# Microsoft 365 priority accounts: how to tag and protect your VIPs

URL: https://iblockspam.com/blog/microsoft-365-priority-accounts-protection
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Setup guides
Author: iBlockSpam Team

> How to tag Microsoft 365 priority accounts, what the tag does with each license, how to check priority account protection is on, and the 250-account limit.

## Short answer

Priority accounts is a Microsoft 365 tag for up to 250 high-value users, such as executives, finance staff and admins. Apply it in the Microsoft 365 admin center, on the Defender portal's User tags page or with Set-User -VIP $true. With Defender for Office 365, the tag filters alerts and reports; Plan 2 adds priority account protection, which is on by default.

Microsoft 365 lets you mark your most targeted people as **priority accounts**. You apply the tag in the Microsoft 365 admin center, but Microsoft says what it does depends on your subscription, and most of its value only appears once you also change policies around it. This guide covers the tag, what it switches on for each plan and how to check it's working. For the wider VIP strategy, including process controls and Google Workspace, read our [executive and VIP email protection guide](https://iblockspam.com/blog/executive-vip-email-protection) first.

## What is a priority account in Microsoft 365?

A priority account in Microsoft 365 is a user tagged as high-impact, such as a CEO, CFO, head of IT or an administrator, so that security tools can protect, monitor and report on them separately. Microsoft's [admin documentation](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts) describes them as users "who have access to sensitive, proprietary, or high priority information, or who are influential in your organization," and says you can designate "up to 250" of them.

Technically, **Priority account** is a *system tag*, a type of user tag. Microsoft's [user tags page](https://learn.microsoft.com/en-us/defender-office-365/user-tags-about) says "Priority account is the only type of system tag." With Defender for Office 365 you can also create *custom tags* (up to 500) for other groups, such as "Finance approvers". Custom tags help with reporting but don't get priority account protection.

Why bother? Microsoft's [security recommendations for priority accounts](https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-security-recommendations) put it plainly: random phishing is "inefficient" for attackers, but "spear phishing or whaling attacks that target priority accounts are very rewarding." If those terms are new, see [spear phishing vs phishing vs whaling](https://iblockspam.com/blog/spear-phishing-vs-phishing-vs-whaling).

## What does the Priority account tag do with each license?

The Priority account tag does different things depending on your subscription. This table summarizes the benefits list on Microsoft's [Manage and monitor priority accounts page](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts), at the time of writing (November 2026):

| Benefit | What it does | Requirement Microsoft lists |
|---|---|---|
| Reporting in Defender for Office 365 | Filter alerts, reports and investigations to priority accounts | Defender for Office 365 Plan 1 or Plan 2 |
| Priority account protection | Extra heuristics tailored to executives; on by default | Defender for Office 365 Plan 2 |
| Exchange Online priority account monitoring | Mailbox health: licensing, storage, message limits, delivery | At least 5,000 qualifying licenses and 50 monthly active users |
| Premium Mail Flow Monitoring | Alerts when failed or delayed mail exceeds your threshold | At least 5,000 qualifying licenses and 50 monthly active users |

Microsoft names Microsoft 365 Business Premium among subscriptions that include Defender for Office 365 for the reporting benefit, and gives Business Premium with the Microsoft Defender Suite for Business Premium add-on as an example of Plan 2. Qualifying licenses for the monitoring features are Office 365 E3, Microsoft 365 E3, Office 365 E5 and Microsoft 365 E5, in any combination. Most small businesses will never meet the 5,000-license threshold, so for them the tag is about reporting and, with Plan 2, extra filtering heuristics. Not sure which plan you have? Compare [Defender for Office 365 Plan 1 vs Plan 2](https://iblockspam.com/blog/defender-for-office-365-plan-1-vs-plan-2).

Two things the tag does **not** do on its own: it doesn't move the user into the Strict preset policy, and it doesn't add them to impersonation protection. Those are separate settings, covered below.

## Who should you tag as a priority account?

Tag the people whose compromise or impersonation would hurt most, not simply the most senior. Microsoft's examples include "CEOs, CISOs, CFOs, infrastructure admin accounts, build system accounts, and more." A practical list for a smaller organization:

- The owner, CEO and other directors whose names attackers will use.
- Anyone who can approve or send payments, change supplier bank details or run payroll.
- Microsoft 365 and IT administrators.
- Executive assistants and delegates with access to those mailboxes. Microsoft's tip: "When you apply priority account protection to a mailbox, you should also apply priority account protection to users with access to the mailbox. For example, the CEO and their executive assistant."
- Public-facing addresses that receive invoices, such as `accounts@`.

Keep the list short. Microsoft answers the obvious question, "Why not designate all users as priority accounts?", by explaining that the extra heuristics are tailored to the different mail flow patterns of executives "that don't benefit regular users."

## How do you tag priority accounts?

You can tag priority accounts in three places. All three update the same list.

### In the Microsoft 365 admin center

1. Go to the Priority accounts page at `https://admin.microsoft.com/Adminportal/Home#/priorityaccounts`, or **Users** > **Active users** > **More actions** > **Manage priority accounts**.
2. Select **Tag accounts**.
3. Choose how to search: **Name and email address** (default), **Job title** or **Distribution list**, then select **Next**.
4. Select the users or distribution groups and select **Tag**. The flyout shows a running **Priority accounts tagged** total, to the maximum of 250.

### In the Microsoft Defender portal

1. Go to **Settings** > **Email & collaboration** > **User tags**, or `https://security.microsoft.com/securitysettings/userTags`.
2. Select the **Priority account** row and select **Edit**.
3. On **Assign members**, select **Add members**, or **Import** a text file with one email address per line.
4. Select **Next**, review, and select **Submit**.

Microsoft lists the permission needed to apply and remove the tag as membership in the Security Administrator and Exchange Admin role groups, or the Global Administrator or Security Administrator role in Microsoft Entra ID.

### With PowerShell

In Exchange Online PowerShell, the tag is the `VIP` property of the user:

```powershell
# List current priority accounts
Get-User -IsVIP | Select-Object Identity

# Add or remove the tag (example address)
Set-User -VIP $true -Identity ceo@example.com -Confirm:$false
Set-User -VIP $false -Identity ceo@example.com -Confirm:$false
```

Whichever method you use, Microsoft warns "it can take up to eight hours to completely apply tags."

## How do you check priority account protection is on?

Priority account protection is the Defender for Office 365 Plan 2 feature that applies extra heuristics to tagged users. Microsoft's [configuration page](https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-turn-on-priority-account-protection) says it is "turned on in organizations with Defender for Office 365 Plan 2" by default, and "we don't recommend turning off priority account protection." Someone may still have turned it off, so check:

- **Portal:** **Settings** > **Email & collaboration** > **Priority account protection** (`https://security.microsoft.com/securitysettings/priorityAccountProtection`). The toggle should be on.
- **PowerShell:**

```powershell
Get-EmailTenantSettings | Format-List Identity,EnablePriorityAccountProtection
Set-EmailTenantSettings -EnablePriorityAccountProtection $true
```

`True` means it's on.

## Which policies should you change for priority accounts?

Tagging identifies the people; policies protect them. Microsoft's recommendations list two steps available on all Office 365 Enterprise plans, and we add the impersonation step for tenants with Defender:

1. **Increase sign-in security.** Require multifactor authentication and disable legacy authentication. If you can't disable legacy protocols everywhere, Microsoft says you can turn off POP3 and IMAP4 on individual mailboxes and allow authenticated SMTP only on mailboxes that still need it. Our guides to [security defaults and MFA](https://iblockspam.com/blog/microsoft-365-security-defaults-mfa) and [SMTP AUTH retirement](https://iblockspam.com/blog/microsoft-365-smtp-auth-basic-auth-retirement) cover both.
2. **Assign the Strict preset security policy.** Microsoft's example: "instead of delivering messages that were classified as spam to the Junk Email folder, you should quarantine those same messages intended for priority accounts." Add the same users (or a group containing them) to Strict in [preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies). The tag doesn't do this for you.
3. **Protect their names from impersonation (Defender for Office 365).** Add each priority user under **Users to protect** in an anti-phishing policy, and choose an action other than the default **Don't apply any action**. Our [anti-phishing policy settings guide](https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings) walks through it.
4. **Keep the group and the tag in sync.** When a director leaves or a new finance manager starts, update both the Strict preset membership and the tag the same day.

## How do you monitor priority accounts?

Once tagged, priority accounts become a filter across the Defender portal. Microsoft's [recommendations page](https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-security-recommendations) lists where tags appear:

| Feature | How the tag helps |
|---|---|
| Alerts and Incidents | User tags are visible and filterable |
| Custom alert policies | Create alert policies with a user tag as a condition |
| Threat Explorer / Real-time detections | Tags show in the email grid and details, and can be filtered |
| Threat protection status report | Filter most views by priority accounts |
| Top senders and recipients report | Add the tag to the top 20 senders |
| Email issues for priority accounts report | Failed and delayed mail to or from priority accounts (5,000-license tier) |

A good routine for a small security team:

1. **Create a custom alert policy** scoped to the Priority account tag for the activities you care about most. Microsoft's [alert policies page](https://learn.microsoft.com/en-us/defender-xdr/alert-policies) says you can "define user tags as a condition of an alert policy," so the resulting alerts carry the context of the impacted user.
2. **Check weekly what reached them.** In Threat Explorer (Plan 2) or Real-time detections (Plan 1), filter by the Priority account tag. With Plan 2, Microsoft adds a **Context** filter: **Equal any of** > **Priority account protection** shows detections made by the extra heuristics. Our [Threat Explorer and Real-time detections guide](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections) explains the views.
3. **Read the Threat protection status report** filtered to priority accounts to see trends in phishing, malware and spam aimed at them.
4. **If you qualify for monitoring**, configure the [Email issues for priority accounts report](https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report) in the Exchange admin center. It shows failed events from the last 15 minutes and delayed messages from the last 6 hours. Its notification threshold defaults to 100 failed or delayed messages, with a daily limit of 1 notification by default.

## How often should you review the priority accounts list?

Review the priority accounts list at least every quarter, and whenever someone joins or leaves a role on it. A stale list is worse than a short one: a former CFO who keeps the tag adds noise to reports, while a new payroll manager without it gets none of the extra visibility. A simple review:

1. Export the list with `Get-User -IsVIP` and compare it with your current org chart and admin role assignments.
2. Remove the tag from anyone who has changed role or left, and add their replacement.
3. Check that the Strict preset and **Users to protect** lists match the tag list.
4. Look at the last quarter's detections for tagged users in Threat Explorer or the Threat protection status report. Names that attackers target repeatedly belong on the list even if they aren't senior.

## What does priority account protection not cover?

Priority account protection reduces risk for tagged users; it doesn't remove it. Know its limits:

- **Lookalike domains.** An email from a domain registered to look like yours can pass SPF, DKIM and DMARC. Impersonation protection and [lookalike domain monitoring](https://iblockspam.com/blog/lookalike-domain-phishing) address that, not the tag.
- **Spoofing of your exact domain** by outsiders is stopped by DMARC enforcement on your domains, which protects everyone.
- **Payment fraud** works by persuading the person, not beating the filter. A phone call-back rule for payment or bank detail changes, as in our [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention), protects executives better than any tag.
- **Account takeover** of a priority user is still possible without strong MFA. If it happens, follow [Microsoft 365 compromised account remediation](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation).

## Next steps

- List your priority people, including assistants and admins, and tag them in the Microsoft 365 admin center. Confirm the list with `Get-User -IsVIP`.
- If you have Defender for Office 365 Plan 2, confirm priority account protection is on.
- Add the same people to the Strict preset and to **Users to protect** in your anti-phishing policy.
- Check what attackers could register to imitate your domain with the free [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator).
- If you want inbound filtering, quarantine and lookalike domain alerts in front of Microsoft 365 for the whole domain, see how iBlockSpam works with [Microsoft 365](https://iblockspam.com/platforms/microsoft-365).

## Frequently asked questions

### How many priority accounts can a Microsoft 365 tenant have?

Microsoft sets the maximum at 250 priority accounts. If you need to group more people for reporting, Defender for Office 365 lets you create up to 500 custom user tags, and a custom tag can be assigned to up to 10,000 individual users. Custom tags don't get priority account protection, only the reporting and filtering.

### Does tagging a priority account change how its email is filtered?

Only with Defender for Office 365 Plan 2. There, priority account protection applies extra heuristics tailored to executives' mail flow, and it's on by default. With Plan 1 the tag only adds filtering in alerts, reports and investigations. Stronger filtering actions come from assigning the user to the Strict preset security policy, which is a separate step.

### How long does the Priority account tag take to apply?

Microsoft says it can take up to eight hours to completely apply tags. Tag your users, wait, and then confirm in a report or in Threat Explorer that the tag appears before relying on tag-based alert policies or report filters for those people.

### Can I see priority accounts with PowerShell?

Yes. In Exchange Online PowerShell, run Get-User -IsVIP | Select-Object Identity to list them. Set-User -VIP $true -Identity user@example.com adds the tag, and -VIP $false removes it. There are no cmdlets for custom user tags; Microsoft says those are managed only in the Defender portal.

### Should an executive assistant be a priority account too?

Microsoft's guidance says yes: when you apply priority account protection to a mailbox, also apply it to users with access to that mailbox, such as the CEO and their executive assistant. An attacker who compromises a delegate can read and send from the executive's mailbox without touching the executive's own sign-in.

## Sources

- [Microsoft Learn: Manage and monitor priority accounts](https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts)
- [Microsoft Learn: Security recommendations for priority accounts](https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-security-recommendations)
- [Microsoft Learn: Configure and review priority account protection in Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/priority-accounts-turn-on-priority-account-protection)
- [Microsoft Learn: User tags in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/user-tags-about)
- [Microsoft Learn: Email issues for priority accounts report](https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-reports/mfr-email-issues-for-priority-accounts-report)
- [Microsoft Learn: Alert policies in the Microsoft Defender portal](https://learn.microsoft.com/en-us/defender-xdr/alert-policies)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-priority-accounts-protection (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt