Skip to content
MitoMito Docs

CIS.M365.2.1.6: Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy)
ID CIS.M365.2.1.6
Severity Medium
Suite CIS Microsoft 365 Foundations Benchmark
Product Defender
Related products Exchange Online
Feature Anti-spam
Security area Email and collaboration protection
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CIS Microsoft 365 Foundations Benchmark 7.0.0, 2.1.6 (L1, E3 Level 1)
Framework controls cis-m365:2.1.6
nist-800-53-r5:SI-4(5) System Monitoring | System-generated Alerts
MITRE ATT&CK T1078.004
Reads from Exchange Online, Security & Compliance PowerShell

What this checks and how to fix it

Section titled “What this checks and how to fix it”

2.1.6 (L1) Ensure Exchange Online Spam Policies are set to notify administrators

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against spam (junk email) by EOP. Configure Exchange Online Spam Policies to copy emails and notify someone when a sender in the organization has been blocked for sending spam emails.

Rationale

Section titled “Rationale”

A blocked account is a good indication that the account in question has been breached, and an attacker is using it to send spam emails to other people.

Impact

Section titled “Impact”

Notification of users that have been blocked should not cause an impact to the user.

Remediation action

Section titled “Remediation action”

To set the Exchange Online Spam Policies:

  1. Navigate to Microsoft 365 Defender https://security.microsoft.com
  2. Under Email & collaboration select Policies & rules
  3. Select Threat policies then Anti-spam
  4. Click on the Anti-spam outbound policy (default)
  5. Select Edit protection settings then under Notifications
  6. Check Send a copy of outbound messages that exceed these limits to these users and groups then enter the desired email addresses
  7. Check Notify these users and groups if a sender is blocked due to sending outbound spam then enter the desired email addresses.
  8. Click Save.
PowerShell
Section titled “PowerShell”
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following PowerShell command:
Terminal window
$BccEmailAddress = @("<INSERT-EMAIL>")
$NotifyEmailAddress = @("<INSERT-EMAIL>")
Set-HostedOutboundSpamFilterPolicy -Identity Default -BccSuspiciousOutboundAdditionalRecipients $BccEmailAddress -BccSuspiciousOutboundMail $true -NotifyOutboundSpam $true -NotifyOutboundSpamRecipients $NotifyEmailAddress

Note: Audit and Remediation guidance may focus on the Default policy however, if a Custom Policy exists in the organization’s tenant, then ensure the setting is set as outlined in the highest priority policy listed.

Section titled “Related links”

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.