# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-MAIL-020
title: Tag priority accounts and protect them with the Strict preset security policy
finding:
  title: Executives and other high-value users get no extra email protection
  description: The accounts attackers target first for fraud and phishing are filtered like everyone else and are not flagged in alerts and reports.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [defender-for-office-365, priority-accounts, preset-security-policies, executives, phishing]

applicability:
  requires:
    - "Microsoft Defender for Office 365 Plan 2"

description: |
  The organization's sensitive users ({{ priority_accounts }}) are:

  - tagged as **Priority account** (up to 250 users);
  - covered by **Priority account protection**, turned on for the tenant
    (`EnablePriorityAccountProtection $true`), which applies extra detection heuristics to them;
  - assigned to the **Strict protection** preset security policy, for both Exchange Online
    Protection and Defender for Office 365, ideally through a group;
  - listed as protected users for user impersonation in the Standard and Strict presets
    (CB-M365-MAIL-029).
rationale: |
  Executives, finance staff, assistants and administrators receive the most targeted phishing and
  business email compromise attempts, and one mistake on their side costs the most. The Strict
  values quarantine more aggressively, and the priority account tag makes their incidents stand out
  in alerts, Threat Explorer and reports so the SOC handles them first.
impact: |
  Priority users get more messages in quarantine (Strict quarantines spam, bulk and spoof
  detections) and need a quick release path through the help desk. Keep the group up to date when
  people change roles.

parameters:
  - name: priority_accounts
    type: string
    description: Who must be tagged as priority accounts.
    default: executives, their assistants, finance and payroll staff, and administrators who still have a mailbox

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Settings** > **Email & collaboration** > **Priority account protection** and check
       that it is turned on.
    3. Browse to **Settings** > **Microsoft Defender XDR** > **Asset rule management** (or **User
       tags**, depending on the tenant) and check that the **Priority account** tag holds the
       expected users.
    4. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset
       security policies** and check that **Strict protection** is on and applies to the same users,
       for both Exchange Online Protection and Defender for Office 365.
    5. In Exchange Online PowerShell (read-only):
       ```powershell
       Get-EmailTenantSettings | Format-List EnablePriorityAccountProtection
       Get-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs
       Get-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo, SentToMemberOf, RecipientDomainIs
       ```
    6. Fail if priority account protection is off, if no user is tagged, or if a priority user is not
       covered by the Strict preset.

remediation:
  manual: |
    1. Create or reuse a mail-enabled security group holding {{ priority_accounts }}.
    2. Tag the users: in the Microsoft 365 admin center, **Users** > **Active users**, select them >
       **Manage priority accounts** (or use the **Priority account** tag in the Defender portal)
       (Security Administrator or Exchange Administrator).
    3. In the Defender portal, **Settings** > **Email & collaboration** > **Priority account
       protection**: turn it on. PowerShell equivalent:
       ```powershell
       Set-EmailTenantSettings -EnablePriorityAccountProtection $true
       ```
    4. In **Preset security policies** > **Strict protection** > **Manage protection settings**,
       apply both protections to the group, add the same users to impersonation protection, and turn
       Strict protection on.
  rollback: |
    Remove the group from the Strict preset; the users fall back to the Standard preset.

references:
  - title: Security recommendations for priority accounts in Microsoft 365
    url: https://learn.microsoft.com/defender-office-365/priority-accounts-security-recommendations
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Manage and monitor priority accounts
    url: https://learn.microsoft.com/microsoft-365/admin/setup/priority-accounts
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Preset security policies in EOP and Microsoft Defender for Office 365
    url: https://learn.microsoft.com/defender-office-365/preset-security-policies
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-245)
    url: https://github.com/cammurray/orca
    publisher: Microsoft (community project)
    kind: tool
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "2.4.1"
    relation: equivalent
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "2.4.2"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.1.4v1
    relation: equivalent
    note: Removed from SCuBA; kept for traceability.
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.DEFENDER.1.5v1
    relation: equivalent
    note: Removed from SCuBA; kept for traceability.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-8
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1566
  - framework: mitre-attack
    id: T1656
related_controls:
  - id: CB-M365-MAIL-019
    type: related
  - id: CB-M365-MAIL-029
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24