Detections
Analytics

MS.DEFENDER.2.1v1 - User impersonation protection SHOULD be enabled for sensitive accounts in both the standard and strict preset policies.

Information

User impersonation, especially of users with access to sensitive or high-value information and resources, has the potential to result in serious harm. Impersonation protection mitigates this risk. By configuring impersonation protection in both preset policies, administrators can help protect email recipients from impersonated emails, regardless of whether they are added to the standard or strict policy.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Sign in to Microsoft 365 Defender.
2. In the left-hand menu, go to Email & Collaboration > Policies & Rules.
3. Select Threat Policies.
4. From the Templated policies section, select Preset Security Policies.
5. Under either Standard protection or Strict protection, select Manage
 protection settings.
6. Select Next until you reach the Impersonation Protection page, then
 select Next once more.
7. On the Protected custom users page, add a name and valid email address for each
 sensitive account and click Add after each.
8. Select Next until you reach the Trusted senders and domains page.
9. (Optional) Add specific email addresses here to not flag as impersonation
 when sending messages and prevent false positives. Click Add after each.
10. Select Next on each page until the Review and confirm your changes page.
11. On the Review and confirm your changes page, select Confirm.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8

Plugin: microsoft_azure

Control ID: 2b0ac1594f2355ac487103c6e665c93e8c0774603c25dfab2dea1a431a59307b