ORCA.102 - Advanced Spam filter options are turned off.
Overview
Enabling one or more of the ASF settings is an aggressive approach to spam filtering that can often cause false positives. The effectiveness of these settings in reducing spam has severely declined over the years. Use them with caution.
Remediation action
Turn off Advanced Spam filter (ASF) options in Anti-Spam filter policies.
Related Links
- Microsoft 365 Defender Portal - Anti-spam settings
- Recommended settings for EOP and Microsoft Defender for Office 365 security
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.102 |
| Severity | Low |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA102 |
| Services | ExchangeOnline |
Source
- Test:
tests/orca/Test.ORCA.102.ps1 - Documentation:
tests/orca/Test.ORCA.102.md