ORCA.232 - Each domain has a malware filter policy applied to it, or the default policy is being used.

Contributed by Michael SouleAll contributors →

Overview

Exchange Online Protection malware filter policies are applied using rules. The default policy applies in the absence of a custom policy. When creating custom policies, there may be duplication of settings and depending on the rules and priority, some policies or settings may not even apply. It's important in this circumstance to check that the desired settings are applied to the right users.

Remediation action

Check your malware filter policies for duplicate rules. Some policies and settings may not be applying.

Related Links

• Microsoft 365 Defender Portal - Anti-malware policies
• Order and precedence of email protection

Test Metadata

Field	Value
Test ID	ORCA.232
Severity	Low
Suite	ORCA
Product	Defender
Related products	Exchange Online
Feature	Anti-malware
Area	Email and collaboration protection
Resource type	Domain
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports controls	nist-800-53-r5:SI-3
PowerShell test	Test-ORCA232
Services	ExchangeOnline

Source

• Test: tests/orca/Test.ORCA.232.ps1
• Documentation: tests/orca/Test.ORCA.232.md