M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- Medium
- Zero Trust pillar
- Applications & Workloads (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.12.2 recommends that safe lists not be enabled. The connection filter safe list is a dynamic, third-party-sourced list of 'known good' senders whose mail bypasses spam filtering and sender authentication. Because the list is externally curated, enabling it cedes a security bypass decision to a source the organization does not control.
Recommended value
Connection filter policy EnableSafeList set to False for all policies
Remediation
Edit the connection filter policy and ensure the safe list option is turned off (EnableSafeList = False) so externally sourced 'known good' senders do not bypass spam and authentication checks. Verify the setting on the default and any custom connection filter policies. A connection filter IP block list may still be used to block known malicious senders.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-7, SI-8
- CIS M365 Benchmark
- 2.1.13
- MITRE ATT&CK
- T1566.001