What this check looks at
Checks the Exchange Online settings Microsoft Secure Score tracks, such as modern authentication, external storage in Outlook on the web and calendar sharing, using Secure Score’s own assessment of each. Mailbox auditing has its own check (NL-THR-008).
Microsoft Secure Score includes a set of Exchange Online improvement actions (control names starting exo_) covering how mailboxes and mail clients are configured: modern authentication for Outlook, external calendar sharing, third-party storage in Outlook on the web, MailTips, Outlook add-ins and mail flow rules that allow-list domains, among others. Most are defaults Microsoft leaves open for compatibility, and each widens what an attacker, or a careless user, can do with a mailbox.
This check takes Secure Score’s own assessment of each of those controls, except mailbox auditing, which has its own check (NL-THR-008). Where the assessment read the same setting directly from Exchange Online, that reading decides; otherwise a control counts as in place when Secure Score awards all of its points. The check passes when every control is in place, fails when more than half are missing and warns otherwise. The evidence lists up to 25 controls not in place.
Individually these settings look minor. Together they decide whether a compromised mailbox can share calendars outside, attach files from personal storage, install an add-in that reads every message or receive mail that skips spam filtering, and whether people get any warning before mailing the wrong person.
Why it matters
These settings decide what an attacker can do with a mailbox once inside, and whether anyone can reconstruct what happened afterwards. Mailbox auditing in particular is what an investigation, and often an insurer, will ask for first.
In a typical business email compromise, the attacker’s first hour in a mailbox is spent learning who pays whom. External calendar sharing shows when the finance director is on holiday; an Outlook add-in keeps access after a password change; a mail flow rule allow-listing a supplier’s domain lets a spoofed invoice straight into the inbox. Closing these settings does not stop the first phish, but it limits what comes next.
Most of these changes take minutes and change little for users. Leaving them open costs nothing until an incident, when it shows up as a longer investigation and a harder conversation with the insurer about why recommended settings were not in place.
ISO 27001 A.8.9 (configuration management), CIS Controls v8 4.1 (secure configuration process), NIST CSF 2.0 PR.PS-01 and NCSC CAF B4.b (secure configuration) all ask for a defined, maintained secure configuration. For Exchange Online, section 6 of the CIS Microsoft 365 Foundations Benchmark sets out the same settings in detail.
How to fix it
Where: Microsoft Defender portal → Exposure management → Secure Score → Recommended actions
Before you start
- Open each listed Secure Score action for its exact setting and user impact.
Step by step
- Open the Exchange Online actions in Secure Score. In the Microsoft Defender portal, go to Exposure management > Secure Score and select Recommended actions. Filter by the product Exchange Online and Status To address, and compare the list with the controls in this finding’s evidence.
- Read each action’s implementation and impact. Open each action and read the Implementation tab for the exact setting and the user impact. Most map to one cmdlet in Exchange Online PowerShell, and each has its own check in this assessment with full steps: modern authentication, MailTips, calendar sharing, third-party storage, Outlook add-ins and mail flow rules.
- Connect to Exchange Online PowerShell. Install the module if needed (Install-Module ExchangeOnlineManagement) and run Connect-ExchangeOnline -UserPrincipalName admin@contoso.com with an account holding the Exchange Administrator role.
- Apply the settings users will not notice. Run only the ones listed as missing: Set-OrganizationConfig -OAuth2ClientProfileEnabled $true (modern authentication); Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25 (MailTips); Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersAvailable $false (third-party storage).
- Agree the changes users will notice. Turning off external calendar sharing (Set-SharingPolicy -Identity "Default Sharing Policy" -Enabled $false), removing the Outlook add-in roles and disabling mail flow rules that skip spam filtering can change how people work. Check with the client who relies on them, then make each change following its own finding.
- Record any action handled another way. If a control is genuinely met by another product, open it in Secure Score, select Edit status & action plan and choose Resolved through third party with a note, which awards the points. Risk accepted records the decision but awards no points, so the action stays listed in this finding.
- Confirm after Secure Score updates. Secure Score updates about once a day. After 24 to 48 hours check the actions show Completed and run the next assessment: the check passes when every Exchange Online control is in place, and warns while no more than half are missing.
What users will notice
Depends on the action; most are invisible to users.
How to confirm it worked
The listed actions show "Completed" in Secure Score, Recommended actions.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Zero Trust | Applications |
| SOC 2 | CC7.1 Detecting configuration changes and vulnerabilities |
| PCI DSS 4.0.1 | 2.2.1 Configuration standards are developed, implemented and maintained |
| NIST SP 800-171 | 3.4.2 Establish and enforce security configuration settings |
| CMMC Level 2 | CM.L2-3.4.2 Security Configuration Enforcement |
| ISO 27001:2022 | A.8.9 Configuration management |
| CIS Controls v8.1 | 8.2 Collect audit logs (IG1)4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and appliedPR.PS-04: Log records are generated and made available for continuous monitoring |
| NCSC 10 Steps | Architecture and configurationLogging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Microsoft Secure Score (Microsoft Learn)