ORCA.180 - Anti-phishing policy exists and EnableSpoofIntelligence is true.
Overview
When the sender email address is spoofed, the message appears to originate from someone or somewhere other than the actual source. Anti-spoofing protection examines forgery of the 'From: header' which is the one that shows up in an email client like Outlook. It is recommended to enable anti-spoofing protection in Office 365 Anti-phishing policies.
Remediation action
Enable anti-spoofing protection in Anti-phishing policy.
Related Links
- Anti-spoofing protection in Office 365
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.180 |
| Severity | Medium |
| Suite | ORCA |
| Category | EXO |
| PowerShell test | Test-ORCA180 |
| Tags | EXO, ORCA, ORCA.180 |
Source
- Pester test:
tests/orca/Test-ORCA180.Tests.ps1 - PowerShell source:
powershell/public/orca/Test-ORCA180.ps1