How to check email protection settings in Microsoft Defender

Before you start

Use an account with the Global Reader or Security Reader role, which Microsoft lists for read-only access to the Configuration analyzer; membership of the View-Only Organization Management role group in Exchange Online also gives it. Every organisation with cloud mailboxes has these policies through Exchange Online Protection. Microsoft 365 E5 or a Defender for Office 365 add-on brings Safe Links, Safe Attachments and more anti-phishing settings.

The policies are read as they stand now. Microsoft's Standard and Strict values are the ones the preset security policies apply, so a preset's own policies meet them. Outbound spam is the exception: no preset covers it, so its policies meet Standard only if you set them to. The examples read and export; they change no policy.

Option 1

Check email protection settings with PowerShell

Install the module once, then connect, read every policy of each kind and keep the settings below Standard.

# Install once, if the module is not already installed.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
# Each setting, Microsoft's Standard value and a test for a value below it.
$spam = 'Get-HostedContentFilterPolicy'
$checks = @(
    @{ Area = 'Anti-spam'; Cmdlet = $spam; Setting = 'BulkThreshold'; Standard = '6 or lower'
        Below = { param($v) [int]$v -gt 6 } }
    @{ Area = 'Anti-spam'; Cmdlet = $spam; Setting = 'HighConfidenceSpamAction'
        Standard = 'Quarantine'; Below = { param($v) "$v" -ne 'Quarantine' } }
    @{ Area = 'Anti-spam'; Cmdlet = $spam; Setting = 'PhishSpamAction'
        Standard = 'Quarantine'; Below = { param($v) "$v" -ne 'Quarantine' } }
    @{ Area = 'Anti-spam'; Cmdlet = $spam; Setting = 'QuarantineRetentionPeriod'
        Standard = '30 days'; Below = { param($v) [int]$v -lt 30 } }
    @{ Area = 'Anti-malware'; Cmdlet = 'Get-MalwareFilterPolicy'; Setting = 'EnableFileFilter'
        Standard = 'True'; Below = { param($v) $v -ne $true } }
    @{ Area = 'Anti-malware'; Cmdlet = 'Get-MalwareFilterPolicy'; Setting = 'ZapEnabled'
        Standard = 'True'; Below = { param($v) $v -ne $true } }
    @{ Area = 'Anti-phishing'; Cmdlet = 'Get-AntiPhishPolicy'; Setting = 'EnableSpoofIntelligence'
        Standard = 'True'; Below = { param($v) $v -ne $true } }
    @{ Area = 'Anti-phishing'; Cmdlet = 'Get-AntiPhishPolicy'
        Setting = 'EnableFirstContactSafetyTips'; Standard = 'True'
        Below = { param($v) $v -ne $true } }
    @{ Area = 'Outbound spam'; Cmdlet = 'Get-HostedOutboundSpamFilterPolicy'
        Setting = 'AutoForwardingMode'; Standard = 'Off'; Below = { param($v) "$v" -ne 'Off' } }
)
Connect-ExchangeOnline -ShowBanner:$false
try {
    $policies = @{}
    $rows = @(foreach ($check in $checks) {
        if (-not $policies.ContainsKey($check.Cmdlet)) {
            $policies[$check.Cmdlet] = @(& $check.Cmdlet)
        }
        foreach ($policy in $policies[$check.Cmdlet]) {
            $value = $policy.($check.Setting)
            if (& $check.Below $value) {
                [pscustomobject]@{
                    Area = $check.Area; Policy = $policy.Name; Setting = $check.Setting
                    Value = "$value"; Standard = $check.Standard
                }
            }
        }
    })
    if ($rows.Count -eq 0) {
        Write-Output 'Every policy meets these Standard values.'
    } else {
        $rows | Sort-Object Area, Policy |
            Export-Csv -Path './protection-below-standard.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) settings are below Microsoft's Standard values."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each policy and setting below Standard. The script compares 9 settings that apply in every organisation; Microsoft's page lists many more, with their Strict values, and each takes 1 more line in $checks. With Defender for Office 365, Get-SafeLinksPolicy and Get-SafeAttachmentPolicy read the Safe Links and Safe Attachments policies the same way.

Option 2

Use the Configuration analyzer in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Email & collaboration > Policies & rules > Threat policies and select Configuration analyzer under Templated policies.
3. On the Standard recommendations tab, read the number of settings to improve for each kind of policy, then the table below it with each setting's recommendation, policy and current value.
4. Select a row, not its check box, to see Why? and the value to change it to. Close it without selecting Apply recommendation, which changes the policy.
5. To keep a file, select the check boxes of the rows you want and select Export.

This suits fixing settings with Microsoft's reasons beside them. The tab shows the policies as they are today; for a record to compare month to month, export it each time or use a report.

Common questions

A setting is below Standard, but the Standard preset covers everyone. Does it matter?

Less than it looks. For the people a preset covers, the preset's settings apply instead of a custom or default policy's. The weaker setting still reaches anyone the preset leaves out, so check its exceptions.

Can I see who changed a setting?

The Configuration analyzer's Configuration drift analysis and history tab lists changes to threat policies, who made them and whether each raised or lowered protection, up to 90 days back. It needs unified auditing turned on.

How do I check whether the presets are on?

The presets are rules of their own, read with other cmdlets. See how to check preset security policies in Microsoft Defender.