[GH-ISSUE #2886] [Feature Request]: Standards -> Check if Standard Protection or Strict Protection is ENABLED #1424

New issue

Closed

opened 2026-03-02 13:44:05 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 13:44:05 +03:00

Owner

Originally created by @erikhoenderdos on GitHub (Sep 6, 2024).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/2886

Description of the new feature - must be an in-depth explanation of the feature you want, reasoning why, and the added benefits for MSPs as a whole.

We would like to check if our custommers have the Preset Security Policies enabled (Standard Protection or Strict Protection)

Currently it is possible in CIPP to check the status of the default policys and their values. We don't use them because our client tenants use the preset security policies from Microsoft.

In example:
If i check the default policy for the value of Phishing email threshold my custommer reports 0
but i have the security defaults enabled. So there is an additionial policy at Policies & Rules > Threat policies > Anti -phising named "Standard Preset Security Policy" This default policy sets the Phishing email threshold to 3.

It's documented on this learn document: https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies
for all the powershell cmdlets see: https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies#preset-security-policies-in-exchange-online-powershell

So in short, could their be a mechanisme to check if these preset policys are enabled?

please be aware that you always need to enable the preset once using webinterface before using the powershell cmdlets below
The only supported method for creating the individual security policies for Standard or Strict preset security policies is to turn on the preset security policy in the Microsoft Defender portal for the first time.

PowerShell commands you would normally use to achieve above request

Standard preset security policy:
Get-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Get-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Enable-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy"

Strict preset security policy
Get-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy"
Get-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy"
Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"; Enable-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"
Enable-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy"; Enable-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy"

Originally created by @erikhoenderdos on GitHub (Sep 6, 2024). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/2886 ### Description of the new feature - must be an in-depth explanation of the feature you want, reasoning why, and the added benefits for MSPs as a whole. We would like to check if our custommers have the Preset Security Policies enabled (Standard Protection or Strict Protection) Currently it is possible in CIPP to check the status of the default policys and their values. We don't use them because our client tenants use the preset security policies from Microsoft. In example: If i check the default policy for the value of Phishing email threshold my custommer reports 0 but i have the security defaults enabled. So there is an additionial policy at Policies & Rules > Threat policies > Anti -phising named "Standard Preset Security Policy" This default policy sets the Phishing email threshold to 3. It's documented on this learn document: https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies for all the powershell cmdlets see: https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies#preset-security-policies-in-exchange-online-powershell So in short, could their be a mechanisme to check if these preset policys are enabled? please be aware that you always need to enable the preset once using webinterface before using the powershell cmdlets below _The only supported method for creating the individual security policies for Standard or Strict preset security policies is to turn on the preset security policy in the Microsoft Defender portal for the first time._ ### PowerShell commands you would normally use to achieve above request **Standard preset security policy:** Get-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy" Get-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy" Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy" Enable-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" **Strict preset security policy** Get-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy" Get-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy" Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"; Enable-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy" Enable-EOPProtectionPolicyRule -Identity "Strict Preset Security Policy"; Enable-ATPProtectionPolicyRule -Identity "Strict Preset Security Policy"

kerem

2026-03-02 13:44:05 +03:00

closed this issue
added the
enhancement

no-priority
labels

kerem commented

2026-03-02 13:44:06 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Sep 6, 2024):

We currently have an Feature Request stop as we're doing a rewrite; outside of our feature stop, only if you are sponsoring at the $99,- dollar level you are able to make feature requests.

@KelvinTegelaar commented on GitHub (Sep 6, 2024): We currently have an Feature Request stop as we're doing a rewrite; outside of our feature stop, only if you are sponsoring at the $99,- dollar level you are able to make feature requests.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#1424

No description provided.

Rows
Columns