Detections
Analytics

MS.EXO.14.3v1 - Allowed domains SHALL NOT be added to inbound anti-spam protection policies.

Information

Legitimate emails may be incorrectly filtered by spam protections. Adding allowed senders is an acceptable method of combating these false positives. However, allowing an entire domain, especially a common domain like office.com, provides for a large number of potentially unknown users to bypass spam protections.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Any product meeting the requirements outlined in this baseline policy may be
used. If the agency uses Microsoft Defender, see the following
implementation steps for
[enabling preset security policies](./defender.md#msdefender12v1), which do not
include any allowed sender domains by default.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-8

Plugin: microsoft_azure

Control ID: fdaa06c92192addab0eaeb81f930085819b26bb5636685e7ac6db6092a287335