Exchange-focused depth
Goes deeper on Exchange Online than any general M365 benchmark — transport rules, connectors, mailbox permissions, and sharing.
Benchmark · Exchange
ORCA — Office 365 Recommended Configuration Analyzer.
Automated. One report.
ORCA is a configuration analyzer focused on Exchange Online, checking a tenant's mail configuration against Microsoft's recommended security settings.
About the baseline
What is ORCA?
ORCA (Office 365 Recommended Configuration Analyzer) was created to answer a simple question: is this Exchange Online tenant configured the way Microsoft recommends? It checks the mail transport, anti-spam, anti-phishing, and sharing settings that are frequently left at insecure defaults, and reports the recommended value for each. For organizations whose primary M365 workload is email, ORCA is the most focused baseline available.
- Maintainer
- Open-source community (Exchange tooling)
- Coverage
- Exchange Online configuration
- License
- MIT
- Source
- GitHub ↗
Capabilities
What ORCA covers
The baseline's scope — we run these checks against your tenant and report the results.
Recommended-value checks
Each control reports the current value alongside Microsoft's recommended value, so the gap is unambiguous.
Anti-phishing & spam posture
Verifies that anti-spam, anti-phishing, and safe-attachment protections are enabled at the recommended thresholds.
External sharing controls
Flags calendars, mailboxes, and transport settings that leak data to external parties by default.
Surface area
Where it looks
Exchange OnlineMail transportAnti-spam & anti-phishingMailbox sharing
Use cases
When it earns its keep
Email security review
For an organization where email is the main risk — legal, finance, healthcare — audit Exchange Online configuration directly.
Post-migration validation
After an Exchange migration or a change to mail flow, confirm the tenant is still configured to Microsoft's recommendations.
Business email compromise prevention
Check the exact mail-transport and forwarding settings that BEC attacks abuse before they are exploited.
Other benchmarks
Add another framework
CIS M365
CIS Microsoft 365 Foundations Benchmark v3.1.0 — 60+ tests across Entra ID, Exchange, Teams, and SharePoint.
CISA SCuBA
US CISA Secure Cloud Business Applications baselines — 70+ tests covering identity, access, devices, and apps.
EIDSCA
Entra ID Security Config Analyzer baseline — 60+ tests from the Microsoft Entra ID Attack and Defense Playbook.
One credit. One tenant. One report.
Run ORCA against a Microsoft 365 tenant and get a severity-ranked PDF. Credits never expire.