No exclusions for the built-in protection policies
ORCA.239HighDefenderSafe Links
Part of ORCA · Defender · Safe Links · All checks
Invoke-Maester -TestId ORCA.239Overview
Section titled “Overview”Built-in protection policies provide catch-all protection against users not covered by higher order policies. Excluding users from the built-in protection policies may mean these users have reduced protections. It is important not to rely on the ‘built-in’ policies, as these policies only apply the minimum level of protections and should serve as a catch-all.
Remediation action
Section titled “Remediation action”Remove exclusions from the built-in protection policies.
Related Links
Section titled “Related Links”- Microsoft 365 Defender Portal - Safe links
- Recommended settings for EOP and Microsoft Defender for Office 365
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.239 |
| Severity | High |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Safe Links |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-ORCA239 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.239.ps1 - Documentation:
tests/orca/Test.ORCA.239.md