M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.14.1 requires that a spam filter be enabled, comparable to the native spam filtering. Spam clutters mailboxes, reduces productivity, and often carries malicious links or attachments. An organization with no active inbound spam policy leaves users exposed to the full volume of unsolicited and potentially malicious mail.
Recommended value
At least one active hosted content (anti-spam) filter policy applied to all recipients
Remediation
Confirm at least one inbound anti-spam (hosted content filter) policy is active and applied to all recipients. If using a comparable third-party gateway, verify it is enabled for all inbound mail. Review spam action thresholds to ensure aggressive bulk and spam senders are filtered.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| empty | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566