M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.11.2 recommends that user warnings comparable to EOP safety tips be displayed. Safety tips surface automated signals (unusual characters in the FROM address, first-contact senders) directly in the client, prompting caution at the moment of risk. This offloads detection work from users and reduces successful phishing.
Valor recomendado
Anti-phish policy with first-contact safety tips and spoof/impersonation safety tips enabled
Remediación
Enable the safety tip options in the anti-phish policy, including first-contact safety tips and spoof and impersonation safety tips, so users receive in-client warnings. Apply the policy to all users. Where a comparable third-party solution is used, confirm it presents equivalent recipient-facing warnings.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566