# If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. Source: https://maester.dev/docs/tests/CISA.MS.EXO.14.4

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Part of CISA · Exchange Online · Anti-spam · All checks

```powershell title="Run this check" Invoke-Maester -TestId CISA.MS.EXO.14.4 ``` ## Overview If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. Rationale: Spam is a constant threat as junk mail can reduce user productivity, fill up mailboxes unnecessarily, and in some cases include malicious links or attachments. Filtering out spam reduces user workload burden, prevents junk mail congestion, and reduces potentially malicious content exposure. #### Remediation action 1. Sign in to **Microsoft 365 Defender**. 2. In the left-hand menu, go to **Email & Collaboration** > **Policies & Rules**. 3. Select **Threat Policies**. 4. From the **Templated policies** section, select [**Preset Security Policies**](https://security.microsoft.com/presetSecurityPolicies). 5. Under **Standard protection**, slide the toggle switch to the right so the text next to the toggle reads **Standard protection is on**. 6. Under **Strict protection**, slide the toggle switch to the right so the text next to the toggle reads **Strict protection is on**. Note: If the toggle slider in step 5 is grayed out, click on **Manage protection settings** instead and configure the policy settings according to [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn](https://learn.microsoft.com/microsoft-365/security/office-365-security/preset-security-policies?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users). #### Related links * [Defender admin center - Preset security policies](https://security.microsoft.com/presetSecurityPolicies) * [CISA 14 Inbound Anti-Spam Protections - MS.EXO.14.4](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo144v1) * [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/EXOConfig.rego#L794) ## Details

Every attribute of this check

| Field | Value | | --- | --- | | Test ID | CISA.MS.EXO.14.4 | | Severity | Medium | | Suite | CISA | | Product | Exchange Online | | Related products | Defender | | Feature | Anti-spam | | Area | Email and collaboration protection | | Resource type | Tenant | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1566 Phishing | | Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.14.4 | | Criticality | SHOULD | | Supports controls | cisa-scuba:MS.EXO.14.4 | | PowerShell test | [Test-MtCisaSpamAlternative](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.14.4.ps1) | | Services | ExchangeOnline, Graph, SecurityCompliance |

## Source - Test: [`tests/cisa/exchange/Test.CISA.MS.EXO.14.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.14.4.ps1) - Documentation: [`tests/cisa/exchange/Test.CISA.MS.EXO.14.4.md`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.14.4.md)