What are the implications of Office 365‎ protection?

Posted by Aim_Fire_Ready@reddit | sysadmin | View on Reddit | 2 comments

I'm not a big fan of presets until I know what the effects will be. I just logged in to the Microsoft 365 Admin Console, and it says "Finish setting up your account". \*confused look\* This tenant was created 14 years ago by a zealous but not very tech-savvy early employee, and I started working with them last year. So, I curiously clicked through and I see these 3 sections under [Preset security policies](https://security.microsoft.com/presetSecurityPolicies): * Note: Built-in protection is enabled only for paid Microsoft Defender for Office 365 tenants. (doesn't say if it's on or not, but it seems to imply that it's on) * Standard protection is off * Strict protection is off Help me to understand this so I know if this should have been turned on Day 1, or we need part of it, or if it will ruin everything (doubtful but always possible). Context: I'm a lifelong power user, self-taught in SOHO envs and lots of online studying, and I have no seniors or peers to ask IRL. Roast me if you have to, but FWIW, I clicked the Learn More link and it took me here: [https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies) . I'm looking for an idea of how this fits into our env more than the technical execution.

2 Comments

[-]

VexedTruly@reddit

The presets are nice set and forget solutions that can dramatically increase your protection by enabling safelinks, block common attachment types, SCL tweaks etc but lack any customization options. The article you linked tells you exactly what it sets. Real world - switching this on when you’ve only ever used the EOP defaults- you need to be aware that the standard preset will quarantine high confidence spam (with daily quarantine notifications) and quarantine high confidence phishing (only an admin can release) and will also reject docx and xlsm emails (yes reject, not quarantine) and a bunch of other bad attachment types. Those are the most common issues, you cannot make exceptions for this. If you alter the preset via powershell it will get replaced again by MS sooner or later. The bright side? MS keep the policy updated with “their” best practices. The strict preset is exactly what it sounds like, the SCL threshold is lowered and pretty much everything is quarantined rather than using the junk folder.

Electrical_Arm7411@reddit

My understanding is based on your selection: Standard or strict, turning the setting on creates "Default Threat Policies" for you. Eg. Anti-Phishing, Anti-Spam, Anti-Malware, Safe Attachments, Safe Links. If you already have the policies defined I wouldn't bother enabling and instead review / modify your existing policies or if you don't have a policy defined, create one manually. Reason I suggest manually creating them is you have better control on policy priority. In that article it says the Standard / Strict polices that are made for you always take priority. *"(the Standard and Strict preset security policies are always applied first)."*

Reply to Post

2 Comments