Anti-phishing policy exists and EnableUnauthenticatedSender is true

Contributed by Michael SouleAll contributors →

Part of ORCA · Defender · Anti-phishing · All checks

Run this check

Invoke-Maester -TestId ORCA.111

Overview

When the sender email address is spoofed, the message appears to originate from someone or somewhere other than the actual source. It is recommended to enable unauthenticated sender tagging in Office 365 Anti-phishing policies. The feature apply a ’?’ symbol in Outlook’s sender card if the sender fails authentication checks.

Remediation action

Enable unauthenticated sender tagging in Anti-phishing policy.

Related Links

• Microsoft 365 Defender Portal - Anti-phishing
• Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security
• Unverified Sender

Details

Every attribute of this check

Field	Value
Test ID	ORCA.111
Severity	Medium
Suite	ORCA
Product	Defender
Related products	Exchange Online
Feature	Anti-phishing
Area	Email and collaboration protection
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing, T1684.002 Email Spoofing
Supports controls	nist-800-53-r5:SI-8
PowerShell test	Test-ORCA111
Services	ExchangeOnline
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/orca/Test.ORCA.111.ps1
• Documentation: tests/orca/Test.ORCA.111.md