What are Microsoft 365 preset security policies, and should you use them?

Microsoft 365 has dozens of threat policy settings, and Microsoft's own advice is that most organizations shouldn't tune them one by one. Preset security policies apply Microsoft's recommended values in one step. The catch is precedence: once a user is in a preset, many of your custom settings stop applying to them, often without anyone noticing.

This guide covers what each preset includes, how they interact with your other policies, how to assign them, and when custom policies are the better choice.

What are the three preset security policies?

Microsoft describes preset security policies as applying "many email protection features to users based on our recommended settings", where "virtually all of the settings ... aren't configurable" (Microsoft Learn).

You'll find them in the Microsoft Defender portal at Email & collaboration > Policies & rules > Threat policies > Preset Security Policies in the Templated policies section, or https://security.microsoft.com/presetSecurityPolicies. You need the Organization Management or Security Administrator role group, or the Entra Security Administrator role.

What does each preset cover, and what does it leave out?

Standard and Strict create special versions of the individual threat policies the first time you turn them on:

Presets don't touch several things, so you still own them:

• Outbound spam policies. Microsoft states they "aren't part of preset security policies". Set limits and forwarding yourself; see Microsoft 365 anti-spam policies.
• The connection filter policy, including the IP Allow List.
• The Tenant Allow/Block List.
• Mail flow rules, including any SCL -1 bypass rules.
• Quarantine notification frequency and branding, set in the quarantine policies' global settings.
• Global Safe Attachments settings for SharePoint, OneDrive and Teams. Built-in protection sets these; Standard and Strict don't.

How do Standard and Strict differ?

Most settings are identical, especially for clearly harmful mail like malware and high confidence phishing. Microsoft lists the meaningful differences:

High confidence spam and phishing are quarantined in both. Strict mainly moves grey mail from Junk Email into quarantine, so it creates more quarantine to review. For the full value-by-value table including the default policy, see Microsoft's recommended settings.

Built-in protection differs from both in Safe Links: it doesn't rewrite URLs, allows click-through and skips internal messages. Our guide to Safe Links and Safe Attachments explains why that matters.

Which policy wins when several apply?

This is the part that surprises admins. For a recipient in more than one policy, Microsoft applies them in this order (Microsoft Learn):

1. The Strict preset security policy.
2. The Standard preset security policy.
3. Defender for Office 365 evaluation policies.
4. Custom threat policies, by priority (lower number first).
5. Built-in protection for Safe Links and Safe Attachments, and the default anti-malware, anti-spam and anti-phishing policies.

Processing stops at the first match. Microsoft's example: if the Standard preset and a custom anti-spam policy cover the same users, the Standard settings apply "instead of the settings in the custom anti-spam policy or the default anti-spam policy."

Practical consequences:

• Allowed sender lists in custom anti-spam policies stop working for preset users. You can't add allow or block lists to the presets at all. Move genuine exceptions to the Tenant Allow/Block List.
• A custom Safe Attachments policy with Dynamic Delivery does nothing for someone also in Standard, which uses Block.
• Exceptions to Built-in protection are ignored for anyone in Standard or Strict.

How do you assign Standard or Strict?

1. Open Preset security policies, turn on Standard protection or Strict protection, and select Manage protection settings.
2. On Apply Exchange Online Protection, choose All recipients or Specific recipients (users, groups or domains), and add exclusions if needed. A domain includes its subdomains unless you exclude them.
3. With Defender for Office 365, the Apply Defender for Office 365 protection page sets who gets Defender features. Use Previously selected recipients to match, or scope it to licensed users only.
4. On Add email addresses to flag when impersonated by attackers, add up to 350 people, such as executives and finance staff. User impersonation protection doesn't apply between a sender and recipient who have emailed each other before.
5. On Add domains to flag when impersonated by attackers, add up to 50 custom domains, such as key suppliers. Your own accepted domains are protected automatically, and every recipient gets mailbox intelligence protection.
6. On Add trusted email addresses and domains to not flag as impersonation, add partners that keep tripping impersonation checks. Trusted domains don't include subdomains, so add each one.
7. Review and select Confirm.

Turning a preset off keeps its recipient conditions, so you can switch it back on later without reassigning.

Excluding users from Built-in protection

On the same page, Add exclusions (not recommended) removes users from Built-in protection. Microsoft only suggests this for users who lack Defender for Office 365 licenses.

How do you check the presets are working?

Microsoft suggests testing a setting where Standard and Strict differ. A spam message should go to Junk Email for a Standard user and to quarantine for a Strict user. Bulk mail at BCL 6 should go to Junk for Standard users, and BCL 5 or higher should be quarantined for Strict users.

In Exchange Online PowerShell, the rules show who each preset covers:

Get-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Get-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Get-ATPBuiltInProtectionRule

The Defender rule (ATPProtectionPolicyRule) exists only in tenants with Defender for Office 365. Microsoft warns not to create, modify or remove the individual threat policies behind the presets; manage them only through the presets page.

On a real message, paste the headers into our Email Header Analyzer and check the BCL, SFV and CAT values. Our guide to Microsoft 365 spam headers decodes them.

When should you use custom policies instead?

Microsoft's general tip is to add users to Standard or Strict instead of building custom policies. Custom policies earn their place when you need something a preset can't do:

• A different bulk threshold or action for one team, such as marketing staff who need newsletters.
• Dynamic Delivery in Safe Attachments, or the Monitor action with redirect.
• Different quarantine policies, for example letting one group release phishing detections themselves. Users can't release high confidence phishing in any configuration.
• Language or country spam settings, or ASF options.
• A temporary allow list for testing, which presets don't support.

To combine both without surprises, Microsoft recommends using "unambiguous groups" so no user sits in two policies. If overlap is unavoidable, make users who need custom settings exceptions in the Standard preset, and make users who need Standard settings exceptions in Strict.

What are the common mistakes with presets?

• Turning Standard on for everyone, then wondering why a custom policy stopped working. Check the Type column on the Anti-spam policies page: preset policies show as Protection templates and sit above your custom ones.
• Leaving the impersonation lists empty. Mailbox intelligence and your own domains are covered automatically, but executives, finance staff and supplier domains aren't until you add them.
• Assuming Built-in protection equals Standard. Users outside Standard and Strict still get unwrapped links and can click through warnings.
• Forgetting quarantine. Strict sends spam and bulk to quarantine with notifications on. Tell users what the notification looks like and how to request a release, and see how to release quarantined email.
• Expecting presets to fix routing problems. A gateway without Enhanced Filtering, or an old bypass rule, undermines any preset.

Do presets work with a filtering gateway?

Yes. If your MX points to a filtering service, the presets still apply to mail that reaches Exchange Online, as long as the inbound connector uses Enhanced Filtering for Connectors so Microsoft sees the original sender. Two things to plan for:

• Strict quarantines more. Combined with the gateway's own quarantine, users may have two places to check. Microsoft lists more false positives "as more products are added" among the trade-offs of layering (Microsoft Learn).
• Presets don't remove bypass rules. An old SCL -1 mail flow rule for the gateway still skips spam filtering for everyone, preset or not. Remove it once Enhanced Filtering is on, and block direct-to-tenant delivery.

Next steps

1. Open https://security.microsoft.com/presetSecurityPolicies and check whether Standard and Strict are on, and for whom.
2. List your custom anti-spam, Safe Links and Safe Attachments policies, and note which users they no longer affect.
3. Move allow-list exceptions to the Tenant Allow/Block List.
4. Fill in the impersonation lists if you have Defender for Office 365.
5. Run a free Email Health Check to confirm your MX, SPF and DMARC records match how mail actually reaches Microsoft 365.

Browse all spam filter setup guides.