Added script to check MDO and EOP user inclusion and logic of multiple threat policies. #2124
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This script checks which Microsoft Defender for Office 365 and Exchange Online Protection threat policies cover a particular user, including anti-malware, anti-phishing, inbound and outbound anti-spam, as well as Safe Attachments and Safe Links policies in case these are licensed for your tenant.
In addition, the script can check for threat policies that have inclusion and/or exclusion settings that may be redundant or confusing and lead to missed coverage of users or coverage by an unexpected threat policy.
To check all threat policies for potentially confusing user inclusion and/or exclusion conditions and print them out for review, run the following:

.\MDOThreatPolicyChecker.ps1
Example output:
To provide a CSV input file with email addresses and see both EOP and MDO policies, run the following: .\MDOThreatPolicyChecker.ps1 -CsvFilePath [Path\filename.csv] -IncludeMDOPolicies

Example output:
To provide multiple email addresses by command line and see only EOP policies, run the following: .\MDOThreatPolicyChecker.ps1 -EmailAddresses user1@domainX.com,user2@domainY.com

Example output:
To see the details of the policies for EOP, run the following:

.\MDOThreatPolicyChecker.ps1 - EmailAddresses user1@domainX.com,user2@domainY.com -IncludeMDOPolicies -ShowDetailedPolicies
Continuation of #2097