CIS.M365.2.1.15 - (L1) Ensure outbound anti-spam message limits are in place
Overview
The default outbound spam policy, and each custom outbound spam policy that an enabled outbound rule applies to, sets sensible recipient limits, restricts a user who reaches them, turns on outbound spam notifications and names a notification recipient.
A compromised mailbox is usually used to send phishing or spam to a large number of recipients. Recipient limits stop the burst early, and blocking the user, instead of only alerting, stops the abuse and protects your sending reputation.
The default value of 0 means that the service uses its own limits and is not accepted. Set values at or below 500 external recipients per hour, 1000 internal recipients per hour and 1000 recipients per day, and the action to Restrict the user from sending mail. The test checks every policy that users receive. A custom policy that no enabled rule applies to is not checked, because no user gets it. The test also checks that each of those policies turns on outbound spam notifications and names at least one notification recipient. It cannot tell whether that mailbox is monitored, so confirm that someone reads its messages. Microsoft recommends the alert policy User restricted from sending email for admin notifications, and this outbound policy setting is being deprecated.
Remediation action
- Sign in to the Microsoft Defender portal.
- Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open the Anti-spam outbound policy (Default).
- Select Edit protection settings.
- Set External message limit to 500 or less, Internal message limit to 1000 or less and Daily message limit to 1000 or less.
- Set Restriction placed on users who reach the message limit to Restrict the user from sending mail. In the Notifications section, turn on Notify these users and groups if a sender is blocked due to sending outbound spam, add a monitored mailbox, then select Save.
- Repeat steps 3 to 5 for each custom outbound policy that the test lists.
Related links
- Microsoft Defender portal - Anti-spam policies
- Configure outbound spam filtering in EOP
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.1.15
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.1.15 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1534 Internal Spearphishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.15 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:2.1.15, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisOutboundSpamLimit |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.2.1.15.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.1.15.md