Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added script to check MDO and EOP user inclusion and logic of multiple threat policies. #2124

Merged
merged 5 commits into from
Jul 17, 2024

Conversation

iserrano76
Copy link
Contributor

This script checks which Microsoft Defender for Office 365 and Exchange Online Protection threat policies cover a particular user, including anti-malware, anti-phishing, inbound and outbound anti-spam, as well as Safe Attachments and Safe Links policies in case these are licensed for your tenant.
In addition, the script can check for threat policies that have inclusion and/or exclusion settings that may be redundant or confusing and lead to missed coverage of users or coverage by an unexpected threat policy.

To check all threat policies for potentially confusing user inclusion and/or exclusion conditions and print them out for review, run the following:
.\MDOThreatPolicyChecker.ps1
Example output:
image

To provide a CSV input file with email addresses and see both EOP and MDO policies, run the following: .\MDOThreatPolicyChecker.ps1 -CsvFilePath [Path\filename.csv] -IncludeMDOPolicies
Example output:
image

To provide multiple email addresses by command line and see only EOP policies, run the following: .\MDOThreatPolicyChecker.ps1 -EmailAddresses user1@domainX.com,user2@domainY.com
Example output:
image

To see the details of the policies for EOP, run the following:
.\MDOThreatPolicyChecker.ps1 - EmailAddresses user1@domainX.com,user2@domainY.com -IncludeMDOPolicies -ShowDetailedPolicies
image

Continuation of #2097

@iserrano76 iserrano76 requested a review from a team as a code owner July 2, 2024 15:20
@dpaulson45 dpaulson45 added New Tool Request Requesting of a new tool to be created Ready for review Pull Request is ready to be reviewed labels Jul 2, 2024
@dpaulson45 dpaulson45 self-requested a review July 11, 2024 20:04
@dpaulson45
Copy link
Member

Wait to merge till release pipeline is fixed.

@bill-long bill-long merged commit 5bde706 into microsoft:main Jul 17, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
New Tool Request Requesting of a new tool to be created Ready for review Pull Request is ready to be reviewed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants