STIGQter STIGQter: STIG Summary: Microsoft Office 365 ProPlus Security Technical Implementation Guide Version: 3 Release: 5 Benchmark Date: 01 Apr 2026:

The junk email protection level must be set to No Automatic Filtering.

DISA Rule

SV-223351r1188335_rule

Vulnerability Number

V-223351

Group Title

SRG-APP-000516

Rule Version

O365-OU-000006

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options.

Set the Junk E-mail protection level to "No Automatic Filtering".

Check Contents

Note: If the Outlook client application is not used to access Office 365 email (i.e., email is only accessed via Outlook Web Access [OWA]), this is not applicable.

Verify Outlook Junk E-mail protection is set to "No Automatic Filtering".

In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options.

Verify Junk E-mail protection is set to "No Automatic Filtering".

If the system being inspected is not behind EEMSG, CBII, or O365 EOP, the Junk E-mail protection level must be set to "High". Otherwise, "Low" is acceptable.

If Junk E-mail protection is not set to "No Automatic Filtering", this is a finding.

If the system is not behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP and the Junk E-mail protection is not set to "High", this is a finding.

If the system is behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP, and the Junk E-mail protection is not at least "Low", this is a finding.

Vulnerability Number

V-223351

Documentable

False

Rule Version

O365-OU-000006

Severity Override Guidance

Note: If the Outlook client application is not used to access Office 365 email (i.e., email is only accessed via Outlook Web Access [OWA]), this is not applicable.

Verify Outlook Junk E-mail protection is set to "No Automatic Filtering".

In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options.

Verify Junk E-mail protection is set to "No Automatic Filtering".

If the system being inspected is not behind EEMSG, CBII, or O365 EOP, the Junk E-mail protection level must be set to "High". Otherwise, "Low" is acceptable.

If Junk E-mail protection is not set to "No Automatic Filtering", this is a finding.

If the system is not behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP and the Junk E-mail protection is not set to "High", this is a finding.

If the system is behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP, and the Junk E-mail protection is not at least "Low", this is a finding.

Check Content Reference

M

Target Key

4099