(L1) Ensure internal phishing protection for Forms is enabled

Contributed by Benjamin Metz with -MynsterAll contributors →

Part of CIS · Microsoft 365 · Organization settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.1.3.5

Overview

1.3.5 (L1) Ensure internal phishing protection for Forms is enabled

Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.

Rationale

Enabling internal phishing protection for Microsoft Forms will prevent attackers using forms for phishing attacks by asking personal or other sensitive information and URLs.

Impact

If potential phishing was detected, the form will be temporarily blocked and cannot be distributed, and response collection will not happen until it is unblocked by the administrator or keywords were removed by the creator.

Remediation action

1. Navigate to Microsoft 365 admin center.
2. Click to expand Settings select Org settings.
3. In Services select Microsoft Forms
4. Enable Add internal phishing protection under Phishing protection
5. Click Save.

PowerShell

1. Connect to the Microsoft Graph service using Connect-MgGraph -Scopes "OrgSettings-AppsAndServices.ReadWrite.All".
2. Run the following Microsoft Graph PowerShell commands:

$uri = 'https://graph.microsoft.com/beta/admin/forms/settings'
$body = @{ "isInOrgFormsPhishingScanEnabled" = $true } | ConvertTo-Json
Invoke-MgGraphRequest -Method PATCH -Uri $uri -Body $body

Related links

• Microsoft 365 admin center
• Administrator settings for Microsoft Forms
• Review and unblock forms or users detected and blocked for potential phishing
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 63

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.1.3.5
Severity	Medium
Suite	CIS
Product	Microsoft 365
Feature	Organization settings
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1534 Internal Spearphishing, T1598 Phishing for Information
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.5
Benchmark level	L1
Benchmark profiles	E3 Level 1, E5 Level 1
Supports controls	cis-m365:1.3.5, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisFormsPhishingProtectionEnabled
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.1.3.5.ps1
• Documentation: tests/cis/Test.CIS.M365.1.3.5.md