ORCA.111 - Anti-phishing policy exists and EnableUnauthenticatedSender is true.
Overview
When the sender email address is spoofed, the message appears to originate from someone or somewhere other than the actual source. It is recommended to enable unauthenticated sender tagging in Office 365 Anti-phishing policies. The feature apply a '?' symbol in Outlook's sender card if the sender fails authentication checks.
Remediation action
Enable unauthenticated sender tagging in Anti-phishing policy.
Related Links
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Office 365 Microsoft Defender for Office 365 security
- Unverified Sender
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.111 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA111 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.111.ps1 - Documentation:
tests/orca/Test.ORCA.111.md