Exchange Organization Configuration

Tenant-wide Exchange Online configuration settings.

Part of the Exchange inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Weekly	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	No

Properties

Property	Type	Description	Automation placeholder
Activity-Based Authentication Timeout Enabled	Boolean	Whether OWA activity-based session timeout is enabled.	{{ExchangeOrganizationConfiguration.ActivityBasedAuthenticationTimeoutEnabled}}
Admin Audit Log Retention (days)	Int32	Number of days the admin audit log is retained.	{{ExchangeOrganizationConfiguration.AdminAuditLogAgeLimit}}
Admin Audit Log Enabled	Boolean	Whether the Exchange admin audit log is enabled. Disabled = compliance/forensic gap.	{{ExchangeOrganizationConfiguration.AdminAuditLogEnabled}}
Bookings Enabled	Boolean	Whether Microsoft Bookings is enabled tenant-wide.	{{ExchangeOrganizationConfiguration.BookingsEnabled}}
Bookings Naming Policy Enabled	Boolean	Whether a naming policy is enforced for Bookings mailboxes.	{{ExchangeOrganizationConfiguration.BookingsNamingPolicyEnabled}}
Connectors Enabled	Boolean	Whether Office 365 connectors are enabled tenant-wide.	{{ExchangeOrganizationConfiguration.ConnectorsEnabled}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{ExchangeOrganizationConfiguration.CreatedTime}}
Display Name	String		{{ExchangeOrganizationConfiguration.DisplayName}}
EWS Application Access Policy	String	Policy controlling which apps can call EWS: null (unrestricted), EnforceAllowList, or EnforceBlockList.	{{ExchangeOrganizationConfiguration.EwsApplicationAccessPolicy}}
Identity	String	Tenant identity / organization name as returned by Exchange.	{{ExchangeOrganizationConfiguration.Identity}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{ExchangeOrganizationConfiguration.LastModifiedTime}}
MailTips All Tips Enabled	Boolean	Whether all MailTips are enabled (including external recipient warnings).	{{ExchangeOrganizationConfiguration.MailTipsAllTipsEnabled}}
MailTips External Recipients Enabled	Boolean	Whether the 'external recipients' MailTip is enabled.	{{ExchangeOrganizationConfiguration.MailTipsExternalRecipientsTipsEnabled}}
OAuth2 Client Profile Enabled (modern auth)	Boolean	Whether modern auth (OAuth2 client profile) is enabled tenant-wide.	{{ExchangeOrganizationConfiguration.OAuth2ClientProfileEnabled}}
Outbound Auto-Forwarding Mode	String	Tenant-wide outbound auto-forwarding setting from the default outbound spam filter policy. 'Off' = blocked. 'On' / 'Automatic' = allowed. Allowed values: Automatic, Off, On.	{{ExchangeOrganizationConfiguration.OutboundSpamAutoForwardingMode}}
Reject Direct Send	Boolean	Whether the tenant rejects unauthenticated direct send to its own domains.	{{ExchangeOrganizationConfiguration.RejectDirectSend}}
Risk Score	Int32	Stores risk score	{{ExchangeOrganizationConfiguration.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{ExchangeOrganizationConfiguration.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{ExchangeOrganizationConfiguration.RiskScoreValue}}

Relations

This object does currently not have any relations.

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Policies that check this object

Policy	Severity	Description
Admin audit log disabled	High	Detects when the Exchange admin audit log is disabled, preventing forensic reconstruction of admin actions.
EWS application access unrestricted	Medium	Detects when no EWS application access policy is configured, allowing all apps to call EWS.
Tenant allows external auto-forwarding	High	Detects when the outbound spam policy 'AutoForwardingMode' is not set to 'Off', allowing users to auto-forward mail externally.