# Standard Default Anti Phishing Policy

> The Standard Default Anti-Phishing Policy provides protection for all Exchange mailboxes, helping to detect and block phishing attempts and spoofed messages.

The Standard Default Anti-Phishing Policy provides protection for all Exchange mailboxes, helping to detect and block phishing attempts and spoofed messages. This policy leverages Microsoft anti-spoof intelligence and machine learning to identify suspicious senders and protect users from credential theft and impersonation attacks.

## Settings this baseline controls

| Setting                             | What it does                                                                                                                                                                                            |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy name                         | The Identity parameter specifies the anti-phish policy that you want to modify. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies) |
| First contact safety tip enabled    | Enables or disables first contact safety tip in email messages. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)                 |
| Authentication failure action       | Action to take when authentication fails (e.g., MoveToJmf, Quarantine). [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)         |
| Spoof quarantine policy             | Quarantine policy to apply for spoof detections. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)                                |
| Spoof intelligence enabled          | Enables or disables antispoofing protection. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)                                    |
| Via tag enabled                     | Enables or disables unauthenticated sender indicators in Outlook. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)               |
| Unauthenticated sender icon enabled | Controls whether to show the unauthenticated sender (?) indicator in Outlook. [Learn more](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies)   |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this baseline to the tenant to turn on Exchange Online's anti-phishing protection for every mailbox, or bundle it into a scheme you deploy to many tenants at once.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn on spoof intelligence.** Set **Spoof intelligence enabled** on so Microsoft's own detection catches a sender faking your domain or a trusted one, and set **Authentication failure action** to `Quarantine` for anything that fails.
3. **Set the spoof quarantine policy.** Set **Spoof quarantine policy** to `AdminOnlyAccessPolicy`, so only an admin can release a message caught by spoof detection, not the recipient.
4. **Turn on the visual warnings.** Turn on **First contact safety tip enabled**, **Via tag enabled** and **Unauthenticated sender icon enabled**. Together they add a warning the first time someone emails a recipient, a "via" note and a "?" icon on the sender's photo, giving users a visible cue on a message that looks legitimate but isn't fully authenticated.
5. **Save.** Turn on **Auto-remediation** ([Remediation](https://docs.octiga.io/baselines/remediation/)) if you want Octiga to reapply these settings whenever the Default policy changes. The safety tip, via tag and "?" icon appear for users when this baseline is applied, and disappear if it's removed.

## Check it worked

Passing means the Default anti-phishing policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under **Email & collaboration → Policies & rules → Threat policies → Anti-phishing**. End users notice the safety tip, via tag and unauthenticated-sender icon on suspicious messages in Outlook; a spoofed message is quarantined instead of delivered.

## Standards this addresses

### CIS

- **M365 2.1.7** — CIS M365 Foundations Benchmark 2.1.7
- **v8 9.7** — CIS Controls v8 Safeguard 9.7

### NIST

- **PR.DS-4** — NIST CSF 2.0 PR.DS-4
- **SI-2** — NIST SP 800-53 SI-2
- **SC-5** — NIST SP 800-53 SC-5

### ISO 27001

- **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)