Reference
Policies for Exchange
See the Exchange inventory reference for the objects these templates work on.
| Policy | Description | Severity | Category | Checks |
|---|---|---|---|---|
| Admin audit log disabled ⭐ | Detects when the Exchange admin audit log is disabled, preventing forensic reconstruction of admin actions. The Exchange admin audit log is the primary forensic source for incident response. When disabled, attacker actions (transport rule changes, permission grants) cannot be reconstructed. | High | Security | Exchange Organization Configuration |
| Mailboxes with auto-reply always enabled | Shows mailboxes whose automatic reply is set to 'always enabled' (no end date). Mailboxes with auto-reply set to 'always enabled' are typically a forgotten OOF that has lost its scheduled end date. Check whether the user has returned and disable the reply. | Low | Operation | Mailbox |
| Mailboxes auto-replying to all external senders ⭐ | Shows mailboxes whose auto-reply is enabled and configured to reply to all external senders. Auto-replies sent to all external senders leak signal to attackers (confirms the account exists, discloses OOF text, calendar info or alternate contacts). Restrict to 'contacts only' or 'none' for sensitive users. | Medium | Security | Mailbox |
| Mailbox folder shared with Default or Anonymous ⭐ | Detects mailbox folders (calendar, inbox) granted to 'Default' or 'Anonymous' permission entries. Folder permissions granted to 'Default' or 'Anonymous' broadcast calendar / inbox content broadly. Anonymous calendar sharing is a silent data leak no admin UI surfaces. | High | Security | Mailbox Folder Permission |
| Calendars shared with external users ⭐ | Shows calendar permissions granted to users outside of the organization. Calendars shared with external users (or 'Anonymous' / 'Default' organization-wide) leak meeting subjects, attendees and free/busy patterns useful for social engineering. Restrict permissions to 'AvailabilityOnly' for external sharing. | Medium | Security | Calendar Permission |
| Calendars with write/delegate access | Shows calendar permissions that grant write or delegate access to other users. Calendar permissions granting 'write' or 'delegate' rights are intended for assistants or close colleagues. Audit them periodically — these accounts can create, modify and remove appointments on behalf of the owner. | Low | Security | Calendar Permission |
| Mail flow connector with wildcard domain | Detects inbound or outbound connectors with wildcard sender or recipient domains. Mail flow connectors with wildcard sender or recipient domains are overly broad and a known misconfiguration pattern. | Medium | Security | Mail Flow Connector |
| Defender policy drifts from Standard baseline ⭐ | Detects Defender / EOP security policies that deviate from Microsoft's recommended Standard preset. Defender policy drifts from Microsoft's Standard baseline. Replicates the built-in Configuration Analyzer as a continuous check. | Medium | Security | Exchange Security Policy |
| Accepted domain without DKIM signing ⭐ | Detects accepted domains where DKIM signing is not enabled. Accepted domains without DKIM signing are vulnerable to spoofing. | Medium | Security | Accepted Domain |
| Distribution group accepts external mail | Detects distribution lists that allow external senders to deliver messages. Distribution lists that accept mail from external senders without authentication are phishing relay risks. | Medium | Security | Distribution Group |
| EWS application access unrestricted | Detects when no EWS application access policy is configured, allowing all apps to call EWS. When the EWS application access policy is left unrestricted (no allow- or block-list), every third-party app the user installs can call EWS against their mailbox. Restrict via 'EnforceAllowList' or 'EnforceBlockList'. | Medium | Security | Exchange Organization Configuration |
| Mailbox forwarding setting changed ⭐ | Detects audit events whose parameters indicate a mailbox forwarding setting was changed. Mailbox forwarding setting changes (Set-Mailbox -ForwardingSmtpAddress, -ForwardingAddress, -DeliverToMailboxAndForward) are the primary BEC data-exfil pattern. Investigate every change. | High | Security | Exchange Audit Event |
| Inactive mailboxes (90+ days) ⭐ | Shows mailboxes that have not had any send/receive/read activity for more than 90 days. Mailboxes with no activity for more than 90 days are likely abandoned. Review whether the user still needs the mailbox or whether it can be archived to reclaim the license. | Medium | Declutter | Mailbox |
| Journal rule sends to external recipient ⭐ | Detects Exchange journal rules whose journal mailbox is in an external domain. Journal rules forwarding to external recipients should be carefully reviewed — they can be (mis)used as a tenant-wide data exfiltration channel under the guise of compliance. | High | Security | Journal Rule |
| Very large mailboxes (90+ GB) | Shows mailboxes whose total storage exceeds 90 GB. Very large mailboxes degrade Outlook performance and may exceed cloud limits. Consider archive policy or content cleanup. | Low | Operation | Mailbox |
| Large mailboxes without archive ⭐ | Shows mailboxes larger than 50 GB that do not have an online archive enabled. Large mailboxes without an online archive grow unmanaged and approach quota. Enable the archive and apply a retention policy to move older content automatically. | Medium | Operation | Mailbox |
| Account excluded from mailbox audit ⭐ | Detects accounts whose mailbox activity is excluded from audit logging. Accounts with mailbox audit bypass enabled can read mail without leaving an audit trail. | High | Security | Mailbox Audit Bypass |
| Mailbox delegation granted to external user ⭐ | Detects Full Access or Send-As permissions granted to users outside the mailbox owner's domain. Mailbox delegations granted to external users are extremely high-risk — Full Access or Send-As to an outside domain represents potential account takeover. | High | Security | Mailbox Delegate |
| Mailboxes near storage quota ⭐ | Shows mailboxes that have used more than 80% of their prohibit-send quota. Mailboxes above 80% of their prohibit-send quota will soon be unable to send mail. Either raise the quota, archive content, or coach the user on cleanup. | High | Operation | Mailbox |
| Mailbox permission granted ⭐ | Detects audit events where mailbox or recipient permissions were added or removed. Mailbox permission grants (Add-MailboxPermission, Add-RecipientPermission) are sensitive — review whether the grantee is expected and whether the permission level (FullAccess / SendAs) is appropriate. | Medium | Security | Exchange Audit Event |
| Mailboxes with external redirect rules | Shows mailboxes which have redirect rules that redirect to external domains | High | Security | Mailbox |
| Stale Exchange ActiveSync device | Detects mobile device partnerships that have not synced in 90 days. Stale ActiveSync device partnerships often correspond to lost devices or departed users. | Low | Declutter | Mobile Device |
| Remote domain permits auto-forward ⭐ | Detects remote domains where automatic forwarding is allowed. Remote domains with AutoForwardEnabled=true permit unconditional mail forwarding to that domain. Combined with an inbox rule, this is the classic exfiltration channel. Disable AutoForwardEnabled on the Default remote domain. | High | Security | Remote Domain |
| Direct role assignment bypassing role groups | Detects Exchange RBAC role assignments granted directly to users instead of via role groups. Direct RBAC role assignments bypass role-group governance and are an auditor blind spot. | Medium | Security | Exchange Role Assignment |
| Resource mailbox without delegate | Detects room or equipment mailboxes that have no approval delegate assigned. Room mailboxes without any approval delegate run unmanaged — booking conflicts and orphaned reservations grow over time. | Low | Operation | Resource Mailbox |
| Safe Links policy allows click-through | Detects Safe Links policies where users can click through warnings on phishing URLs. Safe Links policies that allow user click-through let users override warnings on detected phishing URLs. | Medium | Security | Exchange Security Policy |
| Shared mailboxes with high storage | Shows shared mailboxes that have used more than 60% of their prohibit-send quota. Shared mailboxes typically receive content from many users and grow without an owner watching them. When they exceed 60% of quota they need active cleanup or quota increase. | Medium | Operation | Mailbox |
| Tenant allows external auto-forwarding ⭐ | Detects when the outbound spam policy 'AutoForwardingMode' is not set to 'Off', allowing users to auto-forward mail externally. Microsoft's #1 hardening recommendation for Exchange Online is to disable external auto-forwarding tenant-wide. When 'AutoForwardingMode' is set to 'On' or 'Automatic', any user can forward all incoming mail to an external address — the most common BEC data-exfil pattern. | High | Security | Exchange Organization Configuration |
| Mailboxes with excessive redirect rules ⭐ | Shows mailboxes with more than 10 redirect rules — a known attacker-persistence pattern. Mailboxes with more than 10 redirect rules are likely the result of attacker persistence (rules used to hide phishing replies). Review the rules and remove unauthorized ones. | Medium | Security | Mailbox |
| Transport rule modified ⭐ | Detects audit events where an Exchange transport rule was created, modified, or removed. Transport rule changes are a high-signal indicator of attacker persistence (rules used to redirect mail, hide phishing replies). Investigate every modification and confirm it was authorized. | High | Security | Exchange Audit Event |
| Transport rule redirecting to external recipients ⭐ | Detects mail flow rules that silently redirect or BCC messages to external domains. Transport rules redirecting or BCC'ing to external recipients are a top BEC / data exfiltration vector. | High | Security | Transport Rule |