CIS.M365.2.1.15 - (L1) Ensure outbound anti-spam message limits are in place (Default policy only)
Overview
The default outbound spam policy sets sensible recipient limits, restricts a user who reaches them, turns on outbound spam notifications and names a notification recipient.
A compromised mailbox is usually used to send phishing or spam to a large number of recipients. Recipient limits stop the burst early, and blocking the user, instead of only alerting, stops the abuse and protects your sending reputation.
The default value of 0 means that the service uses its own limits and is not accepted. Set values at or below 500 external recipients per hour, 1000 internal recipients per hour and 1000 recipients per day, and the action to Restrict the user from sending mail. The test checks only the default outbound spam policy, as specified by CIS 2.1.15. It also checks that this policy turns on outbound spam notifications and names at least one notification recipient. It cannot tell whether that mailbox is monitored, so confirm that someone reads its messages. Microsoft recommends the alert policy User restricted from sending email for admin notifications, and this outbound policy setting is being deprecated.
Remediation action
- Sign in to the Microsoft Defender portal.
- Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open the Anti-spam outbound policy (Default).
- Select Edit protection settings.
- Set External message limit to 500 or less, Internal message limit to 1000 or less and Daily message limit to 1000 or less.
- Set Restriction placed on users who reach the message limit to Restrict the user from sending mail. In the Notifications section, turn on Notify these users and groups if a sender is blocked due to sending outbound spam, add a monitored mailbox, then select Save.
Related links
- Microsoft Defender portal - Anti-spam policies
- Configure outbound spam filtering in EOP
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 2.1.15
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.2.1.15 |
| Severity | Medium |
| Suite | CIS |
| Product | Defender |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1534 Internal Spearphishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 2.1.15 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:2.1.15, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisOutboundSpamLimit |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.2.1.15.ps1 - Documentation:
tests/cis/Test.CIS.M365.2.1.15.md