# Malware Internal Sender Filter Notification Policy - DEPRECATED

> Sends an alert when an internal user is blocked from sending malware, helping identify potentially compromised accounts quickly.

Sends an alert when an internal user is blocked from sending malware, helping identify potentially compromised accounts quickly.

## Settings this baseline controls

| Setting                               | What it does                                                                                                                                                                                                     |
| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Internal sender notifications enabled | Enables or disables admin notifications when an internal sender is detected sending malware. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps) |
| Internal sender notification email    | Email address to receive internal sender malware notifications. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-malwarefilterpolicy?view=exchange-ps)                              |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline checks only the internal-sender notification setting in the Default anti-malware policy, the same policy [Anti Malware Policy (Default)](https://docs.octiga.io/baselines/email-security/anti-malware-policy/) checks in full.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Leave internal sender notifications off.** Leave **Internal sender notifications enabled** off. A compromised internal account already shows up in the anti-malware policy's blocking, without also generating a separate notification email every time.
3. **Save.** Turn on **Auto-remediation** if you want Octiga to reapply this whenever the Default policy changes (see [Remediation](https://docs.octiga.io/baselines/remediation/)).

## Check it worked

Passing means the Default anti-malware policy in Exchange Online has internal sender admin notifications turned off. Check it in the Microsoft Defender portal, under **Email & collaboration → Policies & rules → Threat policies → Anti-malware**, alongside [Anti Malware Policy (Default)](https://docs.octiga.io/baselines/email-security/anti-malware-policy/). Users see no difference either way.

## Standards this addresses

### CIS

- **M365 2.1.2** — CIS M365 Foundations Benchmark 2.1.2
- **v8 10.1** — CIS Controls v8 Safeguard 10.1

### NIST

- **DE.CM-7** — NIST CSF 2.0 DE.CM-7
- **SI-3** — NIST SP 800-53 SI-3
- **SI-4** — NIST SP 800-53 SI-4

### ISO 27001

- **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7
- **A.8.16** — ISO/IEC 27001:2022 Annex A.8.16

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)