CISA.MS.EXO.11.2: User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.
| ID | CISA.MS.EXO.11.2 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Related products | Defender |
| Feature | Anti-phishing |
| Security area | Email and collaboration protection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.11.2 (SHOULD) |
| Framework controls | cisa-scuba:MS.EXO.11.2nist-800-53-r5:AT-2b Literacy Training and Awarenessnist-800-53-r5:SI-8 Spam Protection |
| MITRE ATT&CK | T1566, T1684.001 |
| Reads from | Exchange Online, Microsoft Graph, Security & Compliance PowerShell |
| Licence needed | ATP_ENTERPRISE |
What this checks and how to fix it
Section titled “What this checks and how to fix it”User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.
Rationale: Many tasks are better suited for automated processes, such as identifying unusual characters in the FROM address or identifying a first-time sender. User warnings can handle these tasks, reducing the burden on end users and the risk of successful phishing attempts.
Remediation action
Section titled “Remediation action”- Sign in to Microsoft 365 Defender.
- In the left-hand menu, go to Email & Collaboration > Policies & Rules.
- Select Threat Policies.
- From the Templated policies section, select Preset Security Policies.
- Under Standard protection, slide the toggle switch to the right so the text next to the toggle reads Standard protection is on.
- Under Strict protection, slide the toggle switch to the right so the text next to the toggle reads Strict protection is on.
Note: If the toggle slider in step 5 is grayed out, click on Manage protection settings instead and configure the policy settings according to Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users | Microsoft Learn.
Related links
Section titled “Related links”- Defender admin center - Preset security policies
- CISA 11 Phishing Protections - MS.EXO.11.2v1
- CISA ScubaGear Rego Reference
- Microsoft Learn - Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365
Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.