| The priority accounts in Microsoft 365 are a security tool that allows administrators to mark up to 250 high-value accounts, including executives, IT, and financial staff, for added security measures and advanced mail flow monitoring. After marking, the user gets two tools: priority account protection in Microsoft Defender for Office 365, which provides differentiated security policies and more proactive threat detection based on the priority account tag; and premium mail flow monitoring, which monitors mail flow to those users and provides notifications if there is delivery failure or delay beyond a threshold. Priority accounts can be set up in the Microsoft 365 Admin Center under Setup > Organizational Knowledge. |
IT personnel, managers, executives, and those from finance handle sensitive information more than the typical end-user, thus making them the typical targets for cybercriminals and phishers. The most expensive attacks that involve phishing are business email compromise (BEC) attacks that make the attacker impersonate or hijack the executive accounts to perform fraudulent transactions and cost billions of dollars each year.
To bridge this gap, Microsoft came up with Priority Accounts that allow organizations to offer differentiated protection to their at-risk employees without having to change their license tiers.
|
User Type |
Reason for Priority Designation |
|
C-suite executives |
High-value impersonation targets; BEC fraud risk |
|
IT administrators |
Access to infrastructure, credentials, and system controls |
|
Finance and treasury staff |
Authority to initiate wire transfers and payments |
|
Legal and compliance leaders |
Access to confidential contracts, IP, and regulatory data |
|
HR leadership |
Access to employee PII, payroll, and sensitive records |
|
Board members |
Access to strategic data; limited day-to-day IT support |
Once the user is labeled as a priority account by the admin, this label is assigned to the account at the system level. This label is further used in Microsoft 365 services for differentiated protection in terms of threat detection, monitoring, and visibility reporting. A maximum of 250 priority accounts can be monitored by an organization. Currently, there are two capabilities for this feature that Microsoft will expand on in the future as per the requirements of application-based capabilities.
Priority Account Protection in Microsoft Defender for Office 365 considers the users who are assigned priority accounts as system-level tags. It helps the security team to use the tags in Threat Explorer, email entity pages, alerts and investigations, and AIR reports to know about the targeted high-priority users.
Source: Microsoft Tech Community
Premium Mail Flow Monitoring provides dedicated monitoring of email deliveries for priority accounts users. The administrator defines thresholds for delayed/failed deliveries, and the system triggers an alert if the threshold is met. Reports reveal trends in failed and delayed deliveries as well as trends in mail flows for priority accounts compared to organizational averages, and this is important for executives.
Up to 250 priority accounts can be tracked. Use these instructions to set up priority accounts.
Method 1: From Setup page. Go to Microsoft 365 Admin Center and then select Setup > Organizational Knowledge. Then click View below Monitor your most important accounts. Click either Get started or Manage, find users that you want to track on the page Add priority accounts, select users, and click Save.
Method 2: From Active Users page. Navigate to Users > Active Users, click Ellipsis(...) and then select Manage priority accounts. Click Add accounts, find users, select them, and then click Save.
To delete a user, you should go to Setup > Organizational Knowledge, click View, click Priority accounts under the heading Manage this feature, select a user and then click Remove accounts.
Since you have already tightened the security for your executive and finance accounts, you might consider securing the contracts signed by them as well. Request a demo to learn how Dock 365 helps keep sensitive contracts protected within the Microsoft 365 environment.