Check ID: defender_malware_policy_notifications_internal_users_malware_enabled
Provider: Microsoft 365
Service: defender
Severity: MEDIUM
Categories: email-security, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 anti-malware policies are checked for admin notifications on malware detected from internal senders, ensuring a valid notification address is defined (EnableInternalSenderAdminNotifications and InternalSenderAdminAddress). Effective settings across default and custom policies are considered.

​
Risk

Without these notifications, malware sent from internal accounts can persist unnoticed, delaying response and containment. This undermines integrity of email, enables lateral movement and outbound propagation, and can cause domain reputation damage and blocklisting, affecting availability.

​
Recommendation

Enable and maintain admin alerts for internal-sender malware and route to a monitored mailbox or SOC list (EnableInternalSenderAdminNotifications and InternalSenderAdminAddress). Ensure coverage via policy precedence, integrate with SIEM, and apply least privilege and defense in depth to limit impact.

​
Remediation

Set-MalwareFilterPolicy -Identity Default -EnableInternalSenderAdminNotifications $true -InternalSenderAdminAddress “<ADMIN_EMAIL>”

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_malware_policy_notifications_internal_users_malware_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks