M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.14.2 requires that spam and high confidence spam be moved to either the junk email folder or quarantine. Delivering spam to the inbox defeats the purpose of filtering and increases exposure to malicious content. The anti-spam policy actions must route detected spam away from the inbox while preserving user review of false positives.
Recommended value
SpamAction and HighConfidenceSpamAction set to MoveToJmf (junk) or Quarantine; never set to deliver to inbox
Remediation
Configure the anti-spam policy so the spam and high confidence spam actions move messages to the junk email folder or quarantine rather than delivering them to the inbox. Verify neither action is set to add a header and deliver. Confirm the policy applies to all recipients so spam routing is consistent.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566