Exchange Online
50 checks from CIS Microsoft 365 Foundations Benchmark, CISA SCuBA baselines, Mito: 17 High, 29 Medium, 4 Low.
| ID | Title | Severity | Suite |
|---|---|---|---|
| CIS.M365.6.5.3 | Ensure additional storage providers are restricted in Outlook on the web | Medium | CIS Microsoft 365 Foundations Benchmark |
| CISA.MS.EXO.1.1 | Automatic forwarding to external domains SHALL be disabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.2.1 | A list of approved IP addresses for sending mail SHALL be maintained. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.2.2 | An SPF policy SHALL be published for each domain, designating only these addresses as approved senders. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.3.1 | DKIM SHOULD be enabled for all domains. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.4.1 | A DMARC policy SHALL be published for every second-level domain. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.4.2 | The DMARC message rejection option SHALL be p=reject. | High | CISA SCuBA baselines |
| CISA.MS.EXO.4.3 | The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.5.1 | SMTP AUTH SHALL be disabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.6.1 | Contact folders SHALL NOT be shared with all domains. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.6.2 | Calendar details SHALL NOT be shared with all domains. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.7.1 | External sender warnings SHALL be implemented. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.8.1 | A DLP solution SHALL be used. | High | CISA SCuBA baselines |
| CISA.MS.EXO.8.2 | The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.8.3 | The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.8.4 | At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email. | High | CISA SCuBA baselines |
| CISA.MS.EXO.9.1 | Emails SHALL be filtered by attachment file types. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.9.2 | The attachment filter SHOULD attempt to determine the true file type and assess the file extension. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.9.3 | Disallowed file types SHALL be determined and enforced. | High | CISA SCuBA baselines |
| CISA.MS.EXO.9.4 | Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender’s Common Attachment Filter. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.9.5 | At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe). | High | CISA SCuBA baselines |
| CISA.MS.EXO.10.1 | Emails SHALL be scanned for malware. | High | CISA SCuBA baselines |
| CISA.MS.EXO.10.2 | Emails identified as containing malware SHALL be quarantined or dropped. | High | CISA SCuBA baselines |
| CISA.MS.EXO.10.3 | Email scanning SHALL be capable of reviewing emails after delivery. | High | CISA SCuBA baselines |
| CISA.MS.EXO.11.1 | Impersonation protection checks SHOULD be used. | High | CISA SCuBA baselines |
| CISA.MS.EXO.11.2 | User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.11.3 | The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.12.1 | IP allow lists SHOULD NOT be created. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.12.2 | Safe lists SHOULD NOT be enabled. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.13.1 | Mailbox auditing SHALL be enabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.14.1 | A spam filter SHALL be enabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.14.2 | Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.14.3 | Allowed domains SHALL NOT be added to inbound anti-spam protection policies. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.14.4 | If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.15.1 | URL comparison with a block-list SHOULD be enabled. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.15.2 | Direct download links SHOULD be scanned for malware. | High | CISA SCuBA baselines |
| CISA.MS.EXO.15.3 | User click tracking SHOULD be enabled. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.16.1 | Alerts SHALL be enabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.16.2 | Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.17.1 | Microsoft Purview Audit (Standard) logging SHALL be enabled. | High | CISA SCuBA baselines |
| CISA.MS.EXO.17.2 | Microsoft Purview Audit (Premium) logging SHALL be enabled. | Medium | CISA SCuBA baselines |
| CISA.MS.EXO.17.3 | Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C). | Medium | CISA SCuBA baselines |
| MT.1039 | Ensure MailTips are enabled for end users | Low | Mito |
| MT.1041 | Ensure users installing Outlook add-ins is not allowed | Medium | Mito |
| MT.1043 | Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains | Medium | Mito |
| MT.1044 | Ensure modern authentication for Exchange Online is enabled | High | Mito |
| MT.1062 | Ensure Direct Send is set to be rejected | Medium | Mito |
| MT.1074 | Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain | Low | Mito |
| MT.1076 | MOERA SHOULD NOT be used for sent mail | Low | Mito |
| MT.1083 | Ensure Delicensing Resiliency is enabled | Low | Mito |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.