Policy recommendations for securing email
This article describes how to implement the recommended identity and device access policies to protect organizational email and email clients that support modern authentication and conditional access. This guidance builds on the Common identity and device access policies and also includes a few additional recommendations.
These recommendations are based on three different tiers of security and protection that can be applied based on the granularity of your needs: baseline, sensitive, and highly regulated. You can learn more about these security tiers, and the recommended client operating systems, referenced by these recommendations in the recommended security policies and configurations introduction.
These recommendations require your users to use modern email clients, including Outlook for iOS and Android on mobile devices. Outlook for iOS and Android provide support for the best features of Office 365. These mobile Outlook apps are also architected with security capabilities that support mobile use and work together with other Microsoft cloud security capabilities. For more information, see Outlook for iOS and Android FAQ.
Update common policies to include email
To protect email, the following diagram illustrates which policies to update from the the common identity and device access policies.
Note the addition of a new policy for Exchange Online to block ActiveSync clients. This forces the use of Outlook mobile.
If you included Exchange Online and Outlook in the scope of the policies when you set them up, you only need to create the new policy to block ActiveSync clients. Review the policies listed in the following table and either make the recommended additions, or confirm that these are already included. Each policy links to the associated configuration instructions in Common identity and device access policies.
|Protection level||Policies||More information|
|Baseline||Require MFA when sign-in risk is medium or high||Include Exchange Online in the assignment of cloud apps|
|Block clients that don't support modern authentication||Include Exchange Online in the assignment of cloud apps|
|Apply APP data protection policies||Be sure Outlook is included in the list of apps. Be sure to update the policy for each platform (iOS, Android, Windows)|
|Require approved apps and APP protection||Include Exchange Online in the list of cloud apps|
|Require compliant PCs||Include Exchange Online in list of cloud apps|
|Block ActiveSync clients||Add this new policy|
|Sensitive||Require MFA when sign-in risk is low, medium or high||Include Exchange Online in the assignment of cloud apps|
|Require compliant PCs and mobile devices||Include Exchange Online in the list of cloud apps|
|Highly regulated||Always require MFA||Include Exchange Online in the assignment of cloud apps|
Block ActiveSync clients
This policy prevents ActiveSync clients from bypassing other Conditional Access policies. The policy configuration applies only to ActiveSync clients. By selecting Require app protection policy, this policy blocks ActiveSync clients. Details on creating this policy can be found in Require app protection policy for cloud app access with Conditional Access.
- Follow "Step 2: Configure an Azure AD Conditional Access policy for Exchange Online with ActiveSync (EAS)" in Scenario 1: Office 365 apps require approved apps with app protection policies, which prevents Exchange ActiveSync clients leveraging basic authentication from connecting to Exchange Online.
You can also use authentication policies to disable Basic authentication, which forces all client access requests to use modern authentication.
Limit access to Exchange Online from Outlook on the web
You can restrict the ability for users to download attachments from Outlook on the web on umnanaged devices. Users on these devices can view and edit these files using Office Online without leaking and storing the files on the device. You can also block users from seeing attachments on an unmanaged device.
Here are the steps:
If you don't already have an OWA mailbox policy, create one with the New-OwaMailboxPolicy cmdlet.
If you want to allow viewing of attachments but no downloading, use this command:
Set-OwaMailboxPolicy -Identity Default -ConditionalAccessPolicy ReadOnly
If you want to block attachments, use this command:
Set-OwaMailboxPolicy -Identity Default -ConditionalAccessPolicy ReadOnlyPlusAttachmentsBlocked
In the Azure portal, create a new Conditional Access policy with these settings:
Assignments > Users and groups: Select appropriate users and groups to include and exclude.
Assignments > Cloud apps or actions > Cloud apps > Include > Select apps: Select Office 365 Exchange Online
Access controls > Session: Select Use app enforced restrictions
Require that iOS and Android devices must use Outlook
To ensure that users of iOS and Android devices can only access work or school content using Outlook for iOS and Android, you need a Conditional Access policy that targets those potential users.
See the steps to configure this policy in Manage messaging collaboration access by using Outlook for iOS and Android.
Set up message encryption
With the new Office 365 Message Encryption (OME) capabilities, which leverage the protection features in Azure Information Protection, your organization can easily share protected email with anyone on any device. Users can send and receive protected messages with other Microsoft 365 organizations as well as non-customers using Outlook.com, Gmail, and other email services.
For more information, see Set up new Office 365 Message Encryption capabilities.
Configure Conditional Access policies for: