What this check looks at
Checks that the standard and strict preset security policies are both on, and that everyone is in one of them for Exchange Online Protection and, where licensed, Defender for Office 365.
Preset security policies are Microsoft’s ready-made bundles of anti-spam, anti-malware and anti-phishing settings, plus Safe Links and Safe Attachments where Defender for Office 365 is licensed, at two levels: Standard and Strict. Microsoft maintains the settings and updates them as threats change, which never happens to custom policies. Both are off until someone turns them on and chooses who they apply to.
The check reads the preset policy rules. It fails when the Standard preset is off, when the Strict preset is off, when no preset applies to all recipients for Exchange Online Protection, or, where Defender for Office 365 is licensed, when no preset applies to all recipients for Defender for Office 365. It passes when both presets are on and at least one covers everyone for each. It reports not checked when the tenant has Defender for Office 365 but its preset policies could not be read.
Custom policies drift: settings chosen years ago, exceptions for one supplier that became permanent, new protections Microsoft added that nobody switched on. A tenant where everyone sits in a preset gets Microsoft’s current recommended filtering without anyone having to keep up with it.
Why it matters
Preset policies apply Microsoft’s recommended filtering and keep it current as Microsoft improves it. Custom policies drift; having everyone in a preset means nobody is left on weaker settings someone forgot.
An MSP looking after 30 clients cannot keep 30 sets of custom anti-phishing, anti-spam and Safe Links policies in line with Microsoft’s recommendations. When Microsoft adds a protection or tightens a threshold, the preset policies pick it up automatically. Without them, one client’s outdated custom policy is the gap a phishing campaign gets through.
The cost is low: people in the Standard preset see a little more mail in quarantine and the occasional notification. The benefit is consistent protection for everyone, including new starters, who are covered the moment their mailbox exists.
CISA SCuBA MS.DEFENDER.1.1, 1.2 and 1.3 ask for the Standard and Strict presets to be enabled and for every user to be in one of them for Exchange Online Protection and for Defender for Office 365. ISO 27001 A.8.7 and A.8.9, CIS Controls v8 9.7, NIST CSF 2.0 PR.PS-01 and NCSC CAF B4.b cover the same need, and the Cyber Essentials Plus malware protection test checks how email is filtered.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Preset security policies
Before you start
- Check the custom anti-spam, anti-phishing and anti-malware policies: preset policies take priority over them for the people they cover.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Review the custom policies first. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies and look through the custom anti-spam, anti-phishing, anti-malware, Safe Links and Safe Attachments policies. Presets take priority over them for the people they cover, so note any deliberate exception (an allowed sender, a mailbox excluded from scanning) that will need handling another way.
- Apply the Standard preset to all recipients. Select Preset security policies, then under Standard protection select Manage protection settings. On Apply Exchange Online Protection choose All recipients, and on Apply Defender for Office 365 protection (where licensed) choose All recipients. Add exclusions only with a documented reason.
- Fill in impersonation protection. On the impersonation pages add the senior people to protect as users and the key partner domains. A separate check covers these entries in detail; they can be completed later without reopening this check.
- Turn the Standard preset on. On the Policy mode page choose Turn on the policy when finished, review the summary and select Confirm. The Preset security policies page should now show Standard protection as on.
- Turn on Strict for the most targeted people. Under Strict protection select Manage protection settings and apply it to Specific recipients: the priority accounts (directors, finance, HR, IT administrators). On the Defender for Office 365 page choose Previously selected recipients, add the impersonation entries, turn it on and select Confirm. Both presets must be on for the check to pass.
- Tell users about quarantine. Let people know that more suspicious mail will now be held in quarantine, what the quarantine notification looks like and how to request a release, and make sure someone reviews release requests in Email & collaboration > Review > Quarantine.
- Confirm both presets are on. In Exchange Online PowerShell run Get-EOPProtectionPolicyRule | Format-Table Name, State, SentTo, SentToMemberOf, RecipientDomainIs and Get-ATPProtectionPolicyRule | Format-Table Name, State, SentTo, SentToMemberOf, RecipientDomainIs. The Standard and Strict rules should both be Enabled, and the Standard rules should have no recipient conditions. The next assessment passes.
What users will notice
Everyone gets Microsoft’s recommended filtering; strict-policy users may see a little more legitimate mail held in quarantine.
How to confirm it worked
Microsoft Defender portal, Preset security policies: Standard and Strict are both On, and Standard applies to all recipients.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Malware protection test |
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malwareA.8.9 Configuration management |
| CISA SCuBA | MS.DEFENDER.1.1v1 Standard and strict preset security policies enabledMS.DEFENDER.1.2v1 All users in Exchange Online Protection standard or strict presetMS.DEFENDER.1.3v1 All users in Defender for Office 365 standard or strict preset |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Preset security policies (Microsoft Learn)