{
  "id": "CB-M365-MAIL-030",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-030",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-030.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-030.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-030",
    "title": "Apply the recommended inbound anti-spam actions with no allowed senders or domains",
    "finding": {
      "title": "Inbound anti-spam policies deliver phishing or allow-list senders and domains",
      "description": "Phishing and high confidence spam can reach the Junk Email folder or the inbox, and allow-listed senders skip filtering even when spoofed."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online-protection",
      "anti-spam",
      "quarantine",
      "allow-list",
      "bulk-mail"
    ],
    "description": "Every inbound anti-spam policy that applies to users (the default policy, custom policies and the\npresets) has at least the Standard values:\n\n- **Spam**: **Move message to Junk Email folder** or **Quarantine message**;\n- **High confidence spam**, **Phishing** and **High confidence phishing**: **Quarantine message**,\n  with **AdminOnlyAccessPolicy** for high confidence phishing;\n- **Bulk email threshold** at {{ bulk_threshold }} or lower, bulk messages moved to Junk Email or\n  quarantined, `MarkAsSpamBulkMail On`;\n- **Retain spam in quarantine for this many days**: 30 (`QuarantineRetentionPeriod`);\n- spam safety tips on (`InlineSafetyTipsEnabled $true`);\n- Advanced Spam Filter (ASF) settings off, as Microsoft recommends;\n- **Allowed senders** and **Allowed domains** empty (`AllowedSenders`, `AllowedSenderDomains`),\n  and never one of the organization's own domains;\n- quarantine policies with notifications for the quarantined verdicts users may release\n  (**DefaultFullAccessWithNotificationPolicy**), so users learn about held messages.\n",
    "rationale": "A phishing message in the Junk Email folder is still one click away from the user. Quarantine\nkeeps it out of reach and admin-only quarantine prevents release of the most dangerous verdicts.\nAllowed senders and domains bypass spam filtering for any message that claims that address,\nincluding spoofed ones, and are one of the most common misconfigurations found in tenants.\n",
    "impact": "More messages are quarantined; users receive quarantine notifications and can release spam and\nbulk themselves. Senders removed from the allow lists go through normal filtering; use the Tenant\nAllow/Block List for the rare confirmed false positives.\n",
    "parameters": [
      {
        "name": "bulk_threshold",
        "type": "integer",
        "description": "Highest bulk complaint level (BCL) threshold allowed; lower is stricter.",
        "default": 6,
        "minimum": 1,
        "maximum": 9
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** >\n   **Anti-spam** and open every inbound policy (**Anti-spam inbound policy (Default)** and custom\n   policies). Check **Bulk email threshold & spam properties**, **Actions** and **Allow & block\n   list** against the values above.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-HostedContentFilterPolicy | Format-List Name, SpamAction, HighConfidenceSpamAction, PhishSpamAction, HighConfidencePhishAction,\n     HighConfidencePhishQuarantineTag, BulkSpamAction, BulkThreshold, MarkAsSpamBulkMail, QuarantineRetentionPeriod,\n     InlineSafetyTipsEnabled, AllowedSenders, AllowedSenderDomains, IncreaseScoreWith*, MarkAsSpam*\n   Get-HostedContentFilterRule | Format-Table Name, State, Priority\n   ```\n4. Fail if a policy that applies to users delivers phishing or high confidence spam outside\n   quarantine, has a bulk threshold above {{ bulk_threshold }}, a retention below 30 days, safety\n   tips off, or any allowed sender or domain.\n"
    },
    "remediation": {
      "manual": "1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019), then align\n   the default policy, which still applies to recipients outside the presets.\n2. In the Defender portal, edit each inbound policy (Security Administrator): set the actions,\n   bulk threshold, retention and safety tips above, and remove every allowed sender and domain\n   (replace confirmed false positives with Tenant Allow/Block List entries).\n3. PowerShell equivalent:\n   ```powershell\n   Set-HostedContentFilterPolicy -Identity Default -SpamAction MoveToJmf -HighConfidenceSpamAction Quarantine `\n     -PhishSpamAction Quarantine -HighConfidencePhishAction Quarantine -HighConfidencePhishQuarantineTag AdminOnlyAccessPolicy `\n     -BulkSpamAction MoveToJmf -BulkThreshold 6 -MarkAsSpamBulkMail On -QuarantineRetentionPeriod 30 `\n     -InlineSafetyTipsEnabled $true -AllowedSenders $null -AllowedSenderDomains $null `\n     -HighConfidenceSpamQuarantineTag DefaultFullAccessWithNotificationPolicy -PhishQuarantineTag DefaultFullAccessWithNotificationPolicy\n   ```\n",
      "rollback": "Restore the previous values on the policy; keep the allow lists empty.\n"
    },
    "references": [
      {
        "title": "Configure anti-spam policies in EOP",
        "url": "https://learn.microsoft.com/defender-office-365/anti-spam-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommended settings for EOP and Microsoft Defender for Office 365 security",
        "url": "https://learn.microsoft.com/defender-office-365/recommended-settings-for-eop-and-office365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Quarantine policies",
        "url": "https://learn.microsoft.com/defender-office-365/quarantine-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-100 to 109, 118-1, 118-3, 139 to 143, 231)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.6.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.6.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-002",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-019",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-024",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-032",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}