Skip to content
MitoMito Docs

CISA.MS.EXO.16.1: Alerts SHALL be enabled.
ID CISA.MS.EXO.16.1
Severity High
Suite CISA SCuBA baselines
Product Exchange Online
Related products Defender
Feature Alert policies
Security area Logging and detection
Resource type Policy
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.16.1 (SHALL)
Framework controls cisa-scuba:MS.EXO.16.1
nist-800-53-r5:SI-4(5) System Monitoring | System-generated Alerts
MITRE ATT&CK T1114.003, T1204.001
Reads from Exchange Online, Microsoft Graph, Security & Compliance PowerShell
Licence needed ATP_ENTERPRISE

What this checks and how to fix it

Section titled “What this checks and how to fix it”

At a minimum, the following alerts SHALL be enabled:

  • Suspicious email sending patterns detected.
  • Suspicious Connector Activity.
  • Suspicious Email Forwarding Activity.
  • Messages have been delayed.
  • Tenant restricted from sending unprovisioned email.
  • Tenant restricted from sending email.
  • A potentially malicious URL click was detected.

Rationale: Potentially malicious or service impacting events may go undetected without a means of detecting these events. Setting up a mechanism to alert administrators to events listed above draws attention to them to help minimize impact to users and the agency.

Remediation action:

Section titled “Remediation action:”
  1. Sign in to Microsoft 365 Defender.
  2. Under Email & collaboration, select Policies & rules.
  3. Select Alert Policy.
  4. Select the checkbox next to each alert to enable as determined by the agency and at a minimum those referenced in the CISA M365 Security Configuration Baseline for Exchange Online which are:
    • Suspicious email sending patterns detected.
    • Suspicious connector activity.
    • Suspicious Email Forwarding Activity.
    • Messages have been delayed.
    • Tenant restricted from sending unprovisioned email.
    • Tenant restricted from sending email.
    • A potentially malicious URL click was detected.
  5. Click the pencil icon from the top menu.
  6. Select the Enable selected policies action from the Bulk actions menu.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.