ORCA.115 - Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.
Overview
Mailbox Intelligence Protection enhances impersonation protection for users based on each user's individual sender graph.
Remediation action
Enable Mailbox intelligence based impersonation protection in anti-phishing policies.
Related Links
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Microsoft Defender for Office 365 security
- Set up Microsoft Defender for Office 365 anti-phishing and anti-phishing policies
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.115 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.001 Impersonation |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA115 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.115.ps1 - Documentation:
tests/orca/Test.ORCA.115.md