M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.2.1 requires that a list of approved IP addresses for sending mail be maintained, which forms the basis of an accurate SPF record. The approved sender list is the authoritative input that determines which hosts may legitimately send mail for each domain. Without a maintained list, an SPF policy cannot be scoped correctly and either fails to block spoofers or blocks legitimate senders.
Valor recomendado
A documented, current list of all approved sending sources per domain (Exchange Online include plus any third-party senders), reflected in the published SPF record
Remediación
Inventory every system that legitimately sends email on behalf of each accepted domain, including Exchange Online (spf.protection.outlook.com), marketing platforms, ticketing systems, and on-premises relays. Record this approved sender list as the source of truth and ensure the published SPF record references exactly those sources. Review the list whenever a new sending service is onboarded or retired so the SPF record stays accurate.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| always-warn | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-8
- MITRE ATT&CK
- T1566.001