Exchange Online protection controls

Preset policies, SPF, DKIM and DMARC to p=reject, no silent forwarding, and Defender for Office 365 set up properly.

ID	Control	Priority	Effort
EX01	Turn on the Standard preset security policy for all users (Strict for priority accounts)	Highest	2 h
EX02	Block automatic forwarding to external addresses and review the forwards that already exist	Highest	2 h
EX03	Publish SPF and turn on DKIM signing for every domain that sends mail	Highest	3 h
EX04	Publish DMARC for every domain and move it from p=none to p=reject	High	1 h set-up + 4 to 8 weeks monitoring
EX05	Anti-malware: common attachments filter on with Reject, zero-hour auto purge on, admin-only quarantine	High	30 min

These are the free Top 5. The Exchange Online Protection Kit has all 20 controls, with the Jira import, Excel plan and read-only script.