{
  "id": "CB-M365-MAIL-023",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-023",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-023.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-023.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-023",
    "title": "Quarantine malware for admins only and notify admins of internal senders",
    "finding": {
      "title": "Nobody is told when an internal mailbox sends malware",
      "description": "An internal account that sends infected attachments is often compromised, yet the security team only learns about it if it searches the reports."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online-protection",
      "anti-malware",
      "quarantine",
      "notifications"
    ],
    "description": "In every anti-malware policy that applies to users:\n\n- messages with malware are quarantined with the quarantine policy **AdminOnlyAccessPolicy**\n  (`QuarantineTag AdminOnlyAccessPolicy`): only administrators can release them;\n- **Notify an admin about undelivered messages from internal senders** is on\n  (`EnableInternalSenderAdminNotifications $true`) and sends to {{ malware_admin_address }}\n  (`InternalSenderAdminAddress`).\n",
    "rationale": "Malware sent from inside usually means a compromised account or device, and the security team\nneeds to act quickly. Admin-only quarantine prevents users from releasing an infected message\nthemselves.\n",
    "impact": "The notification mailbox receives a message for each internal malware detection; route it to the\nSOC queue. The preset policies use admin-only quarantine but do not send notifications: the\nnotification needs a custom policy or the default policy.\n",
    "notes": "ORCA check ORCA-110 reads the same property but expects it to be off, based on the old\nnotification to the sender. The admin notification sends nothing to the sender, so this control\nkeeps it on, as the CIS benchmark does.\n",
    "parameters": [
      {
        "name": "malware_admin_address",
        "type": "string",
        "description": "Address that receives admin notifications for malware sent by internal users.",
        "default": "a monitored mailbox of the security operations team"
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** >\n   **Anti-malware** and open each policy.\n3. Check that **Quarantine policy** is **AdminOnlyAccessPolicy** and that **Notify an admin about\n   undelivered messages from internal senders** is selected with the expected address.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-MalwareFilterPolicy | Format-Table Name, QuarantineTag, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress\n   ```\n5. Fail if a policy that applies to users uses a quarantine policy that lets users release\n   malware, or if no policy covering users sends internal sender notifications.\n"
    },
    "remediation": {
      "manual": "1. In the Defender portal, open the policy > **Edit protection settings**, set **Quarantine\n   policy** to **AdminOnlyAccessPolicy**, select **Notify an admin about undelivered messages\n   from internal senders**, enter the address and save.\n2. PowerShell equivalent (Security Administrator):\n   ```powershell\n   Set-MalwareFilterPolicy -Identity Default -QuarantineTag AdminOnlyAccessPolicy `\n     -EnableInternalSenderAdminNotifications $true -InternalSenderAdminAddress soc@example.com\n   ```\n",
      "rollback": "`Set-MalwareFilterPolicy -Identity Default -EnableInternalSenderAdminNotifications $false`.\n"
    },
    "references": [
      {
        "title": "Configure anti-malware policies in EOP",
        "url": "https://learn.microsoft.com/defender-office-365/anti-malware-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Quarantine policies",
        "url": "https://learn.microsoft.com/defender-office-365/quarantine-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.1.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-6",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-021",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}