{
  "id": "CB-M365-MAIL-020",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-020",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-020.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-020.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-020",
    "title": "Tag priority accounts and protect them with the Strict preset security policy",
    "finding": {
      "title": "Executives and other high-value users get no extra email protection",
      "description": "The accounts attackers target first for fraud and phishing are filtered like everyone else and are not flagged in alerts and reports."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "priority-accounts",
      "preset-security-policies",
      "executives",
      "phishing"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 2"
      ]
    },
    "description": "The organization's sensitive users ({{ priority_accounts }}) are:\n\n- tagged as **Priority account** (up to 250 users);\n- covered by **Priority account protection**, turned on for the tenant\n  (`EnablePriorityAccountProtection $true`), which applies extra detection heuristics to them;\n- assigned to the **Strict protection** preset security policy, for both Exchange Online\n  Protection and Defender for Office 365, ideally through a group;\n- listed as protected users for user impersonation in the Standard and Strict presets\n  (CB-M365-MAIL-029).\n",
    "rationale": "Executives, finance staff, assistants and administrators receive the most targeted phishing and\nbusiness email compromise attempts, and one mistake on their side costs the most. The Strict\nvalues quarantine more aggressively, and the priority account tag makes their incidents stand out\nin alerts, Threat Explorer and reports so the SOC handles them first.\n",
    "impact": "Priority users get more messages in quarantine (Strict quarantines spam, bulk and spoof\ndetections) and need a quick release path through the help desk. Keep the group up to date when\npeople change roles.\n",
    "parameters": [
      {
        "name": "priority_accounts",
        "type": "string",
        "description": "Who must be tagged as priority accounts.",
        "default": "executives, their assistants, finance and payroll staff, and administrators who still have a mailbox"
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Settings** > **Email & collaboration** > **Priority account protection** and check\n   that it is turned on.\n3. Browse to **Settings** > **Microsoft Defender XDR** > **Asset rule management** (or **User\n   tags**, depending on the tenant) and check that the **Priority account** tag holds the\n   expected users.\n4. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset\n   security policies** and check that **Strict protection** is on and applies to the same users,\n   for both Exchange Online Protection and Defender for Office 365.\n5. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-EmailTenantSettings | Format-List EnablePriorityAccountProtection\n   Get-EOPProtectionPolicyRule -Identity \"Strict Preset Security Policy\" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs\n   Get-ATPProtectionPolicyRule -Identity \"Strict Preset Security Policy\" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs\n   ```\n6. Fail if priority account protection is off, if no user is tagged, or if a priority user is not\n   covered by the Strict preset.\n"
    },
    "remediation": {
      "manual": "1. Create or reuse a mail-enabled security group holding {{ priority_accounts }}.\n2. Tag the users: in the Microsoft 365 admin center, **Users** > **Active users**, select them >\n   **Manage priority accounts** (or use the **Priority account** tag in the Defender portal)\n   (Security Administrator or Exchange Administrator).\n3. In the Defender portal, **Settings** > **Email & collaboration** > **Priority account\n   protection**: turn it on. PowerShell equivalent:\n   ```powershell\n   Set-EmailTenantSettings -EnablePriorityAccountProtection $true\n   ```\n4. In **Preset security policies** > **Strict protection** > **Manage protection settings**,\n   apply both protections to the group, add the same users to impersonation protection, and turn\n   Strict protection on.\n",
      "rollback": "Remove the group from the Strict preset; the users fall back to the Standard preset.\n"
    },
    "references": [
      {
        "title": "Security recommendations for priority accounts in Microsoft 365",
        "url": "https://learn.microsoft.com/defender-office-365/priority-accounts-security-recommendations",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage and monitor priority accounts",
        "url": "https://learn.microsoft.com/microsoft-365/admin/setup/priority-accounts",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Preset security policies in EOP and Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/preset-security-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-245)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.1.4v1",
        "relation": "equivalent",
        "note": "Removed from SCuBA; kept for traceability."
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.1.5v1",
        "relation": "equivalent",
        "note": "Removed from SCuBA; kept for traceability."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      },
      {
        "framework": "mitre-attack",
        "id": "T1656"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-029",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}