How to check preset security policies in Microsoft Defender

Before you start

Use an account with read access: the Global Reader role group in Exchange Online, or the Microsoft Entra Global Reader or Security Administrator role. Where Defender XDR unified role-based access control is active for email and collaboration, Core Security settings (read) also opens the portal page, but not PowerShell.

Standard and Strict work in every organisation with cloud mailboxes, through Exchange Online Protection. Microsoft 365 E5 or a Defender for Office 365 add-on adds a second rule to each preset, and brings built-in protection: Safe Links and Safe Attachments for everyone that no preset or custom policy of those kinds covers. The rules are read as they stand now. The examples read and export; they change nothing.

Option 1

Check preset security policies with PowerShell

Install the module once, then connect and export every preset rule.

# Install once, if the module is not already installed.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'

# Turns 1 rule into a row: its state, who it covers and who it leaves out.
function ConvertTo-PresetRow ($Rule, [string] $Protection) {
    $covers = @($Rule.SentTo) + @($Rule.SentToMemberOf) + @($Rule.RecipientDomainIs)
    $except = @($Rule.ExceptIfSentTo) + @($Rule.ExceptIfSentToMemberOf) +
        @($Rule.ExceptIfRecipientDomainIs)
    $covers = @($covers | Where-Object { $_ })
    $except = @($except | Where-Object { $_ })
    [pscustomobject]@{
        Policy     = $Rule.Name
        Protection = $Protection
        State      = $Rule.State
        AppliesTo  = if ($covers.Count -gt 0) { $covers -join '; ' } else { 'All recipients' }
        Exceptions = if ($except.Count -gt 0) { $except -join '; ' } else { 'None' }
    }
}

Connect-ExchangeOnline -ShowBanner:$false
try {
    $rows = @(Get-EOPProtectionPolicyRule |
        ForEach-Object { ConvertTo-PresetRow $_ 'Exchange Online Protection' })
    # The Defender for Office 365 rules, in organisations that have it.
    if (Get-Command Get-ATPProtectionPolicyRule -ErrorAction SilentlyContinue) {
        $rows += @(Get-ATPProtectionPolicyRule |
            ForEach-Object { ConvertTo-PresetRow $_ 'Defender for Office 365' })
    }
    if ($rows.Count -eq 0) {
        Write-Output 'No preset rules exist: Standard and Strict have never been turned on.'
    } else {
        $rows | Sort-Object Policy, Protection |
            Export-Csv -Path './preset-security-policies.csv' -NoTypeInformation -Encoding utf8
        $rows | Format-Table Policy, Protection, State
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row for each rule: its name, protection, state, who it covers and who it leaves out. A rule with no recipient conditions covers all recipients, and different kinds of condition must all match. To check 1 preset, add -Identity 'Strict Preset Security Policy' to both rule commands.

Check built-in protection

Built-in protection has 1 rule, always on, that holds only exceptions. Reconnect with Connect-ExchangeOnline first, since the export above disconnects.

# Run while connected to Exchange Online, in an organisation with Defender for Office 365.
Get-ATPBuiltInProtectionRule |
    Select-Object Name, ExceptIfSentTo, ExceptIfSentToMemberOf, ExceptIfRecipientDomainIs

Empty exceptions mean nobody is left out.

Option 2

Review preset security policies in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Go to Email & collaboration > Policies & rules > Threat policies > Preset Security Policies.
3. Read whether Standard protection and Strict protection are on. Leave the toggles alone: each turns its preset on or off.
4. For a preset that is on, select Manage protection settings to see who it includes and excludes, then close the wizard without selecting Confirm.
5. Under Built-in protection, Add exclusions (not recommended) shows who it leaves out. Close it without selecting Save.

This suits a quick look at 1 tenant. For a record to keep and compare month to month, use PowerShell or a report.

Common questions

Why does Get-EOPProtectionPolicyRule return nothing?

A preset's rules are created the first time someone turns it on in the Defender portal, so a tenant that never has has none to read. Turning a preset off keeps its rules, with the state Disabled.

Someone is in Strict, Standard and a custom policy. Which applies?

Strict first, then Standard, then Defender for Office 365 evaluation policies, then custom policies by priority, and last built-in protection and the default policies. For the people a preset covers, its settings win over any custom policy.

Do the presets cover all of email protection?

No. Outbound spam policies are not part of them, and impersonation protection for named people needs those people added to the preset. For a wider view of what to improve, see how to check Secure Score.