Defender

151 checks40 High83 Medium23 Low5 Info

Endpoint antivirus31Anti-spam23Anti-phishing19Exposure Management12Safe Links12Tenant settings12Safe Attachments8Defender for Identity7Anti-malware7Email authentication7Mail flow6Zero-hour auto purge6Quarantine1

Run theseInvoke-Maester -Product defenderCopy

151 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

CIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabledSafe AttachmentsHighCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0Anti-spamHighMT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.Exposure ManagementHighMT.1149Behavior Monitoring should be enabled.Endpoint antivirusHighMT.1150Cloud Protection should be enabled.Endpoint antivirusHighMT.1152Script Scanning should be enabled.Endpoint antivirusHighMT.1153Real-time Monitoring should be enabled.Endpoint antivirusHighMT.1165Network Protection should be enabled.Endpoint antivirusHighORCA.104High Confidence Phish action set to Quarantine message.Anti-spamHighORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.Anti-spamHighORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.Mail flowHighORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.Anti-spamHighORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.Mail flowHighORCA.124Safe attachments unknown malware response set to block messages.Safe AttachmentsHighORCA.189.2Safe Links is not bypassed.Mail flowHighORCA.239No exclusions for the built-in protection policies.Safe LinksHighORCA.242Important protection alerts responsible for AIR activities are enabled.Tenant settingsHighZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerZTADefender for IdentityHighZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversZTADefender for IdentityHighZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantZTADefender for IdentityHighZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedZTADefender for IdentityHighZTA.41029Anti-malware policies are configured according to recommended settingsZTAAnti-malwareHighZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockZTASafe AttachmentsHighZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsZTASafe LinksHighZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionZTAAnti-phishingHighZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailZTAZero-hour auto purgeHighZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessZTAAnti-spamHighZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTATenant settingsHighZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointZTAEndpoint antivirusHighZTA.41053Network protection is enabled in block modeZTAEndpoint antivirusHighZTA.41054Controlled folder access is enabled in block modeZTAEndpoint antivirusHighZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusZTAEndpoint antivirusHighZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusZTAEndpoint antivirusHighZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusZTAEndpoint antivirusHighZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedZTATenant settingsHighZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTATenant settingsHighZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsZTATenant settingsHighZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsZTASafe LinksHighZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedZTAEndpoint antivirusHighZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowZTATenant settingsHighCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)Safe LinksMediumCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)Anti-malwareMediumCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledAnti-malwareMediumCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledSafe AttachmentsMediumCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsAnti-spamMediumCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdAnti-phishingMediumCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0Email authenticationMediumCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsEmail authenticationMediumCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0Email authenticationMediumCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedAnti-malwareMediumCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)Anti-spamMediumCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)Anti-spamMediumCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0Anti-spamMediumCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0Tenant settingsMediumCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0Tenant settingsMediumCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)Zero-hour auto purgeMediumMT.1059Microsoft Defender for Identity health issues should be resolvedDefender for IdentityMediumMT.1077App registrations with privileged API permissions should not have owners.Exposure ManagementMediumMT.1078App registrations with highly privileged directory roles should not have owners.Exposure ManagementMediumMT.1079Privileged API permissions on service principals should not remain unused.Exposure ManagementMediumMT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.Exposure ManagementMediumMT.1081Hybrid users should not be assigned Entra ID role assignments.Exposure ManagementMediumMT.1088Devices with critical credentials should be protected by TPM.Exposure ManagementMediumMT.1089Devices with critical credentials should be protected by Credential Guard.Exposure ManagementMediumMT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreviewExposure ManagementMediumMT.1148Archive Scanning should be enabled.Endpoint antivirusMediumMT.1151Email Scanning should be enabled.Endpoint antivirusMediumMT.1154Full Scan Removable Drives should be enabled.Endpoint antivirusMediumMT.1156Scanning Network Files should be enabled.Endpoint antivirusMediumMT.1161Cloud Block Level should be High or higher.Endpoint antivirusMediumMT.1164PUA Protection should be enabled.Endpoint antivirusMediumMT.1166Local Admin Merge should be disabled.Endpoint antivirusMediumMT.1167Real-Time Scan Direction should cover both directions.Endpoint antivirusMediumMT.1171Sample Submission should send safe samples automatically.Endpoint antivirusMediumORCA.103Outbound spam filter policy settings configured.Anti-spamMediumORCA.105Safe Links Synchronous URL detonation is enabled.Safe LinksMediumORCA.108DKIM signing is set up for all your custom domains.Email authenticationMediumORCA.108.1DNS Records have been set up to support DKIM.Email authenticationMediumORCA.109Senders are not being allow listed in an unsafe manner.Anti-spamMediumORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.Anti-phishingMediumORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.Anti-phishingMediumORCA.113AllowClickThrough is disabled in Safe Links policies.Safe LinksMediumORCA.114No IP Allow Lists have been configured.Anti-spamMediumORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.Anti-phishingMediumORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.Anti-phishingMediumORCA.120.1Zero Hour Autopurge Enabled for Phish.Zero-hour auto purgeMediumORCA.120.2Zero Hour Autopurge Enabled for Malware.Zero-hour auto purgeMediumORCA.120.3Zero Hour Autopurge Enabled for Spam.Zero-hour auto purgeMediumORCA.121Supported filter policy action used.Zero-hour auto purgeMediumORCA.140High Confidence Spam action set to Quarantine message.Anti-spamMediumORCA.142Phish action set to Quarantine message.Anti-spamMediumORCA.156Safe Links Policies are tracking when user clicks on safe links.Safe LinksMediumORCA.158Safe Attachments is enabled for SharePoint and Teams.Safe AttachmentsMediumORCA.179Safe Links is enabled intra-organization.Safe LinksMediumORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.Anti-phishingMediumORCA.189Safe Attachments is not bypassed.Mail flowMediumORCA.205Common attachment type filter is enabled.Anti-malwareMediumORCA.220Advanced Phish filter Threshold level is adequate.Anti-phishingMediumORCA.221Mailbox intelligence is enabled in anti-phishing policies.Anti-phishingMediumORCA.222Domain Impersonation action is set to move to Quarantine.Anti-phishingMediumORCA.223User impersonation action is set to move to Quarantine.Anti-phishingMediumORCA.225Safe Documents is enabled for Office clients.Safe AttachmentsMediumORCA.226Each domain has a Safe Link policy applied to it.Safe LinksMediumORCA.227Each domain has a Safe Attachments policy applied to it.Safe AttachmentsMediumORCA.228No trusted senders in Anti-phishing policy.Anti-phishingMediumORCA.229No trusted domains in Anti-phishing policy.Anti-phishingMediumORCA.233Domains are pointed directly at EOP or enhanced filtering is used.Mail flowMediumORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.Mail flowMediumORCA.234Click through is disabled for Safe Documents.Safe AttachmentsMediumORCA.235SPF records is set up for all your custom domains.Email authenticationMediumORCA.236Safe Links is enabled for emails.Safe LinksMediumORCA.237Safe Links is enabled for teams messages.Safe LinksMediumORCA.238Safe Links is enabled for office documents.Safe LinksMediumORCA.240Outlook is configured to display external tags for external emails.Tenant settingsMediumORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.Anti-phishingMediumORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.Email authenticationMediumORCA.244Policies are configured to honor sending domains DMARC.Anti-phishingMediumZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageZTADefender for IdentityMediumZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedZTADefender for IdentityMediumZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsZTAAnti-spamMediumZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxZTATenant settingsMediumZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsZTATenant settingsMediumZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalZTATenant settingsMediumMT.1085Pending approvals for Critical Asset Management should not be present.Exposure ManagementLowMT.1086Devices should not share both critical and non-critical user credentials.Exposure ManagementLowMT.1111High privileged user should be linked to an identity.-IncludePreviewExposure ManagementLowMT.1155Full Scan Mapped Drives should be disabled for performance.Endpoint antivirusLowMT.1157CPU Load Factor should be optimized (20-30%).Endpoint antivirusLowMT.1158Scan should be scheduled.Endpoint antivirusLowMT.1160Signatures should be checked before scan.Endpoint antivirusLowMT.1162Cloud Extended Timeout should be 30-50 seconds.Endpoint antivirusLowMT.1163Signature Update Interval should be 1-4 hours.Endpoint antivirusLowMT.1168Cleaned Malware should be retained for at least 30 days.Endpoint antivirusLowMT.1169Catch-up Full Scan should be disabled.Endpoint antivirusLowMT.1170Catch-up Quick Scan should be disabled.Endpoint antivirusLowORCA.100Bulk Complaint Level threshold is between 4 and 6.Anti-spamLowORCA.101Bulk is marked as spam.Anti-spamLowORCA.102Advanced Spam filter options are turned off.Anti-spamLowORCA.106Quarantine retention period is 30 days.Anti-spamLowORCA.107End-user spam notification is enabled.QuarantineLowORCA.110Internal Sender notifications are disabled.Anti-malwareLowORCA.139Spam action set to move message to junk mail folder or quarantine.Anti-spamLowORCA.141Bulk action set to Move message to Junk Email Folder.Anti-spamLowORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.Anti-phishingLowORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.Anti-spamLowORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.Anti-malwareLowMT.1159Quick Scan Time configuration is not required.Endpoint antivirusInfoORCA.119Similar Domains Safety Tips is enabled.Anti-phishingInfoORCA.123Unusual Characters Safety Tips is enabled.Anti-phishingInfoORCA.143Safety Tips are enabled.Anti-spamInfoORCA.224Similar Users Safety Tips is enabled.Anti-phishingInfo