Quarantine malware for admins only and notify admins of internal senders

Description

In every anti-malware policy that applies to users:

• messages with malware are quarantined with the quarantine policy AdminOnlyAccessPolicy (QuarantineTag AdminOnlyAccessPolicy): only administrators can release them;
• Notify an admin about undelivered messages from internal senders is on (EnableInternalSenderAdminNotifications $true) and sends to {{ malware_admin_address }} (InternalSenderAdminAddress).

ORCA check ORCA-110 reads the same property but expects it to be off, based on the old notification to the sender. The admin notification sends nothing to the sender, so this control keeps it on, as the CIS benchmark does.

Rationale

Malware sent from inside usually means a compromised account or device, and the security team needs to act quickly. Admin-only quarantine prevents users from releasing an infected message themselves.

Impact

The notification mailbox receives a message for each internal malware detection; route it to the SOC queue. The preset policies use admin-only quarantine but do not send notifications: the notification needs a custom policy or the default policy.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-malware and open each policy.
3. Check that Quarantine policy is AdminOnlyAccessPolicy and that Notify an admin about undelivered messages from internal senders is selected with the expected address.
4. In Exchange Online PowerShell (read-only):

   Get-MalwareFilterPolicy | Format-Table Name, QuarantineTag, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress
   

5. Fail if a policy that applies to users uses a quarantine policy that lets users release malware, or if no policy covering users sends internal sender notifications.

Remediation

1. In the Defender portal, open the policy > Edit protection settings, set Quarantine policy to AdminOnlyAccessPolicy, select Notify an admin about undelivered messages from internal senders, enter the address and save.
2. PowerShell equivalent (Security Administrator):

   Set-MalwareFilterPolicy -Identity Default -QuarantineTag AdminOnlyAccessPolicy `
     -EnableInternalSenderAdminNotifications $true -InternalSenderAdminAddress [email protected]
   

Rollback

Set-MalwareFilterPolicy -Identity Default -EnableInternalSenderAdminNotifications $false.

References

• Configure anti-malware policies in EOP Microsoft, vendor-doc, accessed 2026-10-24
• Quarantine policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-MAIL-021 Turn on the common attachments filter in every anti-malware policy

People and lifecycle