Recommended EOP and Defender for Office 365 settings

1. Enforced by defaultafter 1 Dec 2023 Published timing is qualified; effectiveness is not confirmed.

1. 1 Dec 2023 2 years agoafterEnforced by default · unconfirmed
   • Enable the common attachments filter (EnableFileFilter)in Anti-malware policy settingsMilestone
     EnableFileFilter

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• EnableFileFilter1 Dec 2023
• ActionWhenThresholdReached
• AuthenticationFailAction
• AutoForwardingMode
• BccSuspiciousOutboundAdditionalRecipients
• BccSuspiciousOutboundMail
• BlockUserForToday
• BulkQuarantineTag
• DefaultFullAccessPolicy
• DefaultFullAccessWithNotificationPolicy
• DmarcQuarantineAction
• DmarcRejectAction

Requirements, exceptions and scope

• GuidanceRecommendation2 conditions6 passages
  Get-ORCAReport

  We recommend two security levels: Standard and Strict. Although customer environments and needs are different, these levels of filtering help keep unwanted email out of…

• Built-in security features for all cloud mailboxesRecommendation1 passage
• Anti-malware policy settingsException4 conditions3 passages
• Anti-spam policy settingsException7 conditions6 passages
  MarkAsSpamBulkMailSpamQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicyHighConfidenceSpamQuarantineTagPhishQuarantineTagHighConfidencePhishActionBulkQuarantineTag
• ASF settings in anti-spam policiesRecommendation16 passages
  IncreaseScoreWithImageLinksIncreaseScoreWithNumericIpsIncreaseScoreWithRedirectToOtherPortIncreaseScoreWithBizOrInfoUrlsMarkAsSpamEmptyMessagesMarkAsSpamEmbedTagsInHtmlMarkAsSpamJavaScriptInHtmlMarkAsSpamFormTagsInHtml
• Outbound spam policy settingsExceptionRecommendation3 conditions8 passages
  RecipientLimitExternalPerHourRecipientLimitInternalPerHourRecipientLimitPerDayActionWhenThresholdReachedBlockUserForTodayAutoForwardingModeBccSuspiciousOutboundMailBccSuspiciousOutboundAdditionalRecipients
• Anti-phishing policy settings for all cloud mailboxesExceptionScope7 conditions4 passages
  DmarcQuarantineActionDmarcRejectActionAuthenticationFailActionMoveToJmfSpoofQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicy
• Microsoft Defender for Office 365 securityRecommendation1 passage
• Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365ExceptionRecommendation3 conditions6 passages
  EnableTargetedUserProtectionTargetedUsersToProtectEnableTargetedDomainsProtectionTargetedDomainsToProtectTargetedUserQuarantineTagDefaultFullAccessPolicyDefaultFullAccessWithNotificationPolicyTargetedDomainQuarantineTag
• Global settings for Safe AttachmentsExceptionRecommendation1 condition2 passages
  EnableSafeDocs
• Safe Attachments policy settingsException6 conditions5 passages
  QuarantineTagForBlockingEncryptedAttachmentsDefaultFullAccessWithNotificationPolicy
• Safe Links policy settingsException1 condition2 passages
  EnableForInternalSenders
• Microsoft Teams protection settings in Microsoft Defender for Office 365Recommendation1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.