CISA.MS.EXO.16.1 - Alerts SHALL be enabled.

Contributed by Michael Soule with Thomas SchmidtAll contributors →

Overview

At a minimum, the following alerts SHALL be enabled:

• Suspicious email sending patterns detected.
• Suspicious Connector Activity.
• Suspicious Email Forwarding Activity.
• Messages have been delayed.
• Tenant restricted from sending unprovisioned email.
• Tenant restricted from sending email.
• A potentially malicious URL click was detected.

Rationale: Potentially malicious or service impacting events may go undetected without a means of detecting these events. Setting up a mechanism to alert administrators to events listed above draws attention to them to help minimize impact to users and the agency.

Remediation action:

1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Alert Policy.
4. Select the checkbox next to each alert to enable as determined by the agency and at a minimum those referenced in the CISA M365 Security Configuration Baseline for Exchange Online which are:
   • Suspicious email sending patterns detected.
   • Suspicious connector activity.
   • Suspicious Email Forwarding Activity.
   • Messages have been delayed.
   • Tenant restricted from sending unprovisioned email.
   • Tenant restricted from sending email.
   • A potentially malicious URL click was detected.
5. Click the pencil icon from the top menu.
6. Select the Enable selected policies action from the Bulk actions menu.

Related links

• Defender admin center - Alert policy
• CISA 16 Alerts - MS.EXO.16.1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.16.1
Severity	High
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Alert policies
Area	Logging and detection
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1114.003 Email Forwarding Rule, T1204.001 Malicious Link
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.16.1
Criticality	SHALL
Upstream requirement	Moved to MS.SECURITYSUITE.4.1v1 (was MS.EXO.16.1v1)
Supports controls	cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)
PowerShell test	Test-MtCisaExoAlert
Services	ExchangeOnline, Graph, SecurityCompliance
Compatible licenses	ATP_ENTERPRISE

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.16.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.16.1.md