(L1) Ensure Priority account protection is enabled and configured
Part of CIS · Defender · Tenant settings · All checks
Invoke-Maester -TestId CIS.M365.2.4.1Overview
Section titled “Overview”Priority account protection is turned on, priority accounts are defined, and alert policies notify people about malware and phishing sent to those accounts.
Executives, finance staff and IT administrators are targeted more often and the damage of a successful attack on them is higher. Priority account protection adds extra detection and reporting for them, and tags them in alerts and reports so that an incident response team notices them.
The test needs the protection to be on, at least one priority account, and an enabled alert for high severity inbound malware and one for high severity inbound phishing that apply to the Priority account tag and notify a user. Microsoft Defender for Office 365 Plan 2 licences are required.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Defender portal.
- Go to Settings > Email & collaboration > Priority account protection and turn on Priority account protection.
- Go to Settings > Email & collaboration > User tags, open Priority account and add the accounts to tag.
- Go to Email & collaboration > Policies & rules > Alert policy and create alerts for malware and phishing that use the Priority account user tag, a severity of High, the filter for inbound mail and a notification recipient.
Related links
Section titled “Related links”- Microsoft Defender portal - Priority account protection
- Configure and manage priority accounts
- Alert policies in the Microsoft Defender portal
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.4.1
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.4.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Tenant settings |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.1 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:2.4.1, nist-800-53-r5:SI-4(5) |
| PowerShell test | Test-MtCisPriorityAccountProtection |
| Services | ExchangeOnline, SecurityCompliance |
| Compatible licenses | THREAT_INTELLIGENCE |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.2.4.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.4.1.md