ORCA
Office 365 Recommended Configuration Analyzer: checks of Exchange Online Protection and Defender for Office 365 settings.
67 checks: 9 High, 43 Medium, 11 Low, 4 Info.
| ID | Title | Severity | Product |
|---|---|---|---|
| ORCA.100 | Bulk Complaint Level threshold is between 4 and 6. | Low | Defender |
| ORCA.101 | Bulk is marked as spam. | Low | Defender |
| ORCA.102 | Advanced Spam filter options are turned off. | Low | Defender |
| ORCA.103 | Outbound spam filter policy settings configured. | Medium | Defender |
| ORCA.104 | High Confidence Phish action set to Quarantine message. | High | Defender |
| ORCA.105 | Safe Links Synchronous URL detonation is enabled. | Medium | Defender |
| ORCA.106 | Quarantine retention period is 30 days. | Low | Defender |
| ORCA.107 | End-user spam notification is enabled. | Low | Defender |
| ORCA.108 | DKIM signing is set up for all your custom domains. | Medium | Defender |
| ORCA.108.1 | DNS Records have been set up to support DKIM. | Medium | Defender |
| ORCA.109 | Senders are not being allow listed in an unsafe manner. | Medium | Defender |
| ORCA.110 | Internal Sender notifications are disabled. | Low | Defender |
| ORCA.111 | Anti-phishing policy exists and EnableUnauthenticatedSender is true. | Medium | Defender |
| ORCA.112 | Anti-spoofing protection action is configured to Move message to the recipients’ Junk Email folders in Anti-phishing policy. | Medium | Defender |
| ORCA.113 | AllowClickThrough is disabled in Safe Links policies. | Medium | Defender |
| ORCA.114 | No IP Allow Lists have been configured. | Medium | Defender |
| ORCA.115 | Mailbox intelligence based impersonation protection is enabled in anti-phishing policies. | Medium | Defender |
| ORCA.116 | Mailbox intelligence based impersonation protection action set to move message to junk mail folder. | Medium | Defender |
| ORCA.118.1 | Domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | Defender |
| ORCA.118.2 | Domains are not being allow listed in an unsafe manner in Transport Rules. | High | Defender |
| ORCA.118.3 | Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | Defender |
| ORCA.118.4 | Your own domains are not being allow listed in an unsafe manner in Transport Rules. | High | Defender |
| ORCA.119 | Similar Domains Safety Tips is enabled. | Info | Defender |
| ORCA.120.1 | Zero Hour Autopurge Enabled for Phish. | Medium | Defender |
| ORCA.120.2 | Zero Hour Autopurge Enabled for Malware. | Medium | Defender |
| ORCA.120.3 | Zero Hour Autopurge Enabled for Spam. | Medium | Defender |
| ORCA.121 | Supported filter policy action used. | Medium | Defender |
| ORCA.123 | Unusual Characters Safety Tips is enabled. | Info | Defender |
| ORCA.124 | Safe attachments unknown malware response set to block messages. | High | Defender |
| ORCA.139 | Spam action set to move message to junk mail folder or quarantine. | Low | Defender |
| ORCA.140 | High Confidence Spam action set to Quarantine message. | Medium | Defender |
| ORCA.141 | Bulk action set to Move message to Junk Email Folder. | Low | Defender |
| ORCA.142 | Phish action set to Quarantine message. | Medium | Defender |
| ORCA.143 | Safety Tips are enabled. | Info | Defender |
| ORCA.156 | Safe Links Policies are tracking when user clicks on safe links. | Medium | Defender |
| ORCA.158 | Safe Attachments is enabled for SharePoint and Teams. | Medium | Defender |
| ORCA.179 | Safe Links is enabled intra-organization. | Medium | Defender |
| ORCA.180 | Anti-phishing policy exists and EnableSpoofIntelligence is true. | Medium | Defender |
| ORCA.189 | Safe Attachments is not bypassed. | Medium | Defender |
| ORCA.189.2 | Safe Links is not bypassed. | High | Defender |
| ORCA.205 | Common attachment type filter is enabled. | Medium | Defender |
| ORCA.220 | Advanced Phish filter Threshold level is adequate. | Medium | Defender |
| ORCA.221 | Mailbox intelligence is enabled in anti-phishing policies. | Medium | Defender |
| ORCA.222 | Domain Impersonation action is set to move to Quarantine. | Medium | Defender |
| ORCA.223 | User impersonation action is set to move to Quarantine. | Medium | Defender |
| ORCA.224 | Similar Users Safety Tips is enabled. | Info | Defender |
| ORCA.225 | Safe Documents is enabled for Office clients. | Medium | Defender |
| ORCA.226 | Each domain has a Safe Link policy applied to it. | Medium | Defender |
| ORCA.227 | Each domain has a Safe Attachments policy applied to it. | Medium | Defender |
| ORCA.228 | No trusted senders in Anti-phishing policy. | Medium | Defender |
| ORCA.229 | No trusted domains in Anti-phishing policy. | Medium | Defender |
| ORCA.230 | Each domain has a Anti-phishing policy applied to it, or the default policy is being used. | Low | Defender |
| ORCA.231 | Each domain has a anti-spam policy applied to it, or the default policy is being used. | Low | Defender |
| ORCA.232 | Each domain has a malware filter policy applied to it, or the default policy is being used. | Low | Defender |
| ORCA.233 | Domains are pointed directly at EOP or enhanced filtering is used. | Medium | Defender |
| ORCA.233.1 | Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors. | Medium | Defender |
| ORCA.234 | Click through is disabled for Safe Documents. | Medium | Defender |
| ORCA.235 | SPF records is set up for all your custom domains. | Medium | Defender |
| ORCA.236 | Safe Links is enabled for emails. | Medium | Defender |
| ORCA.237 | Safe Links is enabled for teams messages. | Medium | Defender |
| ORCA.238 | Safe Links is enabled for office documents. | Medium | Defender |
| ORCA.239 | No exclusions for the built-in protection policies. | High | Defender |
| ORCA.240 | Outlook is configured to display external tags for external emails. | Medium | Defender |
| ORCA.241 | Anti-phishing policy exists and EnableFirstContactSafetyTips is true. | Medium | Defender |
| ORCA.242 | Important protection alerts responsible for AIR activities are enabled. | High | Defender |
| ORCA.243 | Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO. | Medium | Defender |
| ORCA.244 | Policies are configured to honor sending domains DMARC. | Medium | Defender |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.