{
  "id": "CB-M365-MAIL-029",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-029",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-029.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-029.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-029",
    "title": "Configure anti-phishing impersonation protection, mailbox intelligence and safety tips",
    "finding": {
      "title": "Anti-phishing policies do not protect against impersonation of key users and domains",
      "description": "Look-alike senders posing as executives, the organization's own domains or key partners are delivered without a warning or quarantine."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-office-365",
      "anti-phishing",
      "impersonation",
      "mailbox-intelligence",
      "safety-tips"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Office 365 Plan 1"
      ]
    },
    "description": "Every recipient is covered by an anti-phishing policy (the impersonation settings of the\nStandard or Strict preset, or a custom policy) with at least the Standard values:\n\n- **Phishing email threshold** at {{ phish_threshold }} or higher (`PhishThresholdLevel`);\n- user impersonation protection on (`EnableTargetedUserProtection $true`) for\n  {{ protected_users }}, action **Quarantine the message**;\n- domain impersonation protection on for the organization's domains\n  (`EnableOrganizationDomainsProtection $true`) and for {{ partner_domains }}\n  (`EnableTargetedDomainsProtection $true`), action **Quarantine the message**;\n- mailbox intelligence and intelligence for impersonation protection on\n  (`EnableMailboxIntelligence`, `EnableMailboxIntelligenceProtection`), action **Move the message\n  to the recipients' Junk Email folders** or stricter;\n- safety tips on: user impersonation, domain impersonation, unusual characters, first contact,\n  unauthenticated sender (?) and \"via\" tag;\n- spoof intelligence on, spoofed senders moved to Junk Email or quarantined;\n- trusted senders and domains (`ExcludedSenders`, `ExcludedDomains`) empty or limited to\n  documented false positives.\n",
    "rationale": "Business email compromise relies on a sender that looks like someone the victim trusts: the CEO\nfrom a personal address, `examp1e.com` for `example.com`, a supplier asking to change bank\ndetails. Impersonation protection compares senders with the protected names and domains and with\neach user's usual contacts (mailbox intelligence); safety tips warn users when the match is not\ncertain.\n",
    "impact": "Some legitimate messages (a protected executive writing from a personal account, a partner with\na similar domain) may be quarantined; add them as trusted senders or domains after review. The\nprotected user list is limited to 350 entries per policy.\n",
    "parameters": [
      {
        "name": "phish_threshold",
        "type": "integer",
        "description": "Minimum phishing email threshold (1 Standard, 2 Aggressive, 3 More aggressive, 4 Most aggressive).",
        "default": 3,
        "minimum": 1,
        "maximum": 4
      },
      {
        "name": "protected_users",
        "type": "string",
        "description": "Senders protected against user impersonation.",
        "default": "the priority accounts (CB-M365-MAIL-020) and other people who approve payments or data access"
      },
      {
        "name": "partner_domains",
        "type": "string",
        "description": "External domains protected against domain impersonation.",
        "default": "the domains of key suppliers, customers, banks and service providers the organization exchanges money or data with"
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Preset\n   security policies** and review the impersonation protection of the Standard and Strict\n   presets; then **Threat policies** > **Anti-phishing** for custom policies and the default\n   policy.\n3. Check the values above for each policy that applies to users.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-AntiPhishPolicy | Format-List Name, PhishThresholdLevel, EnableTargetedUserProtection, TargetedUsersToProtect,\n     TargetedUserProtectionAction, EnableOrganizationDomainsProtection, EnableTargetedDomainsProtection, TargetedDomainsToProtect,\n     TargetedDomainProtectionAction, EnableMailboxIntelligence, EnableMailboxIntelligenceProtection, MailboxIntelligenceProtectionAction,\n     EnableSimilarUsersSafetyTips, EnableSimilarDomainsSafetyTips, EnableUnusualCharactersSafetyTips, EnableFirstContactSafetyTips,\n     EnableUnauthenticatedSender, EnableViaTag, EnableSpoofIntelligence, AuthenticationFailAction, ExcludedSenders, ExcludedDomains\n   ```\n5. Fail if a policy that applies to users misses one of the values, if the protected users or\n   partner domains lists are empty, or if trusted senders and domains contain undocumented\n   entries.\n"
    },
    "remediation": {
      "manual": "1. Prefer the preset: in **Preset security policies** > **Standard protection** (and **Strict**)\n   > **Manage protection settings** > **Impersonation protection**, add the protected users and\n   partner domains and confirm (Security Administrator).\n2. For a custom policy, in **Anti-phishing**, edit the policy: **Phishing threshold & protection**\n   with the threshold, user and domain protection, mailbox intelligence; **Actions** with\n   Quarantine for user and domain impersonation and every safety tip selected.\n3. PowerShell equivalent:\n   ```powershell\n   Set-AntiPhishPolicy -Identity \"<policy>\" -PhishThresholdLevel 3 -EnableTargetedUserProtection $true `\n     -TargetedUsersToProtect \"CEO;ceo@example.com\",\"CFO;cfo@example.com\" -TargetedUserProtectionAction Quarantine `\n     -EnableOrganizationDomainsProtection $true -EnableTargetedDomainsProtection $true -TargetedDomainsToProtect \"partner.example\" `\n     -TargetedDomainProtectionAction Quarantine -EnableMailboxIntelligence $true -EnableMailboxIntelligenceProtection $true `\n     -MailboxIntelligenceProtectionAction MoveToJmf -EnableSimilarUsersSafetyTips $true -EnableSimilarDomainsSafetyTips $true `\n     -EnableUnusualCharactersSafetyTips $true -EnableFirstContactSafetyTips $true -EnableUnauthenticatedSender $true -EnableViaTag $true\n   ```\n",
      "rollback": "Set the impersonation actions back to `NoAction` on the custom policy, or remove a protected entry\nthat causes false positives.\n"
    },
    "references": [
      {
        "title": "Configure anti-phishing policies in Microsoft Defender for Office 365",
        "url": "https://learn.microsoft.com/defender-office-365/anti-phishing-policies-mdo-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Anti-phishing policies in Microsoft 365",
        "url": "https://learn.microsoft.com/defender-office-365/anti-phishing-policies-about",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommended settings for EOP and Microsoft Defender for Office 365 security",
        "url": "https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-111 to 123, 180, 220 to 230, 241)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.2.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.2.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.2.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.2.4v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      },
      {
        "framework": "mitre-attack",
        "id": "T1656"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-003",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-017",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}