Impersonation protection checks SHOULD be used

Contributed by Michael SouleAll contributors →

Part of CISA · Exchange Online · Anti-phishing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.11.1

Overview

Impersonation protection checks SHOULD be used.

Rationale: Users might not be able to reliably identify phishing emails, especially if the FROM address is nearly indistinguishable from that of a known entity. By automatically identifying senders who appear to be impersonating known senders, the risk of a successful phishing attempt can be reduced.

Remediation action

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
6. Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.

Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.

Related links

• Defender admin center - Preset security policies
• CISA 11 Phishing Protections - MS.EXO.11.1v1
• CISA ScubaGear Rego Reference
• Microsoft Learn - Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.11.1
Severity	High
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Anti-phishing
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing, T1684.001 Impersonation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.11.1
Criticality	SHOULD
Upstream requirement	Moved to MS.SECURITYSUITE.2.1v1 (was MS.EXO.11.1v1)
Supports controls	cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisaImpersonation
Services	ExchangeOnline, Graph
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.11.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.11.1.md