Exchange Online
61 checks19 High34 Medium8 Low
Run these
Invoke-Maester -Product exchangeCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Mailbox auditingLogging and detectionHighLowLowT1685.002cis-m365:6.1.1, nist-800-53-r5:AU-12CISCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Mail flowExternal access and sharingHighMediumLowT1114.003cis-m365:6.2.1, nist-800-53-r5:AC-4CISCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Client accessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:6.5.4, nist-800-53-r5:CM-7CISCISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Mail flowEmail and collaboration protectionHighMediumLowT1114.003, T1048 +1cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Email authenticationEmail and collaboration protectionHighMediumHighT1566, T1598 +1cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Client accessAuthenticationHighMediumMedium—cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.EXO.8.1A DLP solution SHALL be used.Data loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.1, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Data loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.4, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.1Emails SHALL be scanned for malware.Anti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.10.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Anti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Mailbox auditingLogging and detectionHighLowLowT1070.008, T1098.002 +3cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12cCISA SCuBACISA.MS.EXO.14.1A spam filter SHALL be enabled.Anti-spamEmail and collaboration protectionHighLowLowT1566cisa-scuba:MS.EXO.14.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Safe LinksEmail and collaboration protectionHighLowLowT1204.001, T1566.002cisa-scuba:MS.EXO.15.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.16.1Alerts SHALL be enabled.Alert policiesLogging and detectionHighLowLowT1114.003, T1204.001cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Audit loggingLogging and detectionHighLowLowT1685.002cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12CISA SCuBACIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Mailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.2, nist-800-53-r5:AU-12CISCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Mailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.3, nist-800-53-r5:AU-12CISCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Mail flowEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:6.2.2, nist-800-53-r5:SI-8CISCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0OutlookEmail and collaboration protectionMediumLowLowT1566cis-m365:6.2.3, nist-800-53-r5:SI-8CISCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0OutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002cis-m365:6.3.1, nist-800-53-r5:CM-7CISCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webOutlookExternal access and sharingMediumLowLowT1567.002, T1204.002cis-m365:6.5.3, nist-800-53-r5:AC-20 +1CISCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Mail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002cis-m365:6.5.5, nist-800-53-r5:SI-8CISCISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Email authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.2.2, nist-800-53-r5:AC-2dCISA SCuBACISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Email authenticationEmail and collaboration protectionMediumLowMediumT1566, T1598 +1cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8CISA SCuBACISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Email authenticationEmail and collaboration protectionMediumLowLowT1566, T1598 +1cisa-scuba:MS.EXO.4.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Email authenticationEmail and collaboration protectionMediumLowLowT1684.002cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Calendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Calendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567 +1cisa-scuba:MS.EXO.6.2, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.7.1External sender warnings SHALL be implemented.Mail flowEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Data loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.2, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Data loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.3CISA SCuBACISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Anti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Anti-malwareEmail and collaboration protectionMediumLowLowT1036.008, T1204.002 +1cisa-scuba:MS.EXO.9.2CISA SCuBACISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Anti-malwareEmail and collaboration protectionMediumLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.4CISA SCuBACISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Anti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.2, nist-800-53-r5:AT-2b +1CISA SCuBACISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Anti-phishingEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.11.3CISA SCuBACISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Anti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Anti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cisa-scuba:MS.EXO.12.2, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Anti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Anti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.14.3, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Anti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.4CISA SCuBACISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Safe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.15.3User click tracking SHOULD be enabled.Safe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3 +1CISA SCuBACISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Alert policiesLogging and detectionMediumLowMedium—cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Audit loggingLogging and detectionMediumLowLowT1070cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11CISA SCuBAMT.1041Ensure users installing Outlook add-ins is not allowedOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002nist-800-53-r5:CM-7, nist-800-53-r5:CM-11MaesterMT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsMail flowEmail and collaboration protectionMediumLowMediumT1566nist-800-53-r5:SI-8MaesterMT.1062Ensure Direct Send is set to be rejectedMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002nist-800-53-r5:CM-7MaesterZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAMail flowData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0OutlookExternal access and sharingLowLowLowT1566cis-m365:6.3.2, nist-800-53-r5:AC-20CISCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Client accessAuthenticationLowLowLow—cis-m365:6.5.1, nist-800-53-r5:IA-2CISCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0OutlookEmail and collaboration protectionLowLowLow—cis-m365:6.5.2, nist-800-53-r5:AC-4CISMT.1039Ensure MailTips are enabled for end usersOutlookEmail and collaboration protectionLowLowLow——MaesterMT.1044Ensure modern authentication for Exchange Online is enabledClient accessAuthenticationLowLowLowT1110—MaesterMT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainMailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1076MOERA SHOULD NOT be used for sent mailMailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1083Ensure Delicensing Resiliency is enabledMailboxesInfrastructure hardeningLowLowLow——Maester
No checks match.