Recommended EOP and Defender for Office 365 settings

Timelines and exceptions · All guidance changes

Defender · Official Microsoft guidanceObserved changes retained

Retained observation

Source metadata changed; retained article content is unchanged.

Documentation metadata only

Read the current Microsoft source · Link to this observation · Compare any two versions

Observation details · observed 24 Oct 00:41 UTC

Observed by ChangeIntel: 24 Oct 00:41 UTC
Source update metadata: 10 Aug 22:36 UTC
First observed on this installation: 8 Oct 23:13 UTC
Last successful check: today 00:51 UTC
Next check due: 27 Oct 00:51 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

Watch this page to review its changes in My radar.

Timeline

From the capture of 24 Oct 00:41 UTC

Published timing needs confirmation 1 Dec 2023 most recent · 2 years ago

1 date
13 undated sections
26 with conditions

Enforced by defaultafter 1 Dec 2023 Published timing is qualified; effectiveness is not confirmed.

1 Dec 2023 2 years agoafterEnforced by default · unconfirmed
- Enable the common attachments filter (EnableFileFilter)in Anti-malware policy settingsMilestone
  EnableFileFilter

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

EnableFileFilter1 Dec 2023
ActionWhenThresholdReached
AuthenticationFailAction
AutoForwardingMode
BccSuspiciousOutboundAdditionalRecipients
BccSuspiciousOutboundMail
BlockUserForToday
BulkQuarantineTag
DefaultFullAccessPolicy
DefaultFullAccessWithNotificationPolicy
DmarcQuarantineAction
DmarcRejectAction

Requirements, exceptions and scope

GuidanceRecommendation2 conditions6 passages
Get-ORCAReport
We recommend two security levels: Standard and Strict. Although customer environments and needs are different, these levels of filtering help keep unwanted email out of…
Built-in security features for all cloud mailboxesRecommendation1 passage
Anti-malware policy settingsException4 conditions3 passages
Anti-spam policy settingsException7 conditions6 passages
MarkAsSpamBulkMailSpamQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicyHighConfidenceSpamQuarantineTagPhishQuarantineTagHighConfidencePhishActionBulkQuarantineTag
ASF settings in anti-spam policiesRecommendation16 passages
IncreaseScoreWithImageLinksIncreaseScoreWithNumericIpsIncreaseScoreWithRedirectToOtherPortIncreaseScoreWithBizOrInfoUrlsMarkAsSpamEmptyMessagesMarkAsSpamEmbedTagsInHtmlMarkAsSpamJavaScriptInHtmlMarkAsSpamFormTagsInHtml
Outbound spam policy settingsExceptionRecommendation3 conditions8 passages
RecipientLimitExternalPerHourRecipientLimitInternalPerHourRecipientLimitPerDayActionWhenThresholdReachedBlockUserForTodayAutoForwardingModeBccSuspiciousOutboundMailBccSuspiciousOutboundAdditionalRecipients
Anti-phishing policy settings for all cloud mailboxesExceptionScope7 conditions4 passages
DmarcQuarantineActionDmarcRejectActionAuthenticationFailActionMoveToJmfSpoofQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicy
Microsoft Defender for Office 365 securityRecommendation1 passage
Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365ExceptionRecommendation3 conditions6 passages
EnableTargetedUserProtectionTargetedUsersToProtectEnableTargetedDomainsProtectionTargetedDomainsToProtectTargetedUserQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicyTargetedDomainQuarantineTag
Global settings for Safe AttachmentsExceptionRecommendation1 condition2 passages
EnableSafeDocs
Safe Attachments policy settingsException6 conditions5 passages
QuarantineTagForBlockingEncryptedAttachmentsDefaultFullAccessWithNotificationPolicy
Safe Links policy settingsException1 condition2 passages
EnableForInternalSenders
Microsoft Teams protection settings in Microsoft Defender for Office 365Recommendation1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured 24 Oct 00:41 UTC; extracted 24 Oct 00:41 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.

Review priority. Extracted assertions require review · Applicability or exceptions require review

0 date changes and 0 condition changes across 1 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 3

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

24 Oct 00:41 UTC · 63 candidates
12 Oct 23:53 UTC · 63 candidates
8 Oct 23:13 UTC · 29 candidates

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Retained observations

24 Oct 00:41 UTC · shown above
12 Oct 23:53 UTC
1 removed passage (about 20 words). No rule matched the changed words; review the source for its effect.
8 Oct 23:13 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.