Preset EOP Policy (Strict)

Applies Microsoft’s Strict preset EOP policy, delivering a higher level of anti-spam, anti-malware, and anti-phishing protection. All settings are controlled and updated automatically by Microsoft.

Settings this baseline controls

Setting	What it does
Policy enabled	The state of the preset security policy (Enabled or Disabled). Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline turns on Microsoft’s Strict preset security policy.

1. Add the baseline.

   Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).

2. Turn the profile on.

   Set Policy enabled on. The Strict preset security policy is a more aggressive fixed bundle of anti-spam, anti-malware, anti-phishing, Safe Links and Safe Attachments settings than the Standard profile, maintained by Microsoft rather than configured individually.

3. Assign it to your highest-value accounts only, in Microsoft 365 first.

   Turning the profile on doesn’t put anyone in it; assign users, groups or domains to the Strict preset security policy in the Microsoft Defender portal. Microsoft recommends this profile for the accounts most worth targeting (executives, their support staff and admins), and only where someone is available to review and release mail the stricter settings hold back.

4. Check for overlap with your other baselines.

   Strict is evaluated before every other policy, including the Standard preset and any custom anti-spam, anti-malware, anti-phishing, Safe Links or Safe Attachments baseline you deploy, such as Anti Malware Policy (Default) or Safe Attachments Policy (Octiga). For anyone assigned to Strict, those settings are ignored, not merged.

5. Save.

   Turn on Auto-remediation if you want Octiga to turn the profile back on whenever it’s disabled (see Remediation).

Caution

Strict flags more borderline mail than Standard does. Assign it only to accounts with an admin available to review and release the messages it holds back; otherwise legitimate mail can sit unreviewed in quarantine.

Check it worked

Passing means the Strict preset security policy shows Enabled. Check the assignment and the settings it applies in the Microsoft Defender portal, under Email & collaboration → Policies & rules → Threat policies → Preset security policies. Assigned users see more borderline mail quarantined or held than under Standard, and may need an admin to release messages more often.

Standards this addresses

CISM365 2.1.4M365 2.1.7v8 9.7

NISTPR.DS-4SI-3SC-7

ISO 27001A.8.7A.8.24

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→