ORCA.221 - Mailbox intelligence is enabled in anti-phishing policies.
Overview
Mailbox Intelligence checks can provide your users with intelligence on suspicious incoming emails that appear to be from users that they normally communicate with based on their graph.
Remediation action
Enable mailbox intelligence in anti-phishing policies.
Related Links
- Microsoft 365 Defender Portal - Anti-phishing
- Recommended settings for EOP and Microsoft Defender for Office 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.221 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-phishing |
| Area | Email and collaboration protection |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing, T1684.001 Impersonation |
| Supports controls | nist-800-53-r5:SI-8 |
| PowerShell test | Test-ORCA221 |
| Services | ExchangeOnline |
| Compatible licenses | ATP_ENTERPRISE |
Source
- Test:
tests/orca/Test.ORCA.221.ps1 - Documentation:
tests/orca/Test.ORCA.221.md