Exchange Standards
Low Impact
Enables DKIM for all domains that currently support it
Enables DKIM for all domains that currently support it
"CIS"
New-DkimSigningConfig and Set-DkimSigningConfig
AddDKIM
Enable Auto-expanding archives
Enables auto-expanding archives for the tenant. Does not enable archives for users.
Set-OrganizationConfig -AutoExpandingArchive
AutoExpandArchive
Set Sharing Level for Default calendar
Sets the default sharing level for the default calendar for all users in the tenant. You can read about the different sharing levels here.
Set-MailboxFolderPermission
calDefault
Set Cloud Message Recall state
Sets the default state for Cloud Message Recall for the tenant. By default this is enabled. You can read more about the feature here.
Set-OrganizationConfig -MessageRecallEnabled
CloudMessageRecall
Disable additional storage providers in OWA
Disables additional storage providers in OWA. This is to prevent users from using personal storage providers like Dropbox, Google Drive, etc. Usually this has little user impact.
"CIS"
Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -AdditionalStorageProvidersEnabled $False
DisableAdditionalStorageProviders
Disable external calendar sharing
Disables external calendar sharing for the entire tenant. This is not a widely used feature, and it's therefore unlikely that this will impact users. Only for the default policy, so exclusions can be made if needed by making a new policy and assigning it to users.
"CIS"
Get-SharingPolicy | Set-SharingPolicy -Enabled $False
DisableExternalCalendarSharing
Disable TNEF/winmail.dat
Disables Transport Neutral Encapsulation Format (TNEF)/winmail.dat for the tenant. TNEF can cause issues if the recipient is not using a client supporting TNEF. Cannot be overridden by the user. For more information, see Microsoft's documentation.
Set-RemoteDomain -Identity 'Default' -TNEFEnabled $false
DisableTNEF
Disable daily Insight/Viva reports
Disables the daily viva reports for all users.
Set-UserBriefingConfig
DisableViva
Enable Litigation Hold for all users
Enables litigation hold for all UserMailboxes with a valid license.
Set-Mailbox -LitigationHoldEnabled $true
EnableLitigationHold
Enable Mailbox auditing
Enables mailbox auditing on tenant level and for all mailboxes. Disables audit bypass on all mailboxes. By default Microsoft does not enable mailbox auditing for Resource Mailboxes, Public Folder Mailboxes and DiscoverySearch Mailboxes. Unified Audit Log needs to be enabled for this standard to function.
"CIS"
Set-OrganizationConfig -AuditDisabled $false
EnableMailboxAuditing
Enable all MailTips
Enables all MailTips in Outlook. MailTips are the notifications Outlook and Outlook on the web shows when an email you create, meets some requirements
"CIS"
Set-OrganizationConfig
EnableMailTips
Enable Online Archive for all users
Enables the In-Place Online Archive for all UserMailboxes with a valid license.
Enable-Mailbox -Archive $true
EnableOnlineArchiving
Set Focused Inbox state
Sets the default Focused Inbox state for the tenant. This can be overridden by the user in their Outlook settings. For more information, see Microsoft's documentation.
Set-OrganizationConfig -FocusedInboxOn $true or $false
FocusedInbox
Set Global Quarantine Notification Interval
Sets the global quarantine notification interval for the tenant. This is the time between the quarantine notification emails are sent out to users. Default is 24 hours.
Set-QuarantinePolicy -EndUserSpamNotificationFrequency
GlobalQuarantineNotifications
Lower Transport Message Expiration to 12 hours
Expires messages in the transport queue after 12 hours. Makes the NDR for failed messages show up faster for users. Default is 24 hours.
Set-TransportConfig -MessageExpirationTimeout 12.00:00:00
MessageExpiration
Set Outbound Spam Alert e-mail
Sets the e-mail address to which outbound spam alerts are sent.
"CIS"
Set-HostedOutboundSpamFilterPolicy
OutBoundSpamAlert
Rotate DKIM keys that are 1024 bit to 2048 bit
Rotate DKIM keys that are 1024 bit to 2048 bit
"CIS"
Rotate-DkimSigningConfig
RotateDKIM
Set send/receive size limits
Sets the Send and Receive limits for new users. Valid values are 1MB to 150MB
Set-MailboxPlan
SendReceiveLimitTenant
Enable or disable 'external' warning in Outlook
Adds or removes indicators to e-mail messages received from external senders in Outlook. You can read more about this feature on Microsoft's Exchange Team Blog.
"CIS"
et-ExternalInOutlook –Enabled $true or $false
SpoofWarn
Set Teams Meetings by default state
Sets the default state for automatically turning meetings into Teams meetings for the tenant. This can be overridden by the user in Outlook.
Set-OrganizationConfig -OnlineMeetingsByDefaultEnabled
TeamsMeetingsByDefault
Medium Impact
Set Bookings state
Sets the state of Bookings on the tenant. Bookings is a scheduling tool that allows users to book appointments with others both internal and external.
Set-OrganizationConfig -BookingsEnabled
Bookings
Set mailbox Sent Items delegation (Sent items for shared mailboxes)
This makes sure that e-mails sent from shared mailboxes or delegate mailboxes, end up in the mailbox of the shared/delegate mailbox instead of the sender, allowing you to keep replies in the same mailbox as the original e-mail.
Set-Mailbox
DelegateSentItems
Disable users from installing add-ins in Outlook
Disables users from being able to install add-ins in Outlook. Only admins are able to approve add-ins for the users. This is done to reduce the threat surface for data exfiltration.
"CIS"
Get-ManagementRoleAssignment | Remove-ManagementRoleAssignment
DisableOutlookAddins
Disable Shared Mailbox AAD accounts
Shared mailboxes can be directly logged into if the password is reset, this presents a security risk as do all shared login credentials. Microsoft's recommendation is to disable the user account for shared mailboxes. It would be a good idea to review the sign-in reports to establish potential impact.
"CIS"
Get-Mailbox & Update-MgUser
DisableSharedMailbox
Remove Safe Senders to prevent SPF bypass
Loops through all users and removes the Safe Senders list. This is to prevent SPF bypass attacks, as the Safe Senders list is not checked by SPF.
Set-MailboxJunkEmailConfiguration
SafeSendersDisable
Allow users to send from their alias addresses
Allows users to change the 'from' address to any set in their Azure AD Profile.
Set-Mailbox
SendFromAlias
Set shorten meetings state
Sets the shorten meetings settings on a tenant level. This will shorten meetings by the selected amount of minutes. Valid values are 0 to 29. Short meetings are under 60 minutes, long meetings are over 60 minutes.
Set-OrganizationConfig -ShortenEventScopeDefault -DefaultMinutesToReduceShortEventsBy -DefaultMinutesToReduceLongEventsBy
ShortenMeetings
Set the state of the built-in Report button in Outlook
Set the state of the built-in Report button in Outlook. This gives the users the ability to report emails as spam or phish.
New-ReportSubmissionPolicy or Set-ReportSubmissionPolicy and New-ReportSubmissionRule or Set-ReportSubmissionRule
UserSubmissions
High Impact
Disable automatic forwarding to external recipients
Disables the ability for users to automatically forward e-mails to external recipients. This is to prevent data exfiltration. Please check if there are any legitimate use cases for this feature before implementing, like forwarding invoices and such.
"CIS"
Set-HostedOutboundSpamFilterPolicy -AutoForwardingMode 'Off'
EXODisableAutoForwarding
Last updated