Preset EOP Policy (Standard)
Applies Microsoft’s Standard preset EOP policy, providing a managed baseline of spam, malware, and phishing protection. Settings are maintained by Microsoft.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy enabled | The state of the preset security policy (Enabled or Disabled). Learn more |
Configure it
This baseline turns on Microsoft’s Standard preset security policy.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn the profile on.
Set Policy enabled on. The Standard preset security policy is a fixed bundle of anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments settings that Microsoft maintains and updates for you, rather than settings you configure individually.
-
Assign who it covers, in Microsoft 365 first.
Turning the profile on doesn’t put anyone in it. Assign users, groups or domains to the Standard preset security policy in the Microsoft Defender portal; until then, it protects no one.
-
Check for overlap with your other baselines.
The Standard preset policy is evaluated before any custom anti-spam, anti-malware, anti-phishing, Safe Links or Safe Attachments policy, including Anti Malware Policy (Default), Standard Default Anti Phishing Policy, Safe Links Policy (Octiga) and Safe Attachments Policy (Octiga). For anyone assigned to this preset, those baselines’ settings are ignored, not merged.
-
Save.
Turn on Auto-remediation if you want Octiga to turn the profile back on whenever it’s disabled (see Remediation). Anyone assigned to the profile gets Microsoft’s recommended protection level in full.
Check it worked
Passing means the Standard preset security policy shows Enabled. Check the assignment and the settings it applies in the Microsoft Defender portal, under Email & collaboration → Policies & rules → Threat policies → Preset security policies. Users assigned to it get the same visible effects as the individual protections it bundles (quarantined malware and phishing, scanned links and attachments) without you configuring each one separately.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.