CISA.MS.EXO.14.2 - Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
Overview
Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
Rationale: Spam is a constant threat as junk mail can reduce user productivity, fill up mailboxes unnecessarily, and in some cases include malicious links or attachments. Moving spam messages to a separate junk or quarantine folder helps users filter out spam while still giving them the ability to review messages, as needed, in case a message is filtered incorrectly.
Remediation action:
- Sign in to Microsoft 365 Defender.
- In the left-hand menu, go to Email & Collaboration > Policies & Rules.
- Select Threat Policies.
- From the Templated policies section, select Preset Security Policies.
- Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
- Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.
Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.
Related links
- Defender admin center - Preset security policies
- CISA 14 Inbound Anti-Spam Protections - MS.EXO.14.2
- CISA ScubaGear Rego Reference
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.14.2 |
| Severity | Medium |
| Suite | CISA |
| Category | exchange |
| PowerShell test | Test-MtCisaSpamAction |
| Tags | CISA, CISA.MS.EXO.14.2, MS.EXO, MS.EXO.14.2 |
Source
- Pester test:
tests/cisa/exchange/Test-MtCisaSpamAction.Tests.ps1 - PowerShell source:
powershell/public/cisa/exchange/Test-MtCisaSpamAction.ps1