What this check looks at
Checks that priority account protection is on, that priority accounts are tagged, and that every one is covered by the strict preset security policy for both Exchange Online Protection and Defender for Office 365.
Priority account protection, in Defender for Office 365 Plan 2, lets you tag up to 250 people (directors, finance, HR, IT administrators) as priority accounts. Tagged accounts get additional protection in Microsoft’s filtering, and their alerts, incidents and reports are flagged so they stand out. The Strict preset security policy is the most aggressive filtering Microsoft offers, with lower thresholds, more quarantine and impersonation protection, for both Exchange Online Protection and Defender for Office 365.
The check is not applicable without Defender for Office 365 Plan 2. It fails when priority account protection is off, when no account is tagged, or when the Strict preset is off for Exchange Online Protection or for Defender for Office 365. It then checks every priority account is in the Strict preset for both, either because the preset applies to everyone or because the account is named in it. It fails when an account is missing, and warns when the preset also targets groups, whose members it cannot see.
Attackers research who approves payments and who holds administrator rights, and send those people the most carefully crafted phishing. Leaving them on the same filtering as everyone else, with their alerts mixed in with everyone else’s, spends the licence’s best protection on the people least likely to be targeted.
Why it matters
Directors and finance staff receive the most targeted phishing. Tagging them as priority accounts and putting them in the strict preset gives them the most aggressive filtering, and their incidents are flagged first in Defender.
In most invoice fraud against UK businesses the target is a named person in finance, or the managing director is the one impersonated. A spear-phishing email to the finance director, built from a real supplier’s branding and an earlier thread, can scrape through standard filtering; strict filtering and impersonation protection give it far less chance, and a priority flag gets any resulting alert looked at first.
The trade-off is a little more legitimate mail held in quarantine for a small number of people, which is manageable. A compromise of one of these accounts costs far more: a director’s mailbox is the most valuable account in the business for fraud, and an IT administrator’s for ransomware.
CIS Microsoft 365 Foundations Benchmark 2.4.1 and 2.4.2 ask for priority account protection to be on and for priority accounts to have the Strict preset applied; CISA SCuBA MS.DEFENDER.1.4 and 1.5 ask for sensitive accounts to be in the Strict preset for Exchange Online Protection and Defender for Office 365. ISO 27001 A.8.2 (privileged access rights) and NCSC CAF B2.c (privileged user management) back the extra care for these people.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Preset security policies
Before you start
- Agree who counts as a priority account (directors, finance, HR, IT administrators); up to 250 users.
- The strict policy quarantines more mail for these people; tell them and whoever reviews quarantine.
Step by step
- Agree the priority accounts. With the client, list the people most likely to be targeted or whose compromise would hurt most: directors, finance and payroll staff, HR, executive assistants and IT administrators, up to 250. Keep the list short and review it as people join and leave.
- Turn on priority account protection. In the Microsoft Defender portal, go to Settings > Email & collaboration > Priority account protection and turn it on.
- Tag the accounts. Go to Settings > Email & collaboration > User tags, select the Priority account tag and Edit, and add each person as a user, not through a group. Or, in Exchange Online PowerShell, run Set-User -Identity user@contoso.com -VIP $true for each person.
- Add them to the Strict preset by name. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies and, under Strict protection, select Manage protection settings. On Apply Exchange Online Protection choose Specific recipients and add each priority account under Users. On Apply Defender for Office 365 protection choose Previously selected recipients so the same people are covered.
- Finish the Strict preset and turn it on. On the impersonation pages add the same people as users to protect, and the key partner domains. Choose Turn on the policy when finished and select Confirm. If Strict was already on, save each page and check the Preset security policies page still shows it as on.
- Tell the people and the quarantine reviewer. Strict filtering holds a little more legitimate mail in quarantine. Tell the priority account holders what quarantine notifications look like, and make sure someone reviews their quarantined mail promptly.
- Confirm the accounts are covered. In Exchange Online PowerShell run Get-User -IsVIP | Format-Table Name, UserPrincipalName, then Get-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo and Get-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy" | Format-List State, SentTo. Both rules should be Enabled and list every priority account. The next assessment passes.
What users will notice
Priority accounts get the strictest filtering; a little more legitimate mail may be held in quarantine for them.
How to confirm it worked
Get-User -IsVIP lists the accounts; Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule for "Strict Preset Security Policy" are enabled and list them.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configurationB2.c Privileged user management |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | ES-2 Use modern anti-malware software |
| Zero Trust | IdentitiesApplications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 5.4.1 Personnel are protected against phishing attacks |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malwareA.8.2 Privileged access rights |
| CISA SCuBA | MS.DEFENDER.1.4v1 Sensitive accounts in the Exchange Online Protection strict presetMS.DEFENDER.1.5v1 Sensitive accounts in the Defender for Office 365 strict preset |
| CIS M365 | 2.4.2 Ensure Priority accounts have 'Strict protection' presets applied2.4.1 Ensure Priority account protection is enabled and configured |
| CIS Controls v8.1 | 9.7 Deploy and maintain email server anti-malware protections (IG3) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Preset security policies (Microsoft Learn)
- Priority account protection (Microsoft Learn)