Ensure the connection filter IP allow list is empty

MediaNivel 1Automatizadam365

Descripción

Mail from IPs on the connection filter allow list skips spam filtering, so a compromised or shared IP becomes a phishing channel. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

Cómo se verifica

Método de auditoría: Comando de shell

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $p = Get-HostedConnectionFilterPolicy -Identity Default -ErrorAction Stop; @($p.IPAllowList | Where-Object { $_ }).Count

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @{} (use mail flow rules or Tenant Allow/Block List entries for justified exceptions).

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: m365mail-flow
Referencia: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Exchange Online Protection / Connection filter IP allow list (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target m365