Exchange Online Security: What CIS Benchmark Section 6 Checks (13 Controls)

The CIS Microsoft 365 Foundations Benchmark v7.0.0 defines 160 controls across 9 sections. Section 6 — Exchange Online — contains 11 of those controls. It exists because email is still the transport layer for most attacks and most exfiltration: a mailbox with weak auditing, unchecked forwarding rules, or a rogue add-in can leak data long before anyone notices.

Where Section 2 governs what reaches the inbox, Section 6 governs the mailbox itself — who can see into it, what it's allowed to do automatically, and how it authenticates. This guide walks through the four capability areas Section 6 covers, why the benchmark includes each, and how to verify them.

For an overview of all 9 sections, see the CIS Microsoft 365 Foundations Benchmark guide.

How Section 6 is structured

The 13 controls in Section 6 are organised into four subsections:

• 6.1 — 3 controls: mailbox auditing
• 6.2 — 3 controls: mail flow and anti-phishing
• 6.3 — 2 controls: Outlook add-ins and personal email accounts
• 6.5 — 5 controls: modern authentication and related client settings

As with the rest of the benchmark, the workbook only stores numeric recommendation IDs and descriptions — the capability groupings below are the practical way to read them against the Exchange admin center and Exchange Online PowerShell.

Mailbox auditing

Mailbox auditing on by default logs actions taken by mailbox owners, delegates, and admins — reads, sends, moves, permission changes — into a searchable audit log, and the organization-level default setting overrides whatever is configured on individual mailboxes. The benchmark also checks that accounts aren't quietly exempted from this logging: a mailbox or account with audit bypass enabled leaves no trail for anything done there.

This matters because mailbox compromise is rarely loud. An attacker who gains access to a mailbox typically reads and searches quietly before doing anything that would trigger an alert — auditing is what lets you reconstruct what happened after the fact, or notice it while it's still happening.

How to check: In Exchange Online PowerShell, confirm organization-wide mailbox auditing is enabled (Get-OrganizationConfig | Select AuditDisabled should return False), and review Get-Mailbox -ResultSize Unlimited | Select Name,AuditBypassEnabled for any accounts with audit bypass turned on.

Mail flow and anti-phishing

Exchange Online offers several mechanisms that move mail automatically — remote domain settings, transport (mail flow) rules, and anti-spam outbound policies — and together they control whether a mailbox can silently auto-forward messages outside the organization. Auto-forwarding is a common exfiltration technique: an attacker who compromises one mailbox sets up a forwarding rule once, then continues receiving copies of everything even after the initial access is revoked.

The benchmark also checks that mail flow rules are reviewed rather than left to accumulate untracked, and that external sender tagging is enabled — the visual cue that flags a message as coming from outside the organization, which helps users catch domain-impersonation and lookalike-sender attempts before they act on them.

How to check: Review Mail flow → Remote domains and outbound anti-spam policies for automatic forwarding settings, audit existing transport rules for anything that forwards or redirects mail unexpectedly, and confirm external sender tagging is enabled under Mail flow settings.

Outlook add-ins

By default, users can install add-ins in Outlook themselves, and an add-in runs with access to the data inside the client — messages, attachments, and in some cases the ability to send mail on the user's behalf. The benchmark requires restricting who can install and manage add-ins, because an unreviewed add-in is effectively unreviewed code with a standing connection to the mailbox.

How to check: In the Exchange admin center, review add-in management permissions and confirm only specific administrators — not all users — can install or manage add-ins for the organization.

Modern authentication and client settings

This subsection covers four related settings: modern authentication (which enables MFA, certificate-based authentication, and third-party SAML identity providers for Outlook clients, in place of legacy basic authentication that bypasses those protections); MailTips (which warn a user composing a message about likely mistakes, such as sending to an unusually large distribution list); external storage providers available in Outlook on the web (third-party file services outside your organization's control); and SMTP AUTH (legacy authenticated SMTP submission, a protocol with no native MFA support that is a common target for password-spray attacks).

The benchmark's recommended state disables legacy authentication paths — SMTP AUTH off, external storage providers restricted — while keeping modern authentication and MailTips on, closing the gaps that legacy protocols leave open without removing functionality users rely on.

How to check: Confirm modern authentication is enabled (Get-OrganizationConfig | Select OAuth2ClientProfileEnabled), MailTips are on under Organization settings, additional storage providers are restricted, and SMTP AUTH is disabled tenant-wide unless a specific, documented exception requires it.

How ConfigCobra assesses Section 6

ConfigCobra evaluates all 11 Section 6 controls automatically as part of a full CIS Microsoft 365 Foundations Benchmark assessment.

The scan connects to your Microsoft 365 tenant using read-only Microsoft Graph permissions — no agents, no scripts running in your environment, no admin passwords shared. Within 20–25 minutes, ConfigCobra returns results for all 160 controls across all 9 sections, including every control in Section 6.

For each finding, you get:

• Pass, fail, or partial status
• The actual configuration value that was evaluated
• The CIS remediation procedure
• A generated PowerShell script where applicable

Mailbox auditing and auto-forwarding rules are two of the more commonly drifted controls in this section — auditing gets disabled during a mailbox migration and never re-enabled, or a forwarding rule created for a legitimate reason during someone's leave is never removed.

Start a free trial to run the full assessment against your own tenant, with 14 days of full access and read-only Microsoft permissions.

What comes next

Section 6 protects the mailbox. Several sections remain uncovered in this series:

• Section 3 — Microsoft Purview (5 controls — audit log search, Data Loss Prevention, Information Protection)
• Section 7 — SharePoint Online & OneDrive (12 controls — external sharing and link defaults)
• Section 8 — Microsoft Teams (17 controls — file sharing, external access, apps)
• Section 9 — Microsoft Fabric / Power BI (12 controls — tenant settings)

For the full benchmark overview including every section's control count, see the CIS Microsoft 365 Foundations Benchmark page.