# Preset EOP Policy (Strict)

> Applies Microsoft's Strict preset EOP policy, delivering a higher level of anti-spam, anti-malware, and anti-phishing protection.

Applies Microsoft's Strict preset EOP policy, delivering a higher level of anti-spam, anti-malware, and anti-phishing protection. All settings are controlled and updated automatically by Microsoft.

## Settings this baseline controls

| Setting        | What it does                                                                                                                                                                           |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy enabled | The state of the preset security policy (Enabled or Disabled). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-eopprotectionpolicyrule?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns on Microsoft's Strict preset security policy.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn the profile on.** Set **Policy enabled** on. The Strict preset security policy is a more aggressive fixed bundle of anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments settings than the Standard profile, maintained by Microsoft rather than configured individually.
3. **Assign it to your highest-value accounts only, in Microsoft 365 first.** Turning the profile on doesn't put anyone in it; assign users, groups or domains to the Strict preset security policy in the Microsoft Defender portal. Microsoft recommends this profile for the accounts most worth targeting (executives, their support staff and admins), and only where someone is available to review and release mail the stricter settings hold back.
4. **Check for overlap with your other baselines.** Strict is evaluated before every other policy, including the Standard preset and any custom anti-spam, anti-malware, anti-phishing, Safe Links or Safe Attachments baseline you deploy, such as [Anti Malware Policy (Default)](https://docs.octiga.io/baselines/email-security/anti-malware-policy/) or [Safe Attachments Policy (Octiga)](https://docs.octiga.io/baselines/email-security/safe-attachment-policy/). For anyone assigned to Strict, those settings are ignored, not merged.
5. **Save.** Turn on **Auto-remediation** if you want Octiga to turn the profile back on whenever it's disabled (see [Remediation](https://docs.octiga.io/baselines/remediation/)).

> **Caution:** Strict flags more borderline mail than Standard does. Assign it only to accounts with an admin available to review and release the messages it holds back; otherwise legitimate mail can sit unreviewed in quarantine.

## Check it worked

Passing means the Strict preset security policy shows Enabled. Check the assignment and the settings it applies in the Microsoft Defender portal, under **Email & collaboration → Policies & rules → Threat policies → Preset security policies**. Assigned users see more borderline mail quarantined or held than under Standard, and may need an admin to release messages more often.

## Standards this addresses

### CIS

- **M365 2.1.4** — CIS M365 Foundations Benchmark 2.1.4
- **M365 2.1.7** — CIS M365 Foundations Benchmark 2.1.7
- **v8 9.7** — CIS Controls v8 Safeguard 9.7

### NIST

- **PR.DS-4** — NIST CSF 2.0 PR.DS-4
- **SI-3** — NIST SP 800-53 SI-3
- **SC-7** — NIST SP 800-53 SC-7

### ISO 27001

- **A.8.7** — ISO/IEC 27001:2022 Annex A.8.7
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)