Ensure the connection filter IP allow list is empty

MittelStufe 1Automatisiertm365

Beschreibung

Mail from IPs on the connection filter allow list skips spam filtering, so a compromised or shared IP becomes a phishing channel. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $p = Get-HostedConnectionFilterPolicy -Identity Default -ErrorAction Stop; @($p.IPAllowList | Where-Object { $_ }).Count

Erwartete Ausgabe: 0

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @{} (use mail flow rules or Tenant Allow/Block List entries for justified exceptions).

Eigenschaften

Betriebssysteme: Beliebig
Tags: m365mail-flow
Referenz: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Exchange Online Protection / Connection filter IP allow list (verify section number for your release)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target m365