configAnalyzerPolicyRecommendations

Policy Recommendations. Compares threat policies to Standard and Strict baselines. The configAnalyzerPolicyRecommendations entity set lives under /exchange/v1.0/configAnalyzerPolicyRecommendations in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/configAnalyzerPolicyRecommendations
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	none (read-only)
Backing cmdlets	Get-ConfigAnalyzerPolicyRecommendation

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/configAnalyzerPolicyRecommendations	List Defender Config Analyzer recommendations vs the Standard/Strict baselines. Required ?recommendedPolicyType=Standard|Strict.	ThreatPolicy.Read	Community
GET	/exchange/v1.0/configAnalyzerPolicyRecommendations/{key}	Get a single Config Analyzer recommendation by Identity. Requires ?recommendedPolicyType= baseline.	ThreatPolicy.Read	Community

GET /exchange/v1.0/configAnalyzerPolicyRecommendations

List Defender Config Analyzer recommendations vs the Standard/Strict baselines. Required ?recommendedPolicyType=Standard|Strict.

Backing cmdlet: Get-ConfigAnalyzerPolicyRecommendation. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
recommendedPolicyType	query	string		Required: baseline to compare against - Standard or Strict.
isAppliedToDisabled	query	bool (switch)		Include policies that are currently disabled (default: enabled only).

Audit Defender policies against the Strict baseline

Defender Config Analyzer compares the tenant’s Defender for Office 365 policies (anti-phish, safe-attachments, safe-links, malware filter, hosted-content filter) against Microsoft’s Standard or Strict security baselines and returns per-setting recommendations where the tenant’s current value diverges from the baseline. Required query: ?recommendedPolicyType=Standard | Strict. Pass ?isAppliedToDisabled=true to include disabled policies in the audit. Read-only - backed by Get-ConfigAnalyzerPolicyRecommendation (Defender baseline checker).

GET /exchange/v1.0/configAnalyzerPolicyRecommendations HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#configAnalyzerPolicyRecommendations",
  "value": [
    {
      "Id": "rec-antiphish-default-strict-1",
      "PolicyName": "Office365 AntiPhish Default",
      "PolicyType": "AntiPhishPolicy",
      "SettingName": "PhishThresholdLevel",
      "RecommendationType": "ToStrict",
      "CurrentValue": "2",
      "RecommendedValue": "4"
    },
    {
      "Id": "rec-safelinks-default-strict-1",
      "PolicyName": "Built-In Protection Policy",
      "PolicyType": "SafeLinksPolicy",
      "SettingName": "EnableSafeLinksForEmail",
      "RecommendationType": "ToStrict",
      "CurrentValue": "True",
      "RecommendedValue": "True"
    }
  ]
}

Related: GET /exchange/v1.0/antiPhishPolicies, GET /exchange/v1.0/safeLinksPolicies

GET /exchange/v1.0/configAnalyzerPolicyRecommendations/{key}

Get a single Config Analyzer recommendation by Identity. Requires ?recommendedPolicyType= baseline.

Backing cmdlet: Get-ConfigAnalyzerPolicyRecommendation. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
recommendedPolicyType	query	string		Required: baseline (Standard or Strict).