Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
exchange_transport_rules_whitelist_disabledProvider: Microsoft 365
Service:
exchangeSeverity: HIGH
Categories:
email-security, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Exchange Online mail flow rules that whitelist specific sender domains by forcingSCL to -1 (skip spam filtering) on matching messages
Risk
Domain-based whitelisting skips anti-spam/phish analysis, allowing spoofed or compromised senders to reach the Inbox. This increases targeted phishing, BEC, and credential theft, enabling unauthorized access and data exfiltration, degrading confidentiality and integrity.Recommendation
Avoid blanket whitelisting. Do not setSCL to -1 based solely on sender domain.
- Prefer controlled allow mechanisms with review/expiry; keep anti-spam/phish active
- If exceptions are unavoidable, apply least privilege: add strong conditions (auth results, known source IPs), narrow scope, time-bound, and monitor
Remediation
- CLI
- Dashboard steps
Set-TransportRule -Identity <RuleName> -SetSCL 0
References
- https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl
- https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/configuration-best-practices
- https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = exchange_transport_rules_whitelist_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks