(L1) Ensure inbound anti-spam policies do not contain allowed domains

Contributed by jeremy finneyAll contributors →

Part of CIS · Defender · Anti-spam · All checks

Run this check

Invoke-Maester -TestId CIS.M365.2.1.14

Overview

No inbound anti-spam policy in Microsoft Defender for Office 365 lists allowed sender domains.

A domain on the allowed list bypasses spam and phishing filtering. Attackers know that and spoof, or compromise, the domains that organisations trust most, such as partners and suppliers. A single allowed domain turns into a path past the filters.

Use tenant allow/block list entries with an expiry, or fix the root cause of the false positive, instead of allowing a whole domain.

Remediation action

1. Sign in to the Microsoft Defender portal.
2. Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam.
3. Open each inbound anti-spam policy and select Edit allowed and blocked senders and domains.
4. Remove every entry under Allow domains and select Save.

Related links

• Microsoft Defender portal - Anti-spam policies
• Configure anti-spam policies in Microsoft Defender for Office 365
• Create safe sender lists in Microsoft Defender for Office 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.1.14

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.1.14
Severity	High
Suite	CIS
Product	Defender
Feature	Anti-spam
Area	Email and collaboration protection
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing, T1684.002 Email Spoofing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.14
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:2.1.14, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisAntiSpamAllowedDomain
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.2.1.14.ps1
• Documentation: tests/cis/Test.CIS.M365.2.1.14.md