Detections
Analytics

6.2.2 Ensure mail transport rules do not whitelist specific domains

Information

Mail flow rules (transport rules) in Exchange Online can be configured to set the spam confidence level (SCL) of a message to -1, which bypasses spam and phishing filtering. When a rule applies this action to messages based on the sender's domain, all mail from that domain is treated as trusted and skips anti-malware and anti-phishing evaluation
regardless of message content.

Whitelisting domains in transport rules bypasses regular malware and phishing scanning, which can enable an attacker to launch attacks against your users from a safe haven domain.

Note: If an organization identifies a business need for an exception, the domain should only be whitelisted if inbound emails from that domain originate from a specific IP address. These exceptions should be documented and regularly reviewed.

Solution

To remediate using the UI:

 - Navigate to Exchange admin center https://admin.exchange.microsoft.com
 - Click to expand Mail Flow and then select Rules.
 - For each rule that sets the spam confidence level to -1 for a specific domain, select the rule and click Delete.

To remediate using PowerShell:

 - Connect to Exchange online using Connect-ExchangeOnline.
 - To remove a specific non-compliant rule:

Remove-TransportRule -Identity "RuleName"

Note: If the rule serves a legitimate purpose beyond domain whitelisting, consider
modifying it to remove the SenderDomainIs condition or the SetSCL -1 action rather
than deleting it entirely.

Impact:

Removing SCL bypass rules will subject previously whitelisted domains to standard spam and phishing filtering. Mail from those domains that does not pass filtering may be quarantined or rejected, which could disrupt established business communications. Prior to removal, identify any rules in scope and coordinate with affected business owners. If a legitimate need exists, consider replacing domain-based whitelisting with approved sender lists at the connection level.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: microsoft_azure

Control ID: 9a6aa9305a597db9c5b44fa70143ea6ee2b5ad20ce491da56499e012950413ce