Apply the recommended inbound anti-spam actions with no allowed senders or domains

Description

Every inbound anti-spam policy that applies to users (the default policy, custom policies and the presets) has at least the Standard values:

• Spam: Move message to Junk Email folder or Quarantine message;
• High confidence spam, Phishing and High confidence phishing: Quarantine message, with AdminOnlyAccessPolicy for high confidence phishing;
• Bulk email threshold at {{ bulk_threshold }} or lower, bulk messages moved to Junk Email or quarantined, MarkAsSpamBulkMail On;
• Retain spam in quarantine for this many days: 30 (QuarantineRetentionPeriod);
• spam safety tips on (InlineSafetyTipsEnabled $true);
• Advanced Spam Filter (ASF) settings off, as Microsoft recommends;
• Allowed senders and Allowed domains empty (AllowedSenders, AllowedSenderDomains), and never one of the organization's own domains;
• quarantine policies with notifications for the quarantined verdicts users may release (DefaultFullAccessWithNotificationPolicy), so users learn about held messages.

Rationale

A phishing message in the Junk Email folder is still one click away from the user. Quarantine keeps it out of reach and admin-only quarantine prevents release of the most dangerous verdicts. Allowed senders and domains bypass spam filtering for any message that claims that address, including spoofed ones, and are one of the most common misconfigurations found in tenants.

Impact

More messages are quarantined; users receive quarantine notifications and can release spam and bulk themselves. Senders removed from the allow lists go through normal filtering; use the Tenant Allow/Block List for the rare confirmed false positives.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open every inbound policy (Anti-spam inbound policy (Default) and custom policies). Check Bulk email threshold & spam properties, Actions and Allow & block list against the values above.
3. In Exchange Online PowerShell (read-only):

   Get-HostedContentFilterPolicy | Format-List Name, SpamAction, HighConfidenceSpamAction, PhishSpamAction, HighConfidencePhishAction,
     HighConfidencePhishQuarantineTag, BulkSpamAction, BulkThreshold, MarkAsSpamBulkMail, QuarantineRetentionPeriod,
     InlineSafetyTipsEnabled, AllowedSenders, AllowedSenderDomains, IncreaseScoreWith*, MarkAsSpam*
   Get-HostedContentFilterRule | Format-Table Name, State, Priority
   

4. Fail if a policy that applies to users delivers phishing or high confidence spam outside quarantine, has a bulk threshold above {{ bulk_threshold }}, a retention below 30 days, safety tips off, or any allowed sender or domain.

Remediation

1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019), then align the default policy, which still applies to recipients outside the presets.
2. In the Defender portal, edit each inbound policy (Security Administrator): set the actions, bulk threshold, retention and safety tips above, and remove every allowed sender and domain (replace confirmed false positives with Tenant Allow/Block List entries).
3. PowerShell equivalent:

   Set-HostedContentFilterPolicy -Identity Default -SpamAction MoveToJmf -HighConfidenceSpamAction Quarantine `
     -PhishSpamAction Quarantine -HighConfidencePhishAction Quarantine -HighConfidencePhishQuarantineTag AdminOnlyAccessPolicy `
     -BulkSpamAction MoveToJmf -BulkThreshold 6 -MarkAsSpamBulkMail On -QuarantineRetentionPeriod 30 `
     -InlineSafetyTipsEnabled $true -AllowedSenders $null -AllowedSenderDomains $null `
     -HighConfidenceSpamQuarantineTag DefaultFullAccessWithNotificationPolicy -PhishQuarantineTag DefaultFullAccessWithNotificationPolicy
   

Rollback

Restore the previous values on the policy; keep the allow lists empty.

References

• Configure anti-spam policies in EOP Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• Quarantine policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-100 to 109, 118-1, 118-3, 139 to 143, 231) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-002 Do not bypass spam filtering for sender domains in mail flow rules
• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients
• related CB-M365-MAIL-024 Keep zero-hour auto purge on for malware, phishing and spam
• related CB-M365-MAIL-032 Keep the connection filter IP allow list empty and the safe list off

People and lifecycle