# Preset EOP Policy (Standard)

> Applies Microsoft's Standard preset EOP policy, providing a managed baseline of spam, malware, and phishing protection.

Applies Microsoft's Standard preset EOP policy, providing a managed baseline of spam, malware, and phishing protection. Settings are maintained by Microsoft.

## Settings this baseline controls

| Setting        | What it does                                                                                                                                                                           |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy enabled | The state of the preset security policy (Enabled or Disabled). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-eopprotectionpolicyrule?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns on Microsoft's Standard preset security policy.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn the profile on.** Set **Policy enabled** on. The Standard preset security policy is a fixed bundle of anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments settings that Microsoft maintains and updates for you, rather than settings you configure individually.
3. **Assign who it covers, in Microsoft 365 first.** Turning the profile on doesn't put anyone in it. Assign users, groups or domains to the Standard preset security policy in the Microsoft Defender portal; until then, it protects no one.
4. **Check for overlap with your other baselines.** The Standard preset policy is evaluated before any custom anti-spam, anti-malware, anti-phishing, Safe Links or Safe Attachments policy, including [Anti Malware Policy (Default)](https://docs.octiga.io/baselines/email-security/anti-malware-policy/), [Standard Default Anti Phishing Policy](https://docs.octiga.io/baselines/email-security/anti-phish-policy/), [Safe Links Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-links-policy/) and [Safe Attachments Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-attachment-policy/). For anyone assigned to this preset, those baselines' settings are ignored, not merged.
5. **Save.** Turn on **Auto-remediation** if you want Octiga to turn the profile back on whenever it's disabled (see [Remediation](https://docs.octiga.io/baselines/remediation/)). Anyone assigned to the profile gets Microsoft's recommended protection level in full.

## Check it worked

Passing means the Standard preset security policy shows Enabled. Check the assignment and the settings it applies in the Microsoft Defender portal, under **Email & collaboration → Policies & rules → Threat policies → Preset security policies**. Users assigned to it get the same visible effects as the individual protections it bundles (quarantined malware and phishing, scanned links and attachments) without you configuring each one separately.

## Standards this addresses

### CIS

- **M365 2.1.4** — CIS M365 Foundations Benchmark 2.1.4
- **M365 2.1.7** — CIS M365 Foundations Benchmark 2.1.7
- **v8 9.7** — CIS Controls v8 Safeguard 9.7

### NIST

- **PR.DS-4** — NIST CSF 2.0 PR.DS-4
- **SI-3** — NIST SP 800-53 SI-3
- **SC-7** — NIST SP 800-53 SC-7

### ISO 27001

- **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)