The settingWhat we hold this to
CreativeTechs minimum
The Standard preset security policy applied to all recipients, at minimum. Anti-phishing with mailbox intelligence ON and impersonation protection configured. Safe Links on for email, Teams and Office apps with click-tracking on and click-through OFF. Safe Attachments in Block mode. No allowed sender domains in anti-spam.
Benchmark position
CIS M365 2.1.1 and 2.1.4–2.1.5 are L2 (Safe Links / Safe Attachments); 2.1.6–2.1.7 are L1 (spam notification, anti-phishing policy exists). CISA MS.EXO.14.1–14.4 require a spam filter enabled, spam moved to junk or quarantine, and no allowed domains in inbound policies.
Where we differ, and why
We take Standard preset as the floor rather than Strict. Strict quarantines more aggressively than a creative agency's inbound mail will tolerate without a dedicated quarantine reviewer — take Strict per client where someone will actually watch it.
Where the switch is
Defender portal → Email & collaboration → Policies & rules → Threat policies → Preset security policies → Standard protection → Manage.
How to verify
Get-EOPProtectionPolicyRule | fl Name,State Get-SafeLinksPolicy | fl Name,EnableSafeLinksForEmail,EnableSafeLinksForTeams,AllowClickThrough Get-SafeAttachmentPolicy | fl Name,Action # expect Block Get-HostedContentFilterPolicy | fl Name,AllowedSenderDomains # expect empty
- Why it matters
- Anti-phishing, anti-spam, Safe Links and Safe Attachments all ship at permissive defaults. The largest single cluster of failures on the Huntress board and the biggest block of Secure Score points across the fleet.
- How we check
- Huntress: five Medium controls in the Optimized group. Secure Score: the whole mdo_* family, roughly 60 points. CISA.MS.EXO.14.1–14.4, CIS.M365.2.1.1–2.1.7, and 40+ ORCA tests that have never run.
- Fix — M365
- Use the Standard or Strict preset security policies rather than hand-building each one, then override only where a client genuinely needs it.
- Fix — Google
- Gmail → Safety settings; enable enhanced pre-delivery scanning.
- User notices
- More aggressive quarantine. Expect a handful of false positives in the first week.
- Expected pushback
- Low but real when a client's newsletter or a vendor's invoice gets quarantined. Someone watches the quarantine for the first fortnight.
- Reason on file
- Tenants licensed for Defender for Office; verdicts pending the Maester -Service All run.