale

Executives, finance staff, assistants and administrators receive the most targeted phishing and business email compromise attempts, and one mistake on their side costs the most. The Strict values quarantine more aggressively, and the priority account tag makes their incidents stand out in alerts, Threat Explorer and reports so the SOC handles them first.

Impact

Priority users get more messages in quarantine (Strict quarantines spam, bulk and spoof detections) and need a quick release path through the help desk. Keep the group up to date when people change roles.

Applies when

Requires: Microsoft Defender for Office 365 Plan 2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Settings > Email & collaboration > Priority account protection and check that it is turned on.
3. Browse to Settings > Microsoft Defender XDR > Asset rule management (or User tags, depending on the tenant) and check that the Priority account tag holds the expected users.
4. Browse to Email & collaboration > Policies & rules > Threat policies > Preset security policies and check that Strict protection is on and applies to the same users, for both Exchange Online Protection and Defender for Office 365.
5. In Exchange Online PowerShell (read-only):

   Get-EmailTenantSettings | Format-List EnablePriorityAccountProtection
   Get-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs
   Get-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs
   

6. Fail if priority account protection is off, if no user is tagged, or if a priority user is not covered by the Strict preset.

Remediation

1. Create or reuse a mail-enabled security group holding {{ priority_accounts }}.
2. Tag the users: in the Microsoft 365 admin center, Users > Active users, select them > Manage priority accounts (or use the Priority account tag in the Defender portal) (Security Administrator or Exchange Administrator).
3. In the Defender portal, Settings > Email & collaboration > Priority account protection: turn it on. PowerShell equivalent:

   Set-EmailTenantSettings -EnablePriorityAccountProtection $true
   

4. In Preset security policies > Strict protection > Manage protection settings, apply both protections to the group, add the same users to impersonation protection, and turn Strict protection on.

Rollback

Remove the group from the Strict preset; the users fall back to the Standard preset.

References

• Security recommendations for priority accounts in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Manage and monitor priority accounts Microsoft, vendor-doc, accessed 2026-10-24
• Preset security policies in EOP and Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-245) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients
• related CB-M365-MAIL-029 Configure anti-phishing impersonation protection, mailbox intelligence and safety tips

People and lifecycle