Vulnerability V-223351

Note: If the Outlook client application is not used to access Office 365 email (i.e., email is only accessed via Outlook Web Access [OWA]), this is not applicable. Verify Outlook Junk E-mail protection is set to "No Automatic Filtering". In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options. Verify Junk E-mail protection is set to "No Automatic Filtering". If the system being inspected is not behind EEMSG, CBII, or O365 EOP, the Junk E-mail protection level must be set to "High". Otherwise, "Low" is acceptable. If Junk E-mail protection is not set to "No Automatic Filtering", this is a finding. If the system is not behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP and the Junk E-mail protection is not set to "High", this is a finding. If the system is behind enterprise-level capabilities such as EEMSG, CBII, or O365 EOP, and the Junk E-mail protection is not at least "Low", this is a finding.

In Outlook, click Home tab >> Delete group >> Junk >> Junk E-mail Options. Set the Junk E-mail protection level to "No Automatic Filtering".