Microsoft 365 Rules and Autofix Support in WatchGuard CloudDR

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

If you block users after they hit a message limit (for example, in Teams or Exchange) helps prevent potential spam, abuse, or compromised accounts from misusing communication channels. While it does not prevent a direct breach, it mitigates lateral movement and reputation damage from mass messaging attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_thresholdreachedaction (external).

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls whether Microsoft Copilot Chat is pinned for eligible users. When you configure this setting according to the organization's adoption and rollout strategy, it helps make sure that Copilot Chat is readily accessible when approved for use, while supporting a consistent user experience across the organization.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls access to image-generation capabilities through Microsoft Designer. Restricting this functionality until it has been explicitly approved helps organizations govern the use of AI-generated content in accordance with internal policies, acceptable-use requirements, and business needs.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls whether Copilot is available within Microsoft 365 admin centers. Keeping this capability disabled until explicitly approved helps make sure that AI-assisted administrative experiences are introduced in accordance with organizational access governance, security policies, and operational requirements.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls whether limited mode is enabled for specified groups in Microsoft Teams meetings. When enabled, it restricts Copilot from responding to certain questions involving inferred emotions, behavior, or judgments. When you configure this setting for groups where such restrictions are required, it helps align AI-generated responses with organizational privacy and responsible AI requirements.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls whether web search is available in Microsoft Copilot and Copilot Chat. Restricting web search in high-control environments helps limit external information retrieval through Copilot, while enabling it when approved allows users to ground responses in current web content to support productivity and research needs.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

When you enable Safe Links for Office Applications, it extends URL scanning protection beyond email to Office documents and applications. This enables detection and blocking of malicious links embedded within documents or office files, enhancing threat coverage. It reduces risk of phishing and malware infections triggered from within the Office ecosystem, a common attack vector. Without it, users are vulnerable to threats from unsafe links in documents.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_safelinksforemail (external).

Zero-hour auto purge (ZAP) policies automatically remove previously delivered emails identified as malware after initial delivery. This minimizes dwell time, reduces user exposure to evolving threats, and strengthens protection against malware campaigns that evade initial detection but are later identified by updated threat intelligence.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_zapmalware (external).

Zero-hour auto purge (ZAP) for phishing messages enables Microsoft 365 to retroactively remove emails identified as phishing after delivery. This rapidly reduces exposure to newly discovered threats, minimizes user interaction with malicious content, and helps contain phishing campaigns using delayed or evasive tactics.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_zapphish (external).

Zero-hour auto purge (ZAP) for spam messages makes sure that emails reclassified as spam after delivery are automatically removed from inboxes. This enhances email hygiene, reduces user distraction, and provides an additional layer of protection against evolving or misclassified spam, though the risk is generally lower than phishing or malware.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_zapspam (external).

Don't Add Allowed IP Addresses in the Connection Filter Policy

Avoiding allowed IP addresses in connection filter policies reduces the risk of bypassing spam/malware checks for trusted (but possibly compromised) sources. Overuse of allowed IP addresses can be exploited by attackers who spoof or hijack allowlisted infrastructure. This policy enforces strict hygiene and scrutiny on all incoming mail.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_connectionfilter (external).

Blocking legacy authentication through Conditional Access policies prevents the use of outdated protocols (for example, POP, IMAP, SMTP Basic) that do not support multi-factor authentication (MFA) or modern security controls. These protocols are often exploited in brute-force and password spray attacks. Disabling them significantly reduces the attack surface.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=BlockLegacyAuthentication (external).

Impersonated domain protection helps detect and block phishing attacks that mimic internal or trusted domains. These attacks can deceive users into divulging credentials or executing malicious actions. When you enable this protection, you help defend against business email compromise (BEC) and credential theft.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_enabledomainstoprotect (external).

Impersonated user protection defends against phishing attempts that spoof specific high-profile or executive user identities (for example, CEO fraud). This is essential for preventing targeted attacks like spear phishing and business email compromise (BEC), which can lead to significant financial or data loss.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_targetedusersprotection (external).

Sign-in risk policies in Microsoft Entra ID Identity Protection detect suspicious logins, such as unfamiliar locations or devices, and can trigger automated responses such as MFA challenges or sign-in blocking. When you enable these policies, it helps mitigate credential-based attacks by responding in real time to anomalous sign-in behavior.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=SigninRiskPolicy (external).

User risk policies in Microsoft Entra ID Identity Protection detect compromised accounts based on behavioral signals and threat intelligence. When you enable these policies, it enables automatic action (for example, password reset or blocking access) for high-risk users, minimizing the impact of account takeovers and reducing exposure time.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=UserRiskPolicy (external).

The domain impersonation safety tip warns users when they receive emails from senders that appear similar to internal or trusted domains. While it does not block threats directly, it raises user awareness and helps prevent phishing attacks, especially those using lookalike domains. It is a valuable user-facing layer of defense.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_similardomainssafetytips (external).

The user impersonation safety tip notifies recipients when an email mimics the name of a known internal user (for example, executives or frequent contacts). While it does not block the message, it alerts users to potential phishing or social engineering attempts, supporting better decision-making and reducing BEC risk.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_similaruserssafetytips (external).

This safety tip alerts users when unusual or lookalike characters (for example, "mícrosoft.com" vs. "microsoft.com") are used in display names or addresses to impersonate legitimate users. It helps prevent targeted phishing and spoofing attacks by increasing user awareness of deceptive tactics.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_unusualcharacterssafetytips (external).

Restricting external calendar sharing prevents sensitive information, such as meeting topics, attendee lists, or locations, from being exposed to unauthorized users outside the organization. While calendar data might seem low risk, it can aid attackers in social engineering or reveal confidential operational details.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_individualsharing (external).

This rule restricts access to Microsoft Azure management interfaces to authorized administrators only, minimizing risk of unauthorized changes or exposure. Restricting these privileges prevents accidental or malicious alterations to cloud infrastructure, protects sensitive configurations, and reduces the attack surface. Properly scoped Azure management access is vital for maintaining secure cloud environments and protecting organizational resources.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_limited_administrative_roles (external).

Requiring phishing-resistant MFA (for example, FIDO2 security keys or certificate-based authentication) for administrator accounts greatly reduces the risk of credential theft and account takeover through phishing. Because admins have elevated privileges, compromising one can lead to full environment control, making strong MFA essential for safeguarding access.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_phishing_MFA_strength (external).

Restricting user-owned apps and services prevents users from registering and granting permissions to third-party applications, which can introduce data exfiltration risks or unauthorized access paths. It enforces centralized control over app integrations, reducing shadow IT and potential OAuth abuse.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=admincenter_owned_apps_and_services (external).

Restricting additional storage providers (for example, Dropbox, Box) in Outlook on the web helps prevent sensitive data from being uploaded to unsanctioned or insecure third-party services. This control enforces data residency and compliance requirements while reducing the risk of data leakage.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_storageproviderrestricted (external).

This rule mandates dedicated administrative accounts that are isolated from standard user accounts and restricted to cloud environments, reducing attack surfaces.

Segregation prevents administrative privileges from being abused or compromised through everyday user actions or malware. Separating cloud-only admin accounts mitigates risks of lateral movement, privilege escalation, and enhances auditing and monitoring for critical security operations, thereby improving overall control and resilience.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_admin_accounts_separate_unassigned_cloud_only (external).

If you block all forms of mail forwarding (for example, inbox rules and SMTP forwarding), you prevent automatic exfiltration of sensitive emails to external accounts. Mail forwarding is a common tactic used by attackers to maintain access and silently steal data after account compromise. Disabling it reduces data loss risk and helps detect malicious behavior.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_blockmailforward (external).

This rule requires implementing a custom list of prohibited passwords that often includes commonly used, weak, or previously compromised passwords. Custom banned lists help enforce password uniqueness and strength beyond default policies, preventing users from choosing easily guessable or recycled passwords. By excluding risky passwords, organizations reduce vulnerabilities to credential attacks and enhance overall account security.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_custom_banned_passwords (external).

When you enable Data Loss Prevention (DLP) policies, it makes sure sensitive data (such as PII, financial info, or health records) is monitored and protected across Microsoft 365 services. DLP policies help prevent accidental or intentional data leaks by enforcing rules for sharing, storing, or transmitting sensitive information—supporting both security and compliance mandates.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=dlp_datalossprevention (external).

When you enable DLP policies for Microsoft Teams, it makes sure that sensitive data shared in chats and channel messages is monitored and protected. Teams is widely used for internal and external collaboration, and without DLP, there is a higher risk of data exposure through casual or unauthorized sharing.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mip_DLP_policies_Teams (external).

Notifying administrators when spam policies are triggered helps with early detection of phishing campaigns, compromised accounts, or misconfigured rules. Prompt alerts enable quicker response and containment of email-based threats, improving overall incident visibility and security posture.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_spam_notifications_only_for_admins (external).

This rule mandates enabling internal phishing protection within Microsoft Forms to detect and prevent unauthorized attempts to gather sensitive data through deceptive forms. The feature analyzes form submissions and link sharing patterns to mitigate risks from phishing campaigns targeting employees.

When you enable this rule, it is vital for protecting corporate data integrity, reducing credential theft, and lowering the likelihood of successful spear-phishing attacks leveraging Forms as an attack vector.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=forms_phishing_protection (external).

MailTips provide real-time alerts to users (for example, external recipient warnings, large recipient lists, or out-of-office replies) when composing emails. When you enable them, they reduce the risk of accidental data exposure, improve communication awareness, and support secure email habits—but they do not enforce security controls directly.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_mailtipsenabled (external).

When you enable Microsoft 365 audit log search, it makes sure comprehensive logging of user and admin activities across services like Exchange, SharePoint, Teams, and Azure AD. This capability is vital for incident investigation, threat detection, compliance auditing, and forensic analysis. Without it, critical security events might be untraceable.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mip_search_auditlog (external).

When you enable modern authentication (OAuth 2.0) for Exchange Online, it is crucial to support advanced security features like Multi-Factor Authentication (MFA) and Conditional Access. It helps eliminate reliance on legacy authentication protocols, which are commonly exploited in credential-based attacks and do not support modern security controls.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_oauth2clientprofileenabled (external).

When you enable multifactor authentication (MFA) for all users, it significantly reduces the risk of account compromise due to phishing, password reuse, or brute-force attacks. MFA adds a second layer of security beyond the password and is one of the most effective controls to protect user identities in cloud environments.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_storageproviderrestricted (external).

When you enable multifactor authentication (MFA) for all users in administrative roles, it is one of the most effective defenses against account compromise. Admin accounts have elevated privileges, and without MFA, they are prime targets for phishing, credential stuffing, and brute-force attacks. MFA significantly reduces the risk of unauthorized access.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=AdminMFAV2 (external).

This rule enforces enhanced password protection mechanisms within on-premises Active Directory, such as banning known compromised passwords and enforcing complexity. It strengthens defenses against credential theft and brute force attacks using legacy on-prem systems.

Implementing advanced password protection safeguards domain accounts, reduces the likelihood of lateral movement, and enhances overall enterprise security posture.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_password_protection (external).

When you enable a Safe Attachments policy, it makes sure that all incoming email attachments are analyzed in a virtual sandbox environment before delivery. This helps detect and block zero-day malware, ransomware, and other threats that evade traditional signature-based defenses poviding a crucial layer of protection against email-based attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_safeattachmentpolicy (external).

When you enable Safe Links for Office applications (Word, Excel, PowerPoint), it makes sure that URLs in documents are dynamically scanned and rewritten to protect users when clicked. This defends against malicious links embedded in Office files, a common phishing and malware delivery method, especially in targeted attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_safelinksforOfficeApps (external).

This rule makes sure that the Spam Confidence Level (SCL) threshold is explicitly set within mail transport rules targeting specific domains. It filters suspicious and potentially harmful emails by assigning confidence levels indicating spam likelihood.

Proper configuration reduces false positives and prevents spam phishing attempts from reaching users. Misconfigured or missing SCL settings increase exposure to spam, phishing, and malware attacks, jeopardizing organizational email security and user productivity.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_transportrulesallowlistdomains (external).

Creating and configuring an anti-phishing policy enables Microsoft Defender for Office 365 to apply targeted protection mechanisms—such as impersonation detection, mailbox intelligence, and policy-based actions. Without such a policy, users are more vulnerable to business email compromise (BEC), spear phishing, and spoofing attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_antiphishingpolicies (external).

When you enable intelligence for impersonation protection, the system can use machine learning and behavioral analysis to detect and block sophisticated impersonation attacks. It enhances protection against business email compromise (BEC), spear phishing, and other targeted threats that mimic trusted senders or domains.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_mailboxintelligenceprotection (external).

When you enable mailbox intelligence, Microsoft 365 can learn typical communication patterns and relationships for each user. This improves detection of impersonation and targeted phishing attempts by identifying anomalies. It strengthens personalized threat protection and enhances overall email security effectiveness.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_enablemailboxintelligence (external).

Not allowing sender domains (that is, avoiding domain-level allowlists) in anti-spam policies prevents attackers from bypassing email protections by exploiting trusted but compromised or spoofed domains. This makes sure all incoming emails are subject to full inspection regardless of origin, strengthening defenses against phishing and spoofing.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_allowedsenderscombined (external).

Restricting the creation and existence of public groups to only those managed or approved by the organization helps prevent unauthorized data exposure and sprawl. Public groups can be indexed and accessed widely, increasing the risk of sensitive information being inadvertently shared or discovered. Governance helps enforce security and compliance standards.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_managed_approved_public_groups_only (external).

Publishing SPF (Sender Policy Framework) records for all Exchange domains helps prevent sender spoofing by specifying which mail servers are authorized to send on behalf of your domain. It is a foundational control in email authentication (along with DKIM and DMARC) and essential for defending against phishing and domain impersonation attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_SPF_records_for_all_domains (external).

Setting passwords to never expire (when combined with strong password policies and MFA) aligns with modern security best practices. Frequent password changes can lead to weak reuse patterns or unsafe storage. A non-expiring password policy, paired with protections like banned password lists and MFA, improves security while enhancing usability.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=PWAgePolicyNew (external).

When you enable the admin consent workflow, it makes sure that users must request administrator approval before an app can get access to organizational data. This prevents unauthorized or risky third-party applications from being granted access by users, enforcing governance and reducing the risk of data leaks or OAuth-based attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_admin_consent_workflow (external).

The Common Attachment Types Filter blocks file types commonly used to deliver malware (for example, .exe, .js, .vbs). When you enable it, it helps prevent initial access attacks through email-borne threats, reducing risk from malicious attachments and enhancing the organization's email hygiene and security posture.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_commonattachmentsfilter (external).

When you enable Customer Lockbox, it makes sure that Microsoft support engineers cannot get access to customer content to troubleshoot issues without explicit approval. This control adds a critical privacy and compliance safeguard, especially for regulated industries, by enforcing customer consent before any data-level access occurs.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=CustomerLockBoxEnabled (external).

Blocking third-party integrated applications prevents unapproved external apps from getting access to organizational data or acting on users' behalf. This control is essential to reduce the risk of data leakage, OAuth abuse, and compromised integrations, and to maintain centralized governance over app access and permissions.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=aad_third_party_apps (external).

Disabling user consent to apps that get access to organizational data prevents users from unintentionally authorizing potentially risky third-party applications through OAuth. This mitigates risks such as data leakage, shadow IT, and token hijacking, and makes sure all app permissions are vetted through admin-controlled processes.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=IntegratedApps (external).

Blocking users from installing Outlook add-ins prevents potential introduction of malicious or vulnerable third-party code that could compromise email security or cause data leakage. This rule minimizes risks associated with uncontrolled extension installations and maintains a secure email client environment.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=exo_outlookaddins (external).

Approving a device means giving permission for a specific device, like a smartphone or laptop, to get access to an account or service. It is essential for security because it makes sure only authorized devices can connect. It is necessary to keep a check on the number of devices that have this privilege. Letting too many devices have this access can prove to be risky. This prevents unauthorized access and protects sensitive information from being accessed by unknown or untrusted devices, enhancing overall account and data security.

Mailbox intelligence identifies emails that impersonate known users based on historical communication patterns. Automatically moving such messages (for example, to Junk or Quarantine) helps prevent user exposure to targeted phishing and business email compromise (BEC), reducing the risk of credential theft and financial fraud.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_mailboxintelligenceprotectionaction (external).

This rule controls whether item insights are enabled across the organization. Disabling organization-wide item insights supports a privacy-focused configuration by limiting the availability of insights derived from users' interactions with organizational items and aligning data processing with privacy requirements.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

This rule controls whether people insights are enabled across the organization. Disabling organization-wide people insights supports a privacy-focused configuration by limiting the availability of insights about relationships and interactions between individuals. The feature should be enabled when its productivity benefits have been reviewed and approved in accordance with organizational privacy requirements.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

Spoof intelligence refers to technology that detects and prevents email spoofing and phishing attacks. It analyzes email headers, sender behavior, and content to identify forged emails aiming to deceive recipients.

Benefits include safeguarding against cyber threats, protecting sensitive information, preserving brand reputation, and making sure of secure communication. It helps businesses maintain trust, reduce fraud risks, and enhance overall cybersecurity posture.

It is an email security feature that delays delivering an email until it is scanned for malware or threats. It functions by holding the email in a queue until a thorough scan is completed. Security implications involve improved protection against malicious content reaching recipients.

Delays might inconvenience users, and if the scanning process fails, legitimate emails might be withheld, potentially causing communication disruptions or overlooking real threats.

This rule prevents anonymous (unauthenticated) users from initiating Microsoft Teams meetings, making sure only verified users can start sessions. It reduces unauthorized meeting creation, which is crucial to prevent disruptions, unauthorized information sharing, or malicious activity such as meeting hijacking.

Enforcing this restriction maintains meeting integrity and protects sensitive communications from exposure to untrusted individuals, thereby strengthening organizational security posture.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mip_sensitivitylabelspolicies (external).

This rule quarantines emails detected as impersonating trusted domains using domain authentication failures, header analysis, and reputation signals. It blocks spoofed sender domains commonly used in phishing. If disabled or relaxed, attackers can bypass trust checks, leading to credential theft, business email compromise, and malware delivery through seemingly legitimate domains.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_targeteddomainprotectionaction (external).

Messages identified as originating from impersonated users are automatically quarantined to prevent phishing and fraud. This control isolates emails that mimic trusted identities, reducing the risk of credential theft, financial loss, and unauthorized actions.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_targeteduserprotectionaction (external).

Retaining spam in quarantine for 30 days gives administrators and users sufficient time to review and release misclassified emails if necessary. It also supports forensic analysis during investigations. While it does not prevent threats directly, it makes sure flexibility and accountability in email handling.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_quarantineretentionperiod (external).

Setting a daily message limit controls the volume of emails a user can send, helping detect and contain account compromises or spam behavior. It restricts the blast radius of compromised accounts and prevents email-based attacks or unintentional data leaks from flooding internal or external recipients.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_recipientlimitperday (external).

Bulk spam (for example, newsletters or marketing messages) is typically low risk but can clutter inboxes and reduce user productivity. Setting an appropriate action (like moving to Junk Email folder) improves email hygiene and user experience without impacting legitimate communication or introducing unnecessary false positives.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_bulkspamaction (external).

High confidence phishing emails are those almost certainly identified as malicious, often using threat intelligence, behavioral analysis, and machine learning. Setting the action to quarantine or delete is essential to prevent users from interacting with highly dangerous content, such as credential harvesters or malware-laden links. This is a top priority control to block exploitation.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_highconfidencephishaction (external).

Messages marked as high confidence spam pose a strong likelihood of being malicious or deceptive. Taking aggressive action (for example, quarantine or delete) minimizes the risk of these emails reaching users and reduces chances of phishing, malware execution, or user deception. It enhances email threat resilience.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_highconfidencespamaction (external).

When you configure a strong action (such as quarantine or delete) for phishing detections, it is critical to prevent users from interacting with harmful content. Prompt containment restricts exposure to credential theft, malware delivery, and business email compromise. It makes sure that phishing threats are neutralized before reaching users.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_phisspamacation (external).

Defining a clear action (for example, quarantine, move to junk folder, or delete) when spam is detected helps make sure consistent handling of malicious or unwanted messages. This reduces user exposure to phishing or malware and enforces secure email hygiene across the organization.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_spamaction (external).

Setting automatic email forwarding rules to "system controlled" or "Off" prevents users from configuring forwarding to external accounts unless explicitly allowed by admins. This reduces the risk of data exfiltration, account compromise persistence, and compliance violations. Centralizing control makes sure visibility and enforcement of secure data handling practices.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_autoforwardingmode (external).

Setting a limit on the number of external recipients per hour helps prevent data exfiltration and reduces damage from compromised accounts being used to send spam or phishing. It is a strong control against both intentional and accidental mass email leaks to outside entities.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_recipientexternallimitperhour (external).

Restricting the number of internal recipients a user can email within an hour helps detect and contain compromised accounts or insider misuse. It prevents mass internal phishing or spam from spreading rapidly, allowing time for detection and response. It is especially useful in mitigating lateral phishing attacks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_recipientinternallimitperhour (external).

This rule makes sure filtering of common risky file attachments (for example, executables, scripts) in emails to prevent malware delivery. When you enable the filter, it reduces the likelihood of endpoint infections and data breaches by blocking potentially dangerous content. It is a fundamental layer in email security posture to protect users and infrastructure from malicious attachments.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_bulkthreshold (external).

Setting the phishing email level threshold to 2 or higher makes sure that more aggressive or suspicious messages are flagged or quarantined before reaching users. This reduces the risk of phishing attacks slipping through filters, particularly those using advanced evasion techniques. It is a key control for strengthening phishing defense.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_phishthresholdlevel (external).

Turning on Microsoft Defender for Office 365 in SharePoint, OneDrive, and Teams enables real-time scanning of files for malware and threats as they are uploaded or shared. These collaboration platforms are common vectors for spreading infected files internally. When you enable this protection, it helps contain threats and prevent lateral movement or data compromise.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_atpprotection (external).

When you enable Safe Attachments in block mode, it makes sure malicious files are automatically prevented from reaching users' inboxes. It uses detonation-based analysis (sandboxing) to detect zero-day threats in email attachments. Blocking instead of monitoring reduces the window of exposure and is essential for proactive email threat defense.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_safeattachments (external).

Safe Documents scans Office files opened in Protected View using Microsoft Defender for Endpoint before allowing editing. This helps prevent malware or malicious macros from executing within Office documents, a common initial access vector in phishing and targeted attacks. It adds a critical layer of real-time threat detection on endpoints.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=mdo_safedocuments (external).

This rule refers to allowing team members to invite people from outside their organization to get access to certain resources or collaborate. It is important for collaboration and flexibility.

In terms of security, it can pose risks. If not carefully managed, unauthorized external users might gain access, potentially leading to data breaches or exposing sensitive information. Proper access controls and user verification mechanisms are essential to maintain security.

This rule controls whether organizational branding is used in Microsoft Entra Lifecycle Workflow notification emails. When you enable approved company branding, it helps maintain a consistent organizational identity and allows recipients to more easily recognize official workflow communications.

This rule requires a valid Agent 365 license. If the license is not present, the rule might not work.

This rule defines the interval at which Microsoft Entra Lifecycle Workflows are scheduled to execute. When you configure an appropriate interval, it helps make sure workflows process lifecycle events in a timely and consistent manner while aligning execution frequency with organizational operational requirements.

This rule requires a valid Agent 365 license. If the license is not present, the rule might not work.

This rule specifies the sender domain used for Microsoft Entra Lifecycle Workflow notification emails. When you configure a verified domain controlled by the organization, it helps establish sender authenticity, maintain consistent email identity, and support reliable delivery of workflow notifications.

This rule requires a valid Agent 365 license. If the license is not present, the rule might not work.

This rule controls the level of related-people information displayed in Microsoft Entra Entitlement Management access-package suggestions. When you configure an appropriate insight level, it helps balance useful access recommendations with privacy requirements by limiting the amount of personal and identity-related information presented to users.

This rule requires a valid Copilot license. If the license is not present, the rule might not work.

Allowing syncing only on computers joined to specific domains restricts file synchronization to authorized devices within particular network domains. Risks of doing so include potential operational limitations for legitimate users outside these domains and the need for stringent access control measures to prevent unauthorized access or data breaches from compromised devices within permitted domains.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=spo_block_onedrive_sync_unmanaged_devices (external).

The rule means allowing use of apps or systems with weaker protection. It is risky for security because weak apps can be exploited by hackers to steal data or cause harm. Using strong and secure applications reduces the risk of cyber-attacks and keeps personal information safe from unauthorized access, protecting users and organizations from potential damage to their privacy, finances, and reputation.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=spo_legacy_auth (external).

Managing SharePoint external sharing through domain allowlists or blocklists makes sure that only trusted domains can receive shared content. This reduces the risk of accidental data leakage, prevents unauthorized access, and enforces organizational data sharing policies, especially critical for regulated industries or sensitive data.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=spo_external_sharing_managed (external).

The feature means that the guests can give access of the items they do not own to others without permission. This can be risky because it might lead to misuse, data breaches, or unauthorized access to sensitive information. It might result into strangers using those resources without consent, and that can cause problems and compromise security.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=spo_external_users_sharing (external).

The rule refers to a system feature that logs out users after a period of inactivity. It enhances security by reducing the risk of unauthorized access to accounts left unattended. This practice helps safeguard sensitive information and prevents potential misuse of user accounts, thereby minimizing security breaches and making sure of data privacy.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=spo_idle_session_timeout (external).

The rule means that people from outside a system can either share or ask for access to that system. The security concern is that granting control to unknown individuals can lead to security breaches, data theft, or misuse of resources. It is important to be cautious and verify the identity and intentions of external participants before giving them control to avoid potential harm.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=meeting_externalrequestcontrol_v1 (external).

This rule refers to allowing access to a system or service without any manual verification. This poses a significant risk because it might grant unauthorized users entry, compromising security and privacy. Give this privilege only to specific roles such as organizers. Without proper checks, anyone can gain access, leading to data breaches and potential harm to the system's integrity. Always use proper authentication methods to safeguard against these risks.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=meeting_autoadmitusers_v1 (external).

Anonymous control access to meetings means allowing people to join and control a meeting or conference without revealing their true identity. Instead of using their real names, participants can use pseudonyms or remain unidentified. It might increase the likelihood of disruptive behavior, trolling, or unauthorized attendees. It can lead to difficulties in moderating discussions and verifying participants' intentions, potentially compromising the meeting's productivity and security.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=meeting_restrictanonymousjoin_v1 (external).

This rule refers to stopping people from avoiding paying fees for long-distance calls. Sending calls through the PSTN (Public Switched Telephone Network) makes sure proper payment for these calls. Security concerns in using PSTN include problems such as eavesdropping and call interception. Analog PSTN calls are susceptible to eavesdropping, where unauthorized individuals could listen in on conversations without detection.

For more information, go to https://security.microsoft.com/securescore?viewid=actions&actionId=meeting_pstnusersbypasslobby_v1 (external).