(L1) Ensure Priority accounts have 'Strict protection' presets applied

Contributed by jeremy finneyAll contributors →

Part of CIS · Defender · Tenant settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.2.4.2

Overview

The Strict preset security policy applies its strongest protections to the recipients selected for Exchange Online Protection and Defender for Office 365.

Microsoft maintains the Standard and Strict preset security policies and updates them as threats change. Strict has the most aggressive settings for spam, phishing, malware, Safe Links and Safe Attachments, which suits the accounts that are most likely to be targeted and most valuable to compromise.

When enabled, a rule with no recipient conditions applies to everyone, including priority accounts. This test follows the CIS PowerShell audit procedure literally: it requires at least one explicit recipient condition on each enabled rule to pass. It does not verify that the selected recipients actually include priority accounts. To meet the audit criterion while targeting those accounts, add a group containing priority accounts to the rule’s SentToMemberOf condition. Microsoft Defender for Office 365 licences are required.

Remediation action

1. Sign in to the Microsoft Defender portal.
2. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies.
3. Under Strict protection, select Manage protection settings.
4. Apply the policy to Specific recipients and add a group containing priority accounts so each rule has a SentToMemberOf condition.
5. Finish the wizard and turn the policy on.

Related links

• Microsoft Defender portal - Preset security policies
• Preset security policies in EOP and Microsoft Defender for Office 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.4.2

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.2.4.2
Severity	Medium
Suite	CIS
Product	Defender
Feature	Tenant settings
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.4.2
Benchmark level	L1
Benchmark profiles	E5 Level 1
Supports controls	cis-m365:2.4.2, nist-800-53-r5:SI-4(5)
PowerShell test	Test-MtCisStrictPresetForPriorityAccount
Services	ExchangeOnline
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cis/Test.CIS.M365.2.4.2.ps1
• Documentation: tests/cis/Test.CIS.M365.2.4.2.md