CIS.M365.2.4.2 - (L1) Ensure Priority accounts have 'Strict protection' presets applied
Overview
The Strict preset security policy applies its strongest protections to the recipients selected for Exchange Online Protection and Defender for Office 365.
Microsoft maintains the Standard and Strict preset security policies and updates them as threats change. Strict has the most aggressive settings for spam, phishing, malware, Safe Links and Safe Attachments, which suits the accounts that are most likely to be targeted and most valuable to compromise.
When enabled, a rule with no recipient conditions applies to everyone, including priority accounts. This test follows the CIS PowerShell audit procedure literally: it requires at least one explicit recipient condition on each enabled rule to pass. It does not verify that the selected recipients actually include priority accounts. To meet the audit criterion while targeting those accounts, add a group containing priority accounts to the rule's SentToMemberOf condition. Microsoft Defender for Office 365 licences are required.
Remediation action
- Sign in to the Microsoft Defender portal.
- Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies.
- Under Strict protection, select Manage protection settings.
- Apply the policy to Specific recipients and add a group containing priority accounts so each rule has a
SentToMemberOfcondition. - Finish the wizard and turn the policy on.
Related links
- Microsoft Defender portal - Preset security policies
- Preset security policies in EOP and Microsoft Defender for Office 365
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.4.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.4.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Tenant settings |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.2 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:2.4.2, nist-800-53-r5:SI-4(5) |
| PowerShell test | Test-MtCisStrictPresetForPriorityAccount |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/cis/Test.CIS.M365.2.4.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.4.2.md