Microsoft 365 priority accounts: how to tag and protect your VIPs

Microsoft 365 lets you mark your most targeted people as priority accounts. You apply the tag in the Microsoft 365 admin center, but Microsoft says what it does depends on your subscription, and most of its value only appears once you also change policies around it. This guide covers the tag, what it switches on for each plan and how to check it's working. For the wider VIP strategy, including process controls and Google Workspace, read our executive and VIP email protection guide first.

What is a priority account in Microsoft 365?

A priority account in Microsoft 365 is a user tagged as high-impact, such as a CEO, CFO, head of IT or an administrator, so that security tools can protect, monitor and report on them separately. Microsoft's admin documentation describes them as users "who have access to sensitive, proprietary, or high priority information, or who are influential in your organization," and says you can designate "up to 250" of them.

Technically, Priority account is a system tag, a type of user tag. Microsoft's user tags page says "Priority account is the only type of system tag." With Defender for Office 365 you can also create custom tags (up to 500) for other groups, such as "Finance approvers". Custom tags help with reporting but don't get priority account protection.

Why bother? Microsoft's security recommendations for priority accounts put it plainly: random phishing is "inefficient" for attackers, but "spear phishing or whaling attacks that target priority accounts are very rewarding." If those terms are new, see spear phishing vs phishing vs whaling.

What does the Priority account tag do with each license?

The Priority account tag does different things depending on your subscription. This table summarizes the benefits list on Microsoft's Manage and monitor priority accounts page, at the time of writing (November 2026):

Microsoft names Microsoft 365 Business Premium among subscriptions that include Defender for Office 365 for the reporting benefit, and gives Business Premium with the Microsoft Defender Suite for Business Premium add-on as an example of Plan 2. Qualifying licenses for the monitoring features are Office 365 E3, Microsoft 365 E3, Office 365 E5 and Microsoft 365 E5, in any combination. Most small businesses will never meet the 5,000-license threshold, so for them the tag is about reporting and, with Plan 2, extra filtering heuristics. Not sure which plan you have? Compare Defender for Office 365 Plan 1 vs Plan 2.

Two things the tag does not do on its own: it doesn't move the user into the Strict preset policy, and it doesn't add them to impersonation protection. Those are separate settings, covered below.

Who should you tag as a priority account?

Tag the people whose compromise or impersonation would hurt most, not simply the most senior. Microsoft's examples include "CEOs, CISOs, CFOs, infrastructure admin accounts, build system accounts, and more." A practical list for a smaller organization:

• The owner, CEO and other directors whose names attackers will use.
• Anyone who can approve or send payments, change supplier bank details or run payroll.
• Microsoft 365 and IT administrators.
• Executive assistants and delegates with access to those mailboxes. Microsoft's tip: "When you apply priority account protection to a mailbox, you should also apply priority account protection to users with access to the mailbox. For example, the CEO and their executive assistant."
• Public-facing addresses that receive invoices, such as accounts@.

Keep the list short. Microsoft answers the obvious question, "Why not designate all users as priority accounts?", by explaining that the extra heuristics are tailored to the different mail flow patterns of executives "that don't benefit regular users."

How do you tag priority accounts?

You can tag priority accounts in three places. All three update the same list.

In the Microsoft 365 admin center

1. Go to the Priority accounts page at https://admin.microsoft.com/Adminportal/Home#/priorityaccounts, or Users > Active users > More actions > Manage priority accounts.
2. Select Tag accounts.
3. Choose how to search: Name and email address (default), Job title or Distribution list, then select Next.
4. Select the users or distribution groups and select Tag. The flyout shows a running Priority accounts tagged total, to the maximum of 250.

In the Microsoft Defender portal

1. Go to Settings > Email & collaboration > User tags, or https://security.microsoft.com/securitysettings/userTags.
2. Select the Priority account row and select Edit.
3. On Assign members, select Add members, or Import a text file with one email address per line.
4. Select Next, review, and select Submit.

Microsoft lists the permission needed to apply and remove the tag as membership in the Security Administrator and Exchange Admin role groups, or the Global Administrator or Security Administrator role in Microsoft Entra ID.

With PowerShell

In Exchange Online PowerShell, the tag is the VIP property of the user:

# List current priority accounts
Get-User -IsVIP | Select-Object Identity

# Add or remove the tag (example address)
Set-User -VIP $true -Identity ceo@example.com -Confirm:$false
Set-User -VIP $false -Identity ceo@example.com -Confirm:$false

Whichever method you use, Microsoft warns "it can take up to eight hours to completely apply tags."

How do you check priority account protection is on?

Priority account protection is the Defender for Office 365 Plan 2 feature that applies extra heuristics to tagged users. Microsoft's configuration page says it is "turned on in organizations with Defender for Office 365 Plan 2" by default, and "we don't recommend turning off priority account protection." Someone may still have turned it off, so check:

• Portal: Settings > Email & collaboration > Priority account protection (https://security.microsoft.com/securitysettings/priorityAccountProtection). The toggle should be on.
• PowerShell:

Get-EmailTenantSettings | Format-List Identity,EnablePriorityAccountProtection
Set-EmailTenantSettings -EnablePriorityAccountProtection $true

True means it's on.

Which policies should you change for priority accounts?

Tagging identifies the people; policies protect them. Microsoft's recommendations list two steps available on all Office 365 Enterprise plans, and we add the impersonation step for tenants with Defender:

1. Increase sign-in security. Require multifactor authentication and disable legacy authentication. If you can't disable legacy protocols everywhere, Microsoft says you can turn off POP3 and IMAP4 on individual mailboxes and allow authenticated SMTP only on mailboxes that still need it. Our guides to security defaults and MFA and SMTP AUTH retirement cover both.
2. Assign the Strict preset security policy. Microsoft's example: "instead of delivering messages that were classified as spam to the Junk Email folder, you should quarantine those same messages intended for priority accounts." Add the same users (or a group containing them) to Strict in preset security policies. The tag doesn't do this for you.
3. Protect their names from impersonation (Defender for Office 365). Add each priority user under Users to protect in an anti-phishing policy, and choose an action other than the default Don't apply any action. Our anti-phishing policy settings guide walks through it.
4. Keep the group and the tag in sync. When a director leaves or a new finance manager starts, update both the Strict preset membership and the tag the same day.

How do you monitor priority accounts?

Once tagged, priority accounts become a filter across the Defender portal. Microsoft's recommendations page lists where tags appear:

A good routine for a small security team:

1. Create a custom alert policy scoped to the Priority account tag for the activities you care about most. Microsoft's alert policies page says you can "define user tags as a condition of an alert policy," so the resulting alerts carry the context of the impacted user.
2. Check weekly what reached them. In Threat Explorer (Plan 2) or Real-time detections (Plan 1), filter by the Priority account tag. With Plan 2, Microsoft adds a Context filter: Equal any of > Priority account protection shows detections made by the extra heuristics. Our Threat Explorer and Real-time detections guide explains the views.
3. Read the Threat protection status report filtered to priority accounts to see trends in phishing, malware and spam aimed at them.
4. If you qualify for monitoring, configure the Email issues for priority accounts report in the Exchange admin center. It shows failed events from the last 15 minutes and delayed messages from the last 6 hours. Its notification threshold defaults to 100 failed or delayed messages, with a daily limit of 1 notification by default.

How often should you review the priority accounts list?

Review the priority accounts list at least every quarter, and whenever someone joins or leaves a role on it. A stale list is worse than a short one: a former CFO who keeps the tag adds noise to reports, while a new payroll manager without it gets none of the extra visibility. A simple review:

1. Export the list with Get-User -IsVIP and compare it with your current org chart and admin role assignments.
2. Remove the tag from anyone who has changed role or left, and add their replacement.
3. Check that the Strict preset and Users to protect lists match the tag list.
4. Look at the last quarter's detections for tagged users in Threat Explorer or the Threat protection status report. Names that attackers target repeatedly belong on the list even if they aren't senior.

What does priority account protection not cover?

Priority account protection reduces risk for tagged users; it doesn't remove it. Know its limits:

• Lookalike domains. An email from a domain registered to look like yours can pass SPF, DKIM and DMARC. Impersonation protection and lookalike domain monitoring address that, not the tag.
• Spoofing of your exact domain by outsiders is stopped by DMARC enforcement on your domains, which protects everyone.
• Payment fraud works by persuading the person, not beating the filter. A phone call-back rule for payment or bank detail changes, as in our BEC prevention guide, protects executives better than any tag.
• Account takeover of a priority user is still possible without strong MFA. If it happens, follow Microsoft 365 compromised account remediation.

Next steps

• List your priority people, including assistants and admins, and tag them in the Microsoft 365 admin center. Confirm the list with Get-User -IsVIP.
• If you have Defender for Office 365 Plan 2, confirm priority account protection is on.
• Add the same people to the Strict preset and to Users to protect in your anti-phishing policy.
• Check what attackers could register to imitate your domain with the free Lookalike Domain Generator.
• If you want inbound filtering, quarantine and lookalike domain alerts in front of Microsoft 365 for the whole domain, see how iBlockSpam works with Microsoft 365.