Contributed by Ben Miles with 2 co-contributorsAll contributors →
Part of CIS · Defender · Anti-malware · All checks
```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.2.1.3 ``` ## Overview 2.1.3 (L1) Ensure notifications for internal users sending malware is Enabled Exchange Online Protection (EOP) is Microsoft's cloud-based filtering service that protects organizations against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes. EOP uses flexible anti-malware policies for malware protection settings. These policies can be set to notify Admins of malicious activity. The check evaluates the policy associated with the highest-priority enabled custom anti-malware rule when one exists; otherwise it evaluates the Default policy. The administrator notification address must be nonblank. #### Rationale This setting alerts administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. #### Impact Notification of account with potential issues should not have an impact on the user #### Remediation action To enable notifications for internal users sending malware: 1. Navigate to Microsoft 365 Defender [https://security.microsoft.com](https://security.microsoft.com). 2. Click to expand **E-mail & Collaboration** select **Policies & rules**. 3. On the Policies & rules page select **Threat policies**. 4. Under Policies select **Anti-malware**. 5. Click on the **Default (Default)** policy, unless the check identifies a higher-priority enabled custom policy. 6. Click on **Edit protection settings** and change the settings for **Notify an admin about undelivered messages from internal senders** to **On** and enter the email address of the administrator who should be notified under **Administrator email address**. 7. Click Save. ##### PowerShell 1. Connect to Exchange Online using `Connect-ExchangeOnline`. 2. Run the following command: ```powershell Set-MalwareFilterPolicy -Identity '{Identity Name}' -EnableInternalSenderAdminNotifications $True -InternalSenderAdminAddress {admin@domain1.com} ``` >Note: If the check identifies a custom policy, use that policy's identity in the PowerShell command and configure its notification address. #### Related links * [Microsoft 365 Defender](https://security.microsoft.com) * [Anti-malware protection for cloud mailboxes](https://learn.microsoft.com/defender-office-365/anti-malware-protection-about) * [Configure anti-malware policies for cloud mailboxes](https://learn.microsoft.com/defender-office-365/anti-malware-policies-configure) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 88](https://www.cisecurity.org/benchmark/microsoft_365) ## Details