Testing/Unit/PowerShell/CreateReport/CreateReportStubs/ProviderSettingsExport.json
|
{
"baseline_version": "0.1", "module_version": "0.3.0", "date": "08/23/2023 12:23:24 Eastern Daylight Time", "tenant_details": [ { "AADAdditionalData": { "AssignedPlans": [ { "AssignedDateTime": "/Date(1682823962000)/", "CapabilityStatus": "Deleted", "Service": "exchange", "ServicePlanId": "113feb6c-3fe4-4440-bddc-54d774bf0318" }, { "AssignedDateTime": "/Date(1676979479000)/", "CapabilityStatus": "Deleted", "Service": "RMSOnline", "ServicePlanId": "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3" }, { "AssignedDateTime": "/Date(1676979478000)/", "CapabilityStatus": "Deleted", "Service": "RMSOnline", "ServicePlanId": "bea4c11e-220a-4e6d-8eb8-8ea15d019f90" }, { "AssignedDateTime": "/Date(1676979478000)/", "CapabilityStatus": "Deleted", "Service": "exchange", "ServicePlanId": "922ba911-5694-4e99-a794-73aed9bfeec8" }, { "AssignedDateTime": "/Date(1676979478000)/", "CapabilityStatus": "Deleted", "Service": "RMSOnline", "ServicePlanId": "5689bec4-755d-4753-8b61-40975025187c" }, { "AssignedDateTime": "/Date(1676979170000)/", "CapabilityStatus": "Deleted", "Service": "Adallom", "ServicePlanId": "8c098270-9dd4-4350-9b30-ba4703f3b36b" }, { "AssignedDateTime": "/Date(1674387225000)/", "CapabilityStatus": "Enabled", "Service": "MIPExchangeSolutions", "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6" }, { "AssignedDateTime": "/Date(1666375096000)/", "CapabilityStatus": "Enabled", "Service": "RMSOnline", "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce" }, { "AssignedDateTime": "/Date(1666375094000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757" }, { "AssignedDateTime": "/Date(1666375094000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftEndpointDLP", "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e" }, { "AssignedDateTime": "/Date(1666375096000)/", "CapabilityStatus": "Enabled", "Service": "RMSOnline", "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98" }, { "AssignedDateTime": "/Date(1666375093000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0" }, { "AssignedDateTime": "/Date(1666375095000)/", "CapabilityStatus": "Enabled", "Service": "Office365InsiderRisk", "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75" }, { "AssignedDateTime": "/Date(1666375094000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7" }, { "AssignedDateTime": "/Date(1666375094000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f" }, { "AssignedDateTime": "/Date(1666300549000)/", "CapabilityStatus": "Enabled", "Service": "Bing", "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftThreatProtection", "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "SharePoint", "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "CRM", "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftCommunicationsOnline", "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "SharePoint", "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692" }, { "AssignedDateTime": "/Date(1666300549000)/", "CapabilityStatus": "Enabled", "Service": "WhiteboardServices", "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "OfficeForms", "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "ProjectWorkManagement", "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftOffice", "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "M365CommunicationCompliance", "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "M365LabelAnalytics", "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "TeamspaceAPI", "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftStream", "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547" }, { "AssignedDateTime": "/Date(1666300549000)/", "CapabilityStatus": "Enabled", "Service": "To-Do", "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67" }, { "AssignedDateTime": "/Date(1666300549000)/", "CapabilityStatus": "Enabled", "Service": "ProjectProgramsAndPortfolios", "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "PowerAppsServiceGCC", "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftCommunicationsOnline", "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "MicrosoftCommunicationsOnline", "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "Fairfax-MicrosoftPowerBI-WFE", "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "M365LabelAnalytics", "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "CRM", "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10" }, { "AssignedDateTime": "/Date(1666300551000)/", "CapabilityStatus": "Enabled", "Service": "RMSOnline", "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "exchange", "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b" }, { "AssignedDateTime": "/Date(1666300550000)/", "CapabilityStatus": "Enabled", "Service": "ProcessSimpleGCC", "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246" }, { "AssignedDateTime": "/Date(1666300529000)/", "CapabilityStatus": "Enabled", "Service": "AzureAdvancedThreatAnalytics", "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f" }, { "AssignedDateTime": "/Date(1666300529000)/", "CapabilityStatus": "Enabled", "Service": "AADPremiumService", "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998" }, { "AssignedDateTime": "/Date(1666300530000)/", "CapabilityStatus": "Enabled", "Service": "AADPremiumService", "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d" }, { "AssignedDateTime": "/Date(1666300529000)/", "CapabilityStatus": "Enabled", "Service": "MultiFactorService", "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0" }, { "AssignedDateTime": "/Date(1666300529000)/", "CapabilityStatus": "Enabled", "Service": "Adallom", "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2" }, { "AssignedDateTime": "/Date(1666300529000)/", "CapabilityStatus": "Enabled", "Service": "SCO", "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5" }, { "AssignedDateTime": "/Date(1646945063000)/", "CapabilityStatus": "Enabled", "Service": "WindowsAzure", "ServicePlanId": "fca3e605-0754-4279-8504-3f1229f29614" }, { "AssignedDateTime": "/Date(1638885214000)/", "CapabilityStatus": "Enabled", "Service": "WindowsDefenderATP", "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef" }, { "AssignedDateTime": "/Date(1616437077000)/", "CapabilityStatus": "Deleted", "Service": "SCO", "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" }, { "AssignedDateTime": "/Date(1614604981000)/", "CapabilityStatus": "Deleted", "Service": "SCO", "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" } ], "Branding": { "BackgroundColor": null, "BackgroundImage": null, "BackgroundImageRelativeUrl": null, "BannerLogo": null, "BannerLogoRelativeUrl": null, "CdnList": null, "CustomAccountResetCredentialsUrl": null, "CustomCannotAccessYourAccountText": null, "CustomCannotAccessYourAccountUrl": null, "CustomCss": null, "CustomCssRelativeUrl": null, "CustomForgotMyPasswordText": null, "CustomPrivacyAndCookiesText": null, "CustomPrivacyAndCookiesUrl": null, "CustomResetItNowText": null, "CustomTermsOfUseText": null, "CustomTermsOfUseUrl": null, "Favicon": null, "FaviconRelativeUrl": null, "HeaderBackgroundColor": null, "HeaderLogo": null, "HeaderLogoRelativeUrl": null, "Id": null, "Localizations": null, "LoginPageLayoutConfiguration": { "IsFooterShown": null, "IsHeaderShown": null, "LayoutTemplateType": null }, "LoginPageTextVisibilitySettings": { "HideAccountResetCredentials": null, "HideCannotAccessYourAccount": null, "HideForgotMyPassword": null, "HidePrivacyAndCookies": null, "HideResetItNow": null, "HideTermsOfUse": null }, "SignInPageText": null, "SquareLogo": null, "SquareLogoDark": null, "SquareLogoDarkRelativeUrl": null, "SquareLogoRelativeUrl": null, "UsernameHintText": null }, "BusinessPhones": ["2025782732"], "CertificateBasedAuthConfiguration": null, "CertificateConnectorSetting": { "CertExpiryTime": null, "ConnectorVersion": null, "EnrollmentError": null, "LastConnectorConnectionTime": null, "LastUploadVersion": null, "Status": null }, "City": "Washington", "Country": null, "CountryLetterCode": "US", "CreatedDateTime": "/Date(1613679244000)/", "DefaultUsageLocation": null, "DeletedDateTime": null, "DirectorySizeQuota": { "Total": 300000, "Used": 1041 }, "DisplayName": "Agency", "Extensions": null, "Id": "3c19c757-3b55-411f-b03f-2bcc514a598d", "IsMultipleDataLocationsForServicesEnabled": null, "MarketingNotificationEmails": [], "MobileDeviceManagementAuthority": {}, "OnPremisesLastSyncDateTime": "/Date(1661362185000)/", "OnPremisesSyncEnabled": true, "PartnerInformation": { "CommerceUrl": null, "CompanyName": null, "CompanyType": null, "HelpUrl": null, "PartnerTenantId": null, "SupportEmails": null, "SupportTelephones": null, "SupportUrl": null }, "PartnerTenantType": null, "PostalCode": "20528-0380", "PreferredLanguage": "en", "PrivacyProfile": { "ContactEmail": "", "StatementUrl": "" }, "ProvisionedPlans": [ { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "Adallom" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "SCO" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "SharePoint" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "SharePoint" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "exchange" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "MicrosoftCommunicationsOnline" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "MicrosoftCommunicationsOnline" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "MicrosoftCommunicationsOnline" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "ProjectWorkManagement" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "Adallom" }, { "CapabilityStatus": "Enabled", "ProvisioningStatus": "Success", "Service": "RMSOnline" }, { "CapabilityStatus": "Deleted", "ProvisioningStatus": "Success", "Service": "SCO" } ], "SecurityComplianceNotificationMails": [], "SecurityComplianceNotificationPhones": [], "Settings": { "ContactInsights": { "DisabledForGroup": null, "Id": null, "IsEnabledInOrganization": null }, "Id": null, "ItemInsights": { "DisabledForGroup": null, "Id": null, "IsEnabledInOrganization": null }, "MicrosoftApplicationDataAccess": { "DisabledForGroup": null, "Id": null, "IsEnabledForAllMicrosoftApplications": null }, "PeopleInsights": { "DisabledForGroup": null, "Id": null, "IsEnabledInOrganization": null }, "ProfileCardProperties": null, "Pronouns": { "Id": null, "IsEnabledInOrganization": null } }, "State": "DC", "Street": "245 Murray Lane", "TechnicalNotificationMails": ["someone@somewhere.org"], "VerifiedDomains": [ { "Capabilities": "Email, OfficeCommunicationsOnline", "IsDefault": true, "IsInitial": true, "Name": "someone.onmicrosoft.com", "Type": "Managed" }, { "Capabilities": "Email, Intune", "IsDefault": false, "IsInitial": false, "Name": "dhs.agency.gov", "Type": "Managed" }, { "Capabilities": "None", "IsDefault": false, "IsInitial": false, "Name": "mail.onmicrosoft.com", "Type": "Managed" }, { "Capabilities": "Email", "IsDefault": false, "IsInitial": false, "Name": "test365.gov", "Type": "Managed" } ], "AdditionalProperties": { "tenantType": "AAD", "onPremisesSyncStatus": [ "System.Collections.Generic.Dictionary`2[System.String,System.Object]" ] } }, "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", "DisplayName": "Agency", "DomainName": "onmicrosoft.com" } ], "scuba_config": {}, "conditional_access_policies": [ { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1618315427741)/", "Description": null, "DisplayName": "Live - MFA SHALL be required for all users", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["mfa"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "34afb953-929e-4c6e-aaac-a73cbd4b9535", "ModifiedDateTime": "/Date(1682375279586)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": [ "exchangeActiveSync", "browser", "mobileAppsAndDesktopClients", "other" ], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": [], "IncludeLocations": ["19da112d-49e5-4699-9c8c-728a47d3016c"] }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": ["7859e6b7-98b3-4c24-89a6-7281cda28be9"], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1618315592170)/", "Description": null, "DisplayName": "Block Logins External to USA", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "31cb4ff8-b286-4153-8e6b-b22ca73d3598", "ModifiedDateTime": "/Date(1660589089368)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["exchangeActiveSync", "other"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1647463691992)/", "Description": null, "DisplayName": "Live - Legacy Authentication SHALL be Blocked", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "99037715-8b47-43a1-9c71-79e52a704944", "ModifiedDateTime": "/Date(1682375421043)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": ["high"], "Users": { "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1647474757009)/", "Description": null, "DisplayName": "Live - High Risk Users SHALL be Blocked", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "74669b8e-fa83-4af6-9141-e01ddcde8ee5", "ModifiedDateTime": "/Date(1690835401844)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": ["high"], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1647480847516)/", "Description": null, "DisplayName": "Live - High Risk Sign-ins SHALL be Blocked", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "b00d17ed-efc7-4aaa-975e-fa59ee7b0436", "ModifiedDateTime": "/Date(1685720218048)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1647536088205)/", "Description": null, "DisplayName": "Live - Session Length SHALL be Limited", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": null, "CustomAuthenticationFactors": null, "Operator": null, "TermsOfUse": null }, "Id": "e430772e-f1c9-4618-9b68-4f125e80a288", "ModifiedDateTime": "/Date(1683901574815)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": "primaryAndSecondaryAuthentication", "FrequencyInterval": "timeBased", "IsEnabled": true, "Type": "days", "Value": 2 } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["All"] } }, "CreatedDateTime": "/Date(1647536401180)/", "Description": null, "DisplayName": "Live - Browser Sessions SHALL NOT be Persistent", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": null, "CustomAuthenticationFactors": null, "Operator": null, "TermsOfUse": null }, "Id": "75fd3dde-7974-4bbf-8912-19f36b9f054d", "ModifiedDateTime": "/Date(1671042607797)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": true, "Mode": "never" }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [ "158c047a-c907-4556-b7ef-446551a6b5f7", "62e90394-69f5-4237-9190-012177145e10", "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", "e8611ab8-c189-46e8-94e1-60213ab1f814", "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "fe930be7-5e62-47db-91af-98c3a49a38b1", "29232cdf-9323-42fd-ade2-1d097af3e4de", "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", "b0f54661-2d74-4c50-afa3-1ec803f12efe" ], "IncludeUsers": [] } }, "CreatedDateTime": "/Date(1648513145374)/", "Description": null, "DisplayName": "Live - MFA SHALL be required for Highly Privileged Roles", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["mfa"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "d62b3de8-455f-42c4-a7f0-31479a7aa572", "ModifiedDateTime": "/Date(1689451663458)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": "include", "Rule": "device.trustType -ne 'AzureAD' -and device.trustType -ne 'ServerAD' -and device.trustType -ne 'Workplace'" }, "ExcludeDeviceStates": [], "ExcludeDevices": [], "IncludeDeviceStates": [], "IncludeDevices": [] }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] } }, "CreatedDateTime": "/Date(1650498176328)/", "Description": null, "DisplayName": "TEST - Require Device Signal using conditions (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "ca4de023-3093-45d5-8111-667010f82a2b", "ModifiedDateTime": "/Date(1654553933475)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["Office365"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": [ "8da76570-8b48-44af-975b-4c377221735b", "ab7a3155-6b08-4580-87d1-54c6e1e57cd1" ] } }, "CreatedDateTime": "/Date(1651243713386)/", "Description": null, "DisplayName": "TEST - Short session length test (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": null, "CustomAuthenticationFactors": null, "Operator": null, "TermsOfUse": null }, "Id": "4c8e5e6e-7803-453e-966b-eea3e33843ef", "ModifiedDateTime": "/Date(1654553471085)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": "primaryAndSecondaryAuthentication", "FrequencyInterval": "timeBased", "IsEnabled": true, "Type": "hours", "Value": 5 } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] } }, "CreatedDateTime": "/Date(1651265768738)/", "Description": null, "DisplayName": "Live - Managed Devices SHOULD be Required (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "ff6e5e8c-8811-41a7-8514-ba4967723500", "ModifiedDateTime": "/Date(1683818479065)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["None"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": ["64720f66-b5cc-41ae-aec7-562f90038952"], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["7a22bd70-341c-4903-a014-d8cfd5c1d75f"] } }, "CreatedDateTime": "/Date(1662149889905)/", "Description": null, "DisplayName": "LIVE - Auth Strength (Limited Users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": [ "fido2", "x509CertificateMultiFactor", "temporaryAccessPassOneTime" ], "CombinationConfigurations": [], "CreatedDateTime": "/Date(1662146338176)/", "Description": "", "DisplayName": "Auth Strength", "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", "ModifiedDateTime": "/Date(1662146338176)/", "PolicyType": "custom", "RequirementsSatisfied": "mfa" }, "BuiltInControls": [], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "7769140e-ec01-425d-a7c9-f4c602cf4ecb", "ModifiedDateTime": "/Date(1662152126085)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["None"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": ["cfb614c8-1563-4001-83c1-93611fac731e"], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": [] } }, "CreatedDateTime": "/Date(1679494674903)/", "Description": null, "DisplayName": "Report - Block CAP Exclusion Test Accounts", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "4b89dfbe-cb48-49f2-90d7-03c46bc7c9be", "ModifiedDateTime": null, "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": [], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": ["urn:user:registersecurityinfo"] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": ["AllTrusted"], "IncludeLocations": ["All"] }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] } }, "CreatedDateTime": "/Date(1682299483531)/", "Description": null, "DisplayName": "Live - MFA registration with temporary access pass (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["mfa"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "3cec5953-bbc0-4fa6-877b-b3b1c84a0813", "ModifiedDateTime": "/Date(1682473922692)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": [], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": ["urn:user:registersecurityinfo"] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": ["AllTrusted"], "IncludeLocations": ["All"] }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] } }, "CreatedDateTime": "/Date(1682474221172)/", "Description": null, "DisplayName": "Live - MFA registration from Trusted Location only (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["block"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "76a7344f-e67a-4469-9ece-8969b249df87", "ModifiedDateTime": null, "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": [], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": ["urn:user:registersecurityinfo"] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": ["AllTrusted"], "IncludeLocations": ["All"] }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] } }, "CreatedDateTime": "/Date(1682474402202)/", "Description": null, "DisplayName": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "3ec71c28-aa3f-44f6-af9d-e64dd55c4d82", "ModifiedDateTime": "/Date(1683818519800)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": [], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": ["urn:user:registerdevice"] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["42dd60ea-57e9-47ea-8a43-a213d36a9cb0"] } }, "CreatedDateTime": "/Date(1682538128295)/", "Description": null, "DisplayName": "Live - Device registration requires MFA (limited users)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["mfa"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "3ad1e26d-8950-4376-8dd5-fd293389e3fa", "ModifiedDateTime": "/Date(1683818557600)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["cafc4ec1-f9e8-4718-942b-69e5b4c896e0"] } }, "CreatedDateTime": "/Date(1683145214503)/", "Description": null, "DisplayName": "Live - Phishing Resistant MFA required (specific guest user)", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": [ "fido2", "x509CertificateMultiFactor", "temporaryAccessPassOneTime" ], "CombinationConfigurations": [], "CreatedDateTime": "/Date(1662146338176)/", "Description": "", "DisplayName": "Auth Strength", "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", "ModifiedDateTime": "/Date(1662146338176)/", "PolicyType": "custom", "RequirementsSatisfied": "mfa" }, "BuiltInControls": [], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "1966019a-244f-4e73-b502-49ddd0d2b868", "ModifiedDateTime": "/Date(1683655324029)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": [], "IncludeApplications": [], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": ["urn:user:registersecurityinfo"] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] } }, "CreatedDateTime": "/Date(1687281553466)/", "Description": null, "DisplayName": "Ted Test - new registration", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": null, "CombinationConfigurations": null, "CreatedDateTime": null, "Description": null, "DisplayName": null, "Id": null, "ModifiedDateTime": null, "PolicyType": null, "RequirementsSatisfied": null }, "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "4fffab6f-b403-4d0c-bd7b-eac25b5cb9f5", "ModifiedDateTime": null, "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabledForReportingButNotEnforced", "AdditionalProperties": {} }, { "Conditions": { "Applications": { "ApplicationFilter": { "Mode": null, "Rule": null }, "ExcludeApplications": ["f5c26e74-f226-4ae8-85f0-b4af0080ac9e"], "IncludeApplications": ["All"], "IncludeAuthenticationContextClassReferences": [], "IncludeUserActions": [] }, "ClientAppTypes": ["all"], "ClientApplications": { "ExcludeServicePrincipals": null, "IncludeServicePrincipals": null, "ServicePrincipalFilter": { "Mode": null, "Rule": null } }, "DeviceStates": { "ExcludeStates": null, "IncludeStates": null }, "Devices": { "DeviceFilter": { "Mode": null, "Rule": null }, "ExcludeDeviceStates": null, "ExcludeDevices": null, "IncludeDeviceStates": null, "IncludeDevices": null }, "Locations": { "ExcludeLocations": null, "IncludeLocations": null }, "Platforms": { "ExcludePlatforms": null, "IncludePlatforms": null }, "ServicePrincipalRiskLevels": null, "SignInRiskLevels": [], "UserRiskLevels": [], "Users": { "ExcludeGroups": [], "ExcludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "ExcludeRoles": [], "ExcludeUsers": [], "IncludeGroups": [], "IncludeGuestsOrExternalUsers": { "ExternalTenants": { "MembershipKind": null }, "GuestOrExternalUserTypes": null }, "IncludeRoles": [], "IncludeUsers": ["d5dd1c3a-c7d2-4f3e-b1cc-333df6c75aa0"] } }, "CreatedDateTime": "/Date(1689075728658)/", "Description": null, "DisplayName": "Phishing Resistant MFA Test Policy", "GrantControls": { "AuthenticationStrength": { "AllowedCombinations": [ "windowsHelloForBusiness", "fido2", "x509CertificateMultiFactor" ], "CombinationConfigurations": [], "CreatedDateTime": "/Date(1638345600000)/", "Description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key", "DisplayName": "Phishing-resistant MFA", "Id": "00000000-0000-0000-0000-000000000004", "ModifiedDateTime": "/Date(1638345600000)/", "PolicyType": "builtIn", "RequirementsSatisfied": "mfa" }, "BuiltInControls": [], "CustomAuthenticationFactors": [], "Operator": "OR", "TermsOfUse": [] }, "Id": "4b5931e7-8b8a-419f-bc2f-c50f2459d198", "ModifiedDateTime": "/Date(1689077524047)/", "SessionControls": { "ApplicationEnforcedRestrictions": { "IsEnabled": null }, "CloudAppSecurity": { "CloudAppSecurityType": null, "IsEnabled": null }, "ContinuousAccessEvaluation": { "Mode": null }, "DisableResilienceDefaults": null, "PersistentBrowser": { "IsEnabled": null, "Mode": null }, "SecureSignInSession": { "IsEnabled": null }, "SignInFrequency": { "AuthenticationType": null, "FrequencyInterval": null, "IsEnabled": null, "Type": null, "Value": null } }, "State": "enabled", "AdditionalProperties": {} } ], "cap_table_data": [ { "Name": "Live - MFA SHALL be required for all users", "State": "On", "Users": ["Users included: All", "Users excluded: 1 specific group"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: 1 specific app" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require multifactor authentication", "Session Controls": ["None"] }, { "Name": "Block Logins External to USA", "State": "On", "Users": ["Users included: All", "Users excluded: 1 specific group"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": [ "Locations included: 1 specific location", "Locations excluded: none", "Client apps included: Exchange ActiveSync Clients, Browser, Mobile apps and desktop clients, Other clients" ], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - Legacy Authentication SHALL be Blocked", "State": "On", "Users": ["Users included: All", "Users excluded: 1 specific group"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: 1 specific app" ], "Conditions": [ "Client apps included: Exchange ActiveSync Clients, Other clients" ], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - High Risk Users SHALL be Blocked", "State": "On", "Users": ["Users included: All", "Users excluded: 1 specific group"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["User risk levels: high", "Client apps included: all"], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - High Risk Sign-ins SHALL be Blocked", "State": "On", "Users": ["Users included: All", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["Sign-in risk levels: high", "Client apps included: all"], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - Session Length SHALL be Limited", "State": "On", "Users": ["Users included: All", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "None", "Session Controls": ["Sign-in frequency (every 2 days)"] }, { "Name": "Live - Browser Sessions SHALL NOT be Persistent", "State": "On", "Users": ["Users included: All", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "None", "Session Controls": ["Persistent browser session (never persistent)"] }, { "Name": "Live - MFA SHALL be required for Highly Privileged Roles", "State": "On", "Users": ["Users included: 9 specific roles", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: 1 specific app" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require multifactor authentication", "Session Controls": ["None"] }, { "Name": "TEST - Require Device Signal using conditions (limited users)", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": [ "Client apps included: all", "Custom device filter in include mode active" ], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "TEST - Short session length test (limited users)", "State": "Report-only", "Users": ["Users included: 2 specific users", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: 1 specific app", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "None", "Session Controls": ["Sign-in frequency (every 5 hours)"] }, { "Name": "Live - Managed Devices SHOULD be Required (limited users)", "State": "On", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", "Session Controls": ["None"] }, { "Name": "LIVE - Auth Strength (Limited Users)", "State": "On", "Users": [ "Users included: 1 specific user, 1 specific group", "Users excluded: None" ], "Apps/Actions": [ "Policy applies to: apps", "Apps included: None", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", "Session Controls": ["None"] }, { "Name": "Report - Block CAP Exclusion Test Accounts", "State": "Report-only", "Users": ["Users included: 1 specific group", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: None", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - MFA registration with temporary access pass (limited users)", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: actions", "User action: Register security info" ], "Conditions": [ "Locations included: all locations", "Locations excluded: all trusted locations", "Client apps included: all" ], "Block/Grant Access": "Allow access but require multifactor authentication", "Session Controls": ["None"] }, { "Name": "Live - MFA registration from Trusted Location only (limited users)", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: actions", "User action: Register security info" ], "Conditions": [ "Locations included: all locations", "Locations excluded: all trusted locations", "Client apps included: all" ], "Block/Grant Access": "Block access", "Session Controls": ["None"] }, { "Name": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: actions", "User action: Register security info" ], "Conditions": [ "Locations included: all locations", "Locations excluded: all trusted locations", "Client apps included: all" ], "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", "Session Controls": ["None"] }, { "Name": "Live - Device registration requires MFA (limited users)", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: actions", "User action: Register or join devices" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require multifactor authentication", "Session Controls": ["None"] }, { "Name": "Live - Phishing Resistant MFA required (specific guest user)", "State": "On", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: None" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", "Session Controls": ["None"] }, { "Name": "Ted Test - new registration", "State": "Report-only", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: actions", "User action: Register security info" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", "Session Controls": ["None"] }, { "Name": "Phishing Resistant MFA Test Policy", "State": "On", "Users": ["Users included: 1 specific user", "Users excluded: None"], "Apps/Actions": [ "Policy applies to: apps", "Apps included: All", "Apps excluded: 1 specific app" ], "Conditions": ["Client apps included: all"], "Block/Grant Access": "Allow access but require authentication strength (Phishing-resistant MFA)", "Session Controls": ["None"] } ], "authorization_policies": [ { "AllowEmailVerifiedUsersToJoinOrganization": true, "AllowInvitesFrom": "adminsAndGuestInviters", "AllowUserConsentForRiskyApps": false, "AllowedToSignUpEmailBasedSubscriptions": true, "AllowedToUseSspr": true, "BlockMsolPowerShell": false, "DefaultUserRoleOverrides": null, "DefaultUserRolePermissions": { "AllowedToCreateApps": false, "AllowedToCreateSecurityGroups": true, "AllowedToCreateTenants": true, "AllowedToReadBitlockerKeysForOwnedDevice": true, "AllowedToReadOtherUsers": true }, "DeletedDateTime": null, "Description": "Used to manage authorization related settings across the company.", "DisplayName": "Authorization Policy", "EnabledPreviewFeatures": [], "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", "Id": "authorizationPolicy", "PermissionGrantPolicyIdsAssignedToDefaultUserRole": [] } ], "secure_score": [ { "ControlCategory": "Identity", "ControlName": "RoleOverlap", "Description": "Ensure that your administrators can accomplish their work with the least amount of privilege assigned to their account. Assigning users roles like Password Administrator or Exchange Online Administrator, instead of Global Administrator, reduces the likelihood of a global administrative privileged account being breached.", "Score": 1, "AdditionalProperties": { "lastSynced": "2023-08-20T09:14:13Z", "IsApplicable": "true", "source": "ingestion", "scoreInPercentage": 100, "count": "138", "implementationStatus": "You have 138 users with least privileged administrative roles." } } ], "admin_consent_policies": [ { "Id": null, "IsEnabled": true, "NotifyReviewers": true, "RemindersEnabled": true, "RequestDurationInDays": 30, "Reviewers": [ "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAccessReviewReviewerScope1" ], "Version": 0 } ], "privileged_users": { "8877d3ff-2f13-46d4-9458-4cdd497befd1": { "DisplayName": "Dylan Gao - CTR", "roles": [ "Exchange Administrator", "Exchange Administrator", "SharePoint Administrator", "Exchange Administrator" ], "OnPremisesImmutableId": null }, "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5": { "DisplayName": "Isabella Magallanez", "roles": ["SharePoint Administrator"], "OnPremisesImmutableId": null }, "d2a550c7-f329-466b-8dfa-c388b65f1a49": { "DisplayName": "Roger Mamika", "roles": ["Global Administrator"], "OnPremisesImmutableId": "Rogeronpremuser" }, "cef8eedb-64d5-48b2-a3e4-b7bda6b7b129": { "DisplayName": "Victor Echeverria - CTR", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "bc6696a2-e821-4d35-80ad-90b981a35f1b": { "DisplayName": "Luke Skywalker 2", "roles": ["Privileged Role Administrator", "User Administrator"], "OnPremisesImmutableId": null }, "21cc87be-6f7b-4bc3-885f-7371e61f4df2": { "DisplayName": "testScubaUser", "roles": ["SharePoint Administrator"], "OnPremisesImmutableId": null }, "38035edd-63a1-4c08-8bd2-ad78d0624057": { "DisplayName": "Shanti Satyapal", "roles": [ "Exchange Administrator", "SharePoint Administrator", "Global Administrator" ], "OnPremisesImmutableId": null }, "2ed0157c-eeb6-456d-a1b1-9e11e403b39b": { "DisplayName": "David Bui - CTR", "roles": [ "Exchange Administrator", "SharePoint Administrator", "Global Administrator", "User Administrator" ], "OnPremisesImmutableId": null }, "d569d130-9206-4c7c-9534-65a8afdc7fac": { "DisplayName": "Julian Burgos", "roles": ["SharePoint Administrator"], "OnPremisesImmutableId": null }, "6066af10-d921-4de6-9ae4-7f01057ec372": { "DisplayName": "Grant Dasher - GOV - AZ", "roles": [ "Exchange Administrator", "Cloud Application Administrator", "Application Administrator", "Privileged Role Administrator", "Privileged Role Administrator", "Exchange Administrator", "Cloud Application Administrator", "SharePoint Administrator", "Global Administrator" ], "OnPremisesImmutableId": "GrantDasherAZonpremuser" }, "f2ac2257-956e-4892-8ced-ec29a4198321": { "DisplayName": "Troy Stevens - CTR - AZ", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "42dd60ea-57e9-47ea-8a43-a213d36a9cb0": { "DisplayName": "Theodore Kolovos - CTR - AZ", "roles": [ "Privileged Role Administrator", "Exchange Administrator", "Global Administrator", "Exchange Administrator", "User Administrator" ], "OnPremisesImmutableId": "Kolovosonpremuser" }, "b07f5e5b-1f08-43ce-a501-c6da20248cc0": { "DisplayName": "Luke Skywalker", "roles": ["Privileged Role Administrator", "User Administrator"], "OnPremisesImmutableId": null }, "0bdffa70-6120-4c17-9ed8-fc6f2332a149": { "DisplayName": "Obi Kenobi", "roles": ["Privileged Role Administrator"], "OnPremisesImmutableId": null }, "6b416798-87b2-4d8b-9d27-543e9608ccb6": { "DisplayName": "Jacob Davis - CTR", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "da9423ea-16dc-4139-a58a-1cc8564191e0": { "DisplayName": "Darth Vader", "roles": ["Exchange Administrator", "Exchange Administrator"], "OnPremisesImmutableId": null }, "c8975770-8c3d-43ef-8466-678584a32de5": { "DisplayName": "Nanda Katikaneni - CTR", "roles": [ "Exchange Administrator", "Global Administrator", "Global Administrator" ], "OnPremisesImmutableId": null }, "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1": { "DisplayName": "Jonathon Evangelista - CTR", "roles": [ "Exchange Administrator", "SharePoint Administrator", "User Administrator" ], "OnPremisesImmutableId": null }, "947f8599-ed00-4cff-b8ea-a925c47a2fdf": { "DisplayName": "Addam Schroll", "roles": [ "Exchange Administrator", "Global Administrator", "Exchange Administrator" ], "OnPremisesImmutableId": null }, "ae71e61c-f465-4db6-8d26-5f3e52bdd800": { "DisplayName": "Alden Hilton - CTR", "roles": [ "Exchange Administrator", "SharePoint Administrator", "Global Administrator", "User Administrator", "Global Administrator" ], "OnPremisesImmutableId": null }, "7b36d094-0211-400b-aabd-3793e9a30fc6": { "DisplayName": "Elijah Agbayani - CTR", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "40c0354d-f1c4-4dc8-8b58-f8aeaa8ebeb0": { "DisplayName": "Prashanth Narayanan - CTR -AZ", "roles": ["SharePoint Administrator"], "OnPremisesImmutableId": null }, "cc7a31ab-d2b5-446a-baf9-84f97c706403": { "DisplayName": "Grant Brown - CTR", "roles": [ "Exchange Administrator", "User Administrator", "SharePoint Administrator", "Global Administrator" ], "OnPremisesImmutableId": "Grantbrownonpremuser" }, "2a8adc58-b7c5-4086-a5cc-244b8df40ce8": { "DisplayName": "Alex Marti - CTR", "roles": [ "Exchange Administrator", "User Administrator", "SharePoint Administrator" ], "OnPremisesImmutableId": "Alexonpremuser" }, "33694aa1-17fe-456d-aa56-0a0bfa1285f1": { "DisplayName": "Richard Crutchfield", "roles": [ "Exchange Administrator", "SharePoint Administrator", "Cloud Application Administrator" ], "OnPremisesImmutableId": null }, "1d2f3021-e930-4b2e-ac3a-ee42f14ec4a4": { "DisplayName": "Richard Mangual", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "54be13e7-3e6b-4e7f-ab1a-e2fce369d7af": { "DisplayName": "David Evensky - CTR", "roles": ["Global Administrator"], "OnPremisesImmutableId": null }, "2fd16b6b-d91f-45e6-b56c-47a222c43386": { "DisplayName": "Thomas Comeau - CTR - AZ", "roles": [ "Cloud Application Administrator", "Application Administrator", "Hybrid Identity Administrator" ], "OnPremisesImmutableId": null }, "d7706382-362d-44ff-b056-7a1d908882c3": { "DisplayName": "Padme Amidala", "roles": [ "Exchange Administrator", "Exchange Administrator", "SharePoint Administrator" ], "OnPremisesImmutableId": null }, "e54ac846-1f5a-4afe-aa69-273b42c3b0c1": { "DisplayName": "Jake Hamzawi - CTR", "roles": ["Application Administrator"], "OnPremisesImmutableId": null } }, "privileged_roles": [ { "DisplayName": "Global Administrator", "RoleTemplateId": "62e90394-69f5-4237-9190-012177145e10", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P15D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P1D" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": true, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [ { "@odata.type": "#microsoft.graph.singleUser", "isBackup": false, "id": "6066af10-d921-4de6-9ae4-7f01057ec372", "description": "grant dasher - gov - az" }, { "@odata.type": "#microsoft.graph.singleUser", "isBackup": false, "id": "f2ac2257-956e-4892-8ced-ec29a4198321", "description": "troy stevens - ctr - az" } ], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "6b416798-87b2-4d8b-9d27-543e9608ccb6", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "947f8599-ed00-4cff-b8ea-a925c47a2fdf", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", "RoleAssignmentScheduleId": "4616f5af-97e5-4849-b8a0-aa1111cee134", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "StartDateTime": "/Date(1647533824543)/", "AdditionalProperties": {} } ] }, { "DisplayName": "User Administrator", "RoleTemplateId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P1D" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": false, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [ { "@odata.type": "#microsoft.graph.groupMembers", "isBackup": false, "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", "description": "privileged escalation approvers" } ], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", "StartDateTime": null, "AdditionalProperties": {} } ] }, { "DisplayName": "Exchange Administrator", "RoleTemplateId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P1D" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": true, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [ { "@odata.type": "#microsoft.graph.groupMembers", "isBackup": false, "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", "description": "privileged escalation approvers" } ], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "d2ed49d6-17b5-475e-b98d-44446308875f", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", "RoleAssignmentScheduleId": "a7621401-7a86-4529-afa1-e8cf6c0b3803", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": "/Date(1648659568260)/", "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", "StartDateTime": null, "AdditionalProperties": {} } ] }, { "DisplayName": "SharePoint Administrator", "RoleTemplateId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P180D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P1D" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": true, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [ { "@odata.type": "#microsoft.graph.groupMembers", "isBackup": false, "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", "description": "privileged escalation approvers" } ], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "d569d130-9206-4c7c-9534-65a8afdc7fac", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "b608333c-67b0-428a-b804-c03e3dd8615a", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", "RoleAssignmentScheduleId": "e501042d-e4d3-4c9b-ae7b-e11e80bfeec1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": "/Date(1691509286140)/", "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "21cc87be-6f7b-4bc3-885f-7371e61f4df2", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", "StartDateTime": null, "AdditionalProperties": {} } ] }, { "DisplayName": "Application Administrator", "RoleTemplateId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "PT2H" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": false, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": ["testme@gmail.com"] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "e54ac846-1f5a-4afe-aa69-273b42c3b0c1", "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", "RoleAssignmentScheduleId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "010295b0-f059-46de-a183-8e1e1c8ece30", "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", "RoleAssignmentScheduleId": "69f5b475-3595-4447-83ff-85b6d7132a0c", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", "StartDateTime": "/Date(1648587304797)/", "AdditionalProperties": {} } ] }, { "DisplayName": "Privileged Role Administrator", "RoleTemplateId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P1D" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": false, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [ { "@odata.type": "#microsoft.graph.groupMembers", "isBackup": false, "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", "description": "privileged escalation approvers" } ], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "0bdffa70-6120-4c17-9ed8-fc6f2332a149", "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", "RoleAssignmentScheduleId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "StartDateTime": null, "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", "RoleAssignmentScheduleId": "b6624013-0364-471b-a861-00aad19e7415", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", "StartDateTime": "/Date(1647482863980)/", "AdditionalProperties": {} } ] }, { "DisplayName": "Cloud Application Administrator", "RoleTemplateId": "158c047a-c907-4556-b7ef-446551a6b5f7", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "PT8H" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["MultiFactorAuthentication", "Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": false, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [ { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "2fd16b6b-d91f-45e6-b56c-47a222c43386", "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", "RoleAssignmentScheduleId": "1d4b4273-5903-490b-b9cf-4658aa1e7019", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", "StartDateTime": "/Date(1648660034457)/", "AdditionalProperties": {} }, { "ActivatedUsing": { "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": null, "EndDateTime": null, "Id": null, "MemberType": null, "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": null, "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": null, "RoleEligibilityScheduleId": null, "StartDateTime": null }, "AppScope": { "DisplayName": null, "Id": null, "Type": null }, "AppScopeId": null, "AssignmentType": "Assigned", "DirectoryScope": { "DeletedDateTime": null, "Id": null }, "DirectoryScopeId": "/", "EndDateTime": null, "Id": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", "MemberType": "Direct", "Principal": { "DeletedDateTime": null, "Id": null }, "PrincipalId": "6066af10-d921-4de6-9ae4-7f01057ec372", "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", "RoleAssignmentScheduleId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", "RoleDefinition": { "AllowedPrincipalTypes": null, "Description": null, "DisplayName": null, "Id": null, "InheritsPermissionsFrom": null, "IsBuiltIn": null, "IsEnabled": null, "ResourceScopes": null, "RolePermissions": null, "TemplateId": null, "Version": null }, "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", "StartDateTime": null, "AdditionalProperties": {} } ] }, { "DisplayName": "Hybrid Identity Administrator", "RoleTemplateId": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", "Rules": [ { "Id": "Expiration_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "P365D" } }, { "Id": "Notification_Admin_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Enablement_Admin_Eligibility", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Eligibility", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": [] } }, { "Id": "Expiration_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": true, "maximumDuration": "P30D" } }, { "Id": "Enablement_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Notification_Admin_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_Admin_Assignment", "Target": { "Caller": "Admin", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Expiration_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", "isExpirationRequired": false, "maximumDuration": "PT8H" } }, { "Id": "Enablement_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", "enabledRules": ["Justification"] } }, { "Id": "Approval_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", "setting": { "isApprovalRequired": false, "isApprovalRequiredForExtension": false, "isRequestorJustificationRequired": true, "approvalMode": "SingleStage", "approvalStages": [ { "approvalStageTimeOutInDays": 1, "isApproverJustificationRequired": true, "escalationTimeInMinutes": 0, "isEscalationEnabled": false, "primaryApprovers": [], "escalationApprovers": [] } ] } } }, { "Id": "AuthenticationContext_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", "isEnabled": false, "claimValue": "" } }, { "Id": "Notification_Admin_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Admin", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Requestor_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Requestor", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } }, { "Id": "Notification_Approver_EndUser_Assignment", "Target": { "Caller": "EndUser", "EnforcedSettings": [], "InheritableSettings": [], "Level": "Assignment", "Operations": ["All"], "TargetObjects": null }, "AdditionalProperties": { "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", "notificationType": "Email", "recipientType": "Approver", "notificationLevel": "All", "isDefaultRecipientsEnabled": true, "notificationRecipients": [] } } ], "Assignments": [] } ], "service_plans": [ { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6", "ServicePlanName": "MIP_S_Exchange", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0", "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX_TOPICEXP", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757", "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7", "ServicePlanName": "SAFEDOCS", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717", "ServicePlanName": "PROJECT_O365_P3_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67", "ServicePlanName": "BPOS_S_TODO_3", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af", "ServicePlanName": "WHITEBOARD_PLAN3", "AdditionalProperties": {} }, { "AppliesTo": "Company", "ProvisioningStatus": "Success", "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff", "ServicePlanName": "MICROSOFT_SEARCH", "AdditionalProperties": {} }, { "AppliesTo": "Company", "ProvisioningStatus": "Success", "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560", "ServicePlanName": "ContentExplorer_Standard", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287", "ServicePlanName": "INFORMATION_BARRIERS", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10", "ServicePlanName": "CDS_O365_P3_GCC", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39", "ServicePlanName": "DYN365_CDS_O365_P3_GCC", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f", "ServicePlanName": "ML_CLASSIFICATION", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e", "ServicePlanName": "MICROSOFTENDPOINTDLP", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94", "ServicePlanName": "MCOSTANDARD_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692", "ServicePlanName": "SHAREPOINTENTERPRISE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f", "ServicePlanName": "PREMIUM_ENCRYPTION", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76", "ServicePlanName": "BI_AZURE_P_2_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246", "ServicePlanName": "FLOW_O365_P3_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e", "ServicePlanName": "POWERAPPS_O365_P3_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec", "ServicePlanName": "SHAREPOINTWAC_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51", "ServicePlanName": "PROJECTWORKMANAGEMENT_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1", "ServicePlanName": "EQUIVIO_ANALYTICS_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28", "ServicePlanName": "TEAMS_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547", "ServicePlanName": "STREAM_O365_E5_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541", "ServicePlanName": "RECORDS_MANAGEMENT", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7", "ServicePlanName": "EXCHANGE_ANALYTICS_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5", "ServicePlanName": "INTUNE_A", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75", "ServicePlanName": "INSIDER_RISK", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6", "ServicePlanName": "THREAT_INTELLIGENCE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "Company", "ProvisioningStatus": "Success", "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516", "ServicePlanName": "ATP_ENTERPRISE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f", "ServicePlanName": "ATA", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb", "ServicePlanName": "CUSTOMER_KEY", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b", "ServicePlanName": "COMMUNICATIONS_DLP", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2", "ServicePlanName": "ADALLOM_S_STANDALONE", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2", "ServicePlanName": "MICROSOFTBOOKINGS", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0", "ServicePlanName": "MFA_PREMIUM", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22", "ServicePlanName": "MCOEV_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192", "ServicePlanName": "MTP", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1", "ServicePlanName": "MCOMEETADV_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af", "ServicePlanName": "OFFICESUBSCRIPTION_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849", "ServicePlanName": "M365_ADVANCED_AUDITING", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c", "ServicePlanName": "MICROSOFT_COMMUNICATION_COMPLIANCE", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5", "ServicePlanName": "MIP_S_CLP1", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3", "ServicePlanName": "MIP_S_CLP2", "AdditionalProperties": {} }, { "AppliesTo": "Company", "ProvisioningStatus": "Success", "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d", "ServicePlanName": "Content_Explorer", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c", "ServicePlanName": "FORMS_GOV_E5", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2", "ServicePlanName": "EXCHANGE_S_ENTERPRISE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526", "ServicePlanName": "LOCKBOX_ENTERPRISE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98", "ServicePlanName": "RMS_S_PREMIUM_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce", "ServicePlanName": "RMS_S_PREMIUM2_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597", "ServicePlanName": "RMS_S_ENTERPRISE_GOV", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998", "ServicePlanName": "AAD_PREMIUM_P2", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d", "ServicePlanName": "AAD_PREMIUM", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66", "ServicePlanName": "INFO_GOVERNANCE", "AdditionalProperties": {} }, { "AppliesTo": "User", "ProvisioningStatus": "Success", "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef", "ServicePlanName": "WINDEFATP", "AdditionalProperties": {} } ], "directory_settings": [ { "DisplayName": "Group.Unified", "Id": "5ce54204-ef8d-44c5-af88-dc8bd4c16069", "TemplateId": "62375ab9-6b52-47ed-826b-58e47e0e304b", "Values": [ { "Name": "NewUnifiedGroupWritebackDefault", "Value": "true" }, { "Name": "EnableMIPLabels", "Value": "False" }, { "Name": "CustomBlockedWordsList", "Value": "" }, { "Name": "EnableMSStandardBlockedWords", "Value": "False" }, { "Name": "ClassificationDescriptions", "Value": "" }, { "Name": "DefaultClassification", "Value": "" }, { "Name": "PrefixSuffixNamingRequirement", "Value": "" }, { "Name": "AllowGuestsToBeGroupOwner", "Value": "False" }, { "Name": "AllowGuestsToAccessGroups", "Value": "True" }, { "Name": "GuestUsageGuidelinesUrl", "Value": "" }, { "Name": "GroupCreationAllowedGroupId", "Value": "67f62883-f97a-4192-a300-8a1576af8056" }, { "Name": "AllowToAddGuests", "Value": "True" }, { "Name": "UsageGuidelinesUrl", "Value": "" }, { "Name": "ClassificationList", "Value": "" }, { "Name": "EnableGroupCreation", "Value": "False" } ], "AdditionalProperties": {} }, { "DisplayName": "Consent Policy Settings", "Id": "62c1305f-60f0-4096-8d72-e1f74e8627f5", "TemplateId": "dffd5d46-495d-40a9-8e21-954ff55e198a", "Values": [ { "Name": "EnableGroupSpecificConsent", "Value": "false" }, { "Name": "BlockUserConsentForRiskyApps", "Value": "true" }, { "Name": "EnableAdminConsentRequests", "Value": "true" }, { "Name": "ConstrainGroupSpecificConsentToMembersOfGroupId", "Value": "" } ], "AdditionalProperties": {} } ], "authentication_method": [ { "AuthenticationMethodConfigurations": [ "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration" ], "Description": "The tenant-wide policy that controls which authentication methods are allowed in the tenant, authentication method registration requirements, and self-service password reset settings", "DisplayName": "Authentication Methods Policy", "Id": "authenticationMethodsPolicy", "LastModifiedDateTime": "/Date(1684278552414)/", "PolicyMigrationState": "preMigration", "PolicyVersion": "1.5", "ReconfirmationInDays": null, "RegistrationEnforcement": { "AuthenticationMethodsRegistrationCampaign": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodsRegistrationCampaign" }, "SystemCredentialPreferences": { "ExcludeTargets": "", "IncludeTargets": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphIncludeTarget", "State": "default" } } ], "aad_successful_commands": [ "Get-MgBetaIdentityConditionalAccessPolicy", "Get-MgBetaSubscribedSku", "Get-PrivilegedUser", "Get-PrivilegedRole", "Get-MgBetaPolicyAuthorizationPolicy", "Get-MgBetaSecuritySecureScore", "Get-MgBetaDirectorySetting", "Get-MgBetaPolicyAuthenticationMethodPolicy" ], "aad_unsuccessful_commands": [], "protection_policy_rules": [ { "HostedContentFilterPolicy": "Strict Preset Security Policy1681329956650", "AntiPhishPolicy": "Strict Preset Security Policy1681329955447", "MalwareFilterPolicy": "Strict Preset Security Policy1681329957931", "State": "Enabled", "Priority": 0, "Comments": null, "Description": "Take the following actions:rntApply hosted content filter policy 'Strict Preset Security Policy1681329956650'., Apply AntiPhish policy 'Strict Preset Security Policy1681329955447'., Apply malware filter policy 'Strict Preset Security Policy1681329957931'.rn", "RuleVersion": { "Major": 14, "Minor": 0, "Build": 0, "Revision": 0, "MajorRevision": 0, "MinorRevision": 0 }, "SentTo": null, "SentToMemberOf": null, "RecipientDomainIs": null, "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": null, "Exceptions": null, "Identity": "Strict Preset Security Policy", "DistinguishedName": "CN=Strict Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", "ImmutableId": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "Strict Preset Security Policy", "IsValid": true, "WhenChanged": "/Date(1689096663000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" }, { "HostedContentFilterPolicy": "Standard Preset Security Policy1659535432883", "AntiPhishPolicy": "Standard Preset Security Policy1659535429826", "MalwareFilterPolicy": "Standard Preset Security Policy1659535435292", "State": "Enabled", "Priority": 1, "Comments": null, "Description": "Take the following actions:rntApply hosted content filter policy 'Standard Preset Security Policy1659535432883'., Apply AntiPhish policy 'Standard Preset Security Policy1659535429826'., Apply malware filter policy 'Standard Preset Security Policy1659535435292'.rn", "RuleVersion": { "Major": 14, "Minor": 0, "Build": 0, "Revision": 0, "MajorRevision": 0, "MinorRevision": 0 }, "SentTo": null, "SentToMemberOf": null, "RecipientDomainIs": null, "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": null, "Exceptions": null, "Identity": "Standard Preset Security Policy", "DistinguishedName": "CN=Standard Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "83318c49-93e8-497b-8fd3-614b090e6103", "ImmutableId": "83318c49-93e8-497b-8fd3-614b090e6103", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "Standard Preset Security Policy", "IsValid": true, "WhenChanged": "/Date(1690471889000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" } ], "dlp_compliance_policies": [ { "Mode": "Enable", "DisplayName": "Default Office 365 DLP policy", "Type": "Dlp", "ExchangeLocation": ["All"], "SharePointLocation": ["All"], "SharePointLocationException": [], "OneDriveLocation": ["All"], "OneDriveLocationException": [], "ExchangeOnPremisesLocation": [], "SharePointOnPremisesLocation": [], "SharePointOnPremisesLocationException": [], "TeamsLocation": ["All"], "TeamsLocationException": [], "EndpointDlpLocation": ["All"], "EndpointDlpLocationException": [], "ThirdPartyAppDlpLocation": [], "ThirdPartyAppDlpLocationException": [], "OnPremisesScannerDlpLocation": ["All"], "OnPremisesScannerDlpLocationException": [], "PowerBIDlpLocation": [], "PowerBIDlpLocationException": [], "ExchangeSender": [], "ExchangeSenderException": [], "PolicyTemplateInfo": {}, "MatchedItemsCount": null, "TotalItemsCount": null, "TopNLocationStatistics": null, "WorkloadStatistics": null, "IsSimulationPolicy": false, "SimulationStatus": null, "AutoEnableAfter": null, "ExtendedProperties": null, "Summary": false, "OneDriveSharedBy": [], "ExceptIfOneDriveSharedBy": [], "OneDriveSharedByMemberOf": [], "ExceptIfOneDriveSharedByMemberOf": [], "ExchangeSenderMemberOf": [], "ExchangeSenderMemberOfException": [], "ExpectedLocations": 0, "CompletedLocations": 0, "FailedLocations": 0, "ItemStatistics": null, "RuleMatchBlob": null, "ErrorMetadata": null, "UserAdministrativeUnitMembershipMap": null, "ForceValidate": false, "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-04-25T18:43:47.10409Z'}", "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", "Priority": 0, "ObjectVersion": "ed2f16ae-251f-4a91-2908-08db45bd0101", "CreatedBy": "", "LastModifiedBy": "Addam Schroll", "ReadOnly": false, "ExternalIdentity": "", "Comment": "This policy detects the presence of credit card numbers in externally shared documents and emails. End users are notified of the detection with the suggestion to consider either removing the sensitive data or restricting the sharing.", "Enabled": true, "DistributionStatus": "Pending", "DistributionResults": null, "LastStatusUpdateTime": null, "ModificationTimeUtc": "/Date(1682462627107)/", "CreationTimeUtc": "/Date(1614652120970)/", "PolicyRBACScopes": [], "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Default Office 365 DLP policy", "DistinguishedName": "CN=Default Office 365 DLP policy,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedPolicy"], "WhenChanged": "/Date(1682448226000)/", "WhenCreated": "/Date(1617646100000)/", "WhenChangedUTC": "/Date(1682448226000)/", "WhenCreatedUTC": "/Date(1617646100000)/", "ExchangeObjectId": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "Guid": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", "OriginatingServer": "", "ObjectState": "Changed" }, { "Mode": "Enable", "DisplayName": "agency DLP Policy for PII", "Type": "Dlp", "ExchangeLocation": ["All"], "SharePointLocation": ["All"], "SharePointLocationException": [], "OneDriveLocation": ["All"], "OneDriveLocationException": [], "ExchangeOnPremisesLocation": [], "SharePointOnPremisesLocation": [], "SharePointOnPremisesLocationException": [], "TeamsLocation": ["All"], "TeamsLocationException": [], "EndpointDlpLocation": [], "EndpointDlpLocationException": [], "ThirdPartyAppDlpLocation": [], "ThirdPartyAppDlpLocationException": [], "OnPremisesScannerDlpLocation": [], "OnPremisesScannerDlpLocationException": [], "PowerBIDlpLocation": [], "PowerBIDlpLocationException": [], "ExchangeSender": [], "ExchangeSenderException": [], "PolicyTemplateInfo": {}, "MatchedItemsCount": null, "TotalItemsCount": null, "TopNLocationStatistics": null, "WorkloadStatistics": null, "IsSimulationPolicy": false, "SimulationStatus": null, "AutoEnableAfter": null, "ExtendedProperties": null, "Summary": false, "OneDriveSharedBy": [], "ExceptIfOneDriveSharedBy": [], "OneDriveSharedByMemberOf": [], "ExceptIfOneDriveSharedByMemberOf": [], "ExchangeSenderMemberOf": [], "ExchangeSenderMemberOfException": [], "ExpectedLocations": 0, "CompletedLocations": 0, "FailedLocations": 0, "ItemStatistics": null, "RuleMatchBlob": null, "ErrorMetadata": null, "UserAdministrativeUnitMembershipMap": null, "ForceValidate": false, "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-06-14T14:36:08.0311995Z'}", "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", "Priority": 1, "ObjectVersion": "9acc0ace-bf62-43ad-0710-08db6ce4b417", "CreatedBy": "d459e626-e311-4242-bb40-263313097103", "LastModifiedBy": "Addam Schroll", "ReadOnly": false, "ExternalIdentity": "", "Comment": "", "Enabled": true, "DistributionStatus": "Pending", "DistributionResults": null, "LastStatusUpdateTime": null, "ModificationTimeUtc": "/Date(1686767773280)/", "CreationTimeUtc": "/Date(1618332438880)/", "PolicyRBACScopes": [], "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency DLP Policy for PII", "DistinguishedName": "CN=agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedPolicy"], "WhenChanged": "/Date(1686753373000)/", "WhenCreated": "/Date(1618318038000)/", "WhenChangedUTC": "/Date(1686753373000)/", "WhenCreatedUTC": "/Date(1618318038000)/", "ExchangeObjectId": "b800d92f-a479-47a9-bcfa-306db665aaa1", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "Guid": "b800d92f-a479-47a9-bcfa-306db665aaa1", "OriginatingServer": "", "ObjectState": "Changed" }, { "Mode": "Enable", "DisplayName": "MS.DEFENDER.4.1v1 Test", "Type": "Dlp", "ExchangeLocation": ["All"], "SharePointLocation": ["All"], "SharePointLocationException": [], "OneDriveLocation": ["All"], "OneDriveLocationException": [], "ExchangeOnPremisesLocation": [], "SharePointOnPremisesLocation": [], "SharePointOnPremisesLocationException": [], "TeamsLocation": ["All"], "TeamsLocationException": [], "EndpointDlpLocation": ["All"], "EndpointDlpLocationException": [], "ThirdPartyAppDlpLocation": [], "ThirdPartyAppDlpLocationException": [], "OnPremisesScannerDlpLocation": ["All"], "OnPremisesScannerDlpLocationException": [], "PowerBIDlpLocation": [], "PowerBIDlpLocationException": [], "ExchangeSender": [], "ExchangeSenderException": [], "PolicyTemplateInfo": null, "MatchedItemsCount": null, "TotalItemsCount": null, "TopNLocationStatistics": null, "WorkloadStatistics": null, "IsSimulationPolicy": false, "SimulationStatus": null, "AutoEnableAfter": null, "ExtendedProperties": null, "Summary": false, "OneDriveSharedBy": [], "ExceptIfOneDriveSharedBy": [], "OneDriveSharedByMemberOf": [], "ExceptIfOneDriveSharedByMemberOf": [], "ExchangeSenderMemberOf": [], "ExchangeSenderMemberOfException": [], "ExpectedLocations": 0, "CompletedLocations": 0, "FailedLocations": 0, "ItemStatistics": null, "RuleMatchBlob": null, "ErrorMetadata": null, "UserAdministrativeUnitMembershipMap": null, "ForceValidate": false, "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-08-14T19:00:01.3768698Z'}", "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", "Priority": 2, "ObjectVersion": "f7210a5b-91bb-4470-8ffa-08db9cf8a991", "CreatedBy": "Addam Schroll", "LastModifiedBy": "Addam Schroll", "ReadOnly": false, "ExternalIdentity": "", "Comment": "Create a custom policy from scratch. You will choose the type of content to protect and how you want to protect it.", "Enabled": true, "DistributionStatus": "Pending", "DistributionResults": null, "LastStatusUpdateTime": null, "ModificationTimeUtc": "/Date(1692054001377)/", "CreationTimeUtc": "/Date(1692053995207)/", "PolicyRBACScopes": [], "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "MS.DEFENDER.4.1v1 Test", "DistinguishedName": "CN=MS.DEFENDER.4.1v1 Test,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedPolicy"], "WhenChanged": "/Date(1692039601000)/", "WhenCreated": "/Date(1692039595000)/", "WhenChangedUTC": "/Date(1692039601000)/", "WhenCreatedUTC": "/Date(1692039595000)/", "ExchangeObjectId": "cfe272a6-564c-4c7b-96c7-8d187487a755", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "Guid": "cfe272a6-564c-4c7b-96c7-8d187487a755", "OriginatingServer": "", "ObjectState": "Changed" } ], "dlp_compliance_rules": [ { "SubjectContainsWords": [], "ExceptIfSubjectContainsWords": [], "SubjectOrBodyMatchesPatterns": [], "ExceptIfSubjectOrBodyMatchesPatterns": [], "SubjectOrBodyContainsWords": [], "ExceptIfSubjectOrBodyContainsWords": [], "DocumentMatchesPatterns": [], "ExceptIfDocumentMatchesPatterns": [], "DocumentContainsWords": [], "ExceptIfDocumentContainsWords": [], "SenderADAttributeMatchesPatterns": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "SenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeContainsWords": null, "ContentCharacterSetContainsWords": [], "ExceptIfContentCharacterSetContainsWords": [], "DocumentNameMatchesPatterns": [], "ExceptIfDocumentNameMatchesPatterns": [], "MessageSizeOver": "", "ExceptIfMessageSizeOver": "", "MessageTypeMatches": null, "ExceptIfMessageTypeMatches": null, "UnscannableDocumentExtensionIs": [], "ExceptIfUnscannableDocumentExtensionIs": [], "HeaderContainsWords": null, "ExceptIfHeaderContainsWords": null, "DeviceManagementType": null, "ExceptIfDeviceManagementType": null, "AccessedBy": [], "ExceptIfAccessedBy": [], "AccessedByMemberOf": [], "ExceptIfAccessedByMemberOf": [], "BlockAccess": true, "BlockAccessScope": "All", "EncryptRMSTemplate": null, "EnforcePortalAccess": true, "ApplyBrandingTemplate": "", "RemoveRMSTemplate": false, "EndpointDlpRestrictions": [ { "setting": "CloudEgress", "defaultmessage": "none", "value": "Audit", "appgroup": "none" }, { "setting": "UnallowedApps", "defaultmessage": "none", "value": "Block", "appgroup": "none" } ], "EndpointDlpBrowserRestrictions": null, "ThirdPartyAppDlpRestrictions": null, "OnPremisesScannerDlpRestrictions": null, "PowerBIDlpRestrictions": null, "AlertProperties": { "AggregationType": "None" }, "GenerateAlert": ["true"], "GenerateIncidentReport": [], "IncidentReportContent": null, "NotifyUser": ["LastModifier"], "NotifyAllowOverride": null, "NotifyEmailCustomText": "", "NotifyEmailCustomSubject": "", "NotifyEmailCustomSenderDisplayName": "", "NotifyEmailExchangeIncludeAttachment": true, "NotifyEmailOnedriveRemediationActions": "NotSet", "NotifyJustificationCustomText": "", "NotifyJustificationCustomTextTranslations": [], "NotifyPolicyTipCustomText": "", "NotifyUserType": "NotSet", "NotifyPolicyTipCustomTextTranslations": [], "NotifyOverrideRequirements": "None", "NotifyPolicyTipDisplayOption": "Tip", "NotifyPolicyTipUrl": "", "NotifyEndpointUser": null, "RemoveHeader": [], "AccessTimeControl": null, "StopPolicyProcessing": false, "SetHeader": null, "AddRecipients": null, "Moderate": null, "ModifySubject": null, "MapRecipients": null, "RedirectMessageTo": null, "PrependSubject": "", "ApplyHtmlDisclaimer": null, "Quarantine": false, "TriggerPowerAutomateFlow": "", "RestrictAccess": null, "Guid": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", "AdvancedRuleBuilderContext": null, "ParentPolicyName": "Default Office 365 DLP policy", "ReportSeverityLevel": "Low", "ActivationDate": null, "ExpiryDate": null, "SenderType": null, "SenderAddressLocation": null, "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", "ExecutionRuleGuids": null, "DisplayName": "Baseline Rule", "StorageBindings": null, "EvaluateRulePerComponent": false, "IsAdvancedRule": false, "ContentContainsSensitiveInformation": [ { "maxconfidence": "100", "confidencelevel": "Medium", "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Individual Taxpayer Identification Number (ITIN)", "mincount": "1", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "High", "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", "minconfidence": "85", "classifiertype": "Content", "name": "Credit Card Number", "mincount": "1", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Social Security Number (SSN)", "mincount": "1", "maxcount": "-1" } ], "ExceptIfContentContainsSensitiveInformation": null, "ContentMissingSensitivityLabel": null, "ContentIsNotLabeled": false, "DocumentCreatedBy": [], "ExceptIfDocumentCreatedBy": [], "DocumentSizeOver": "", "ExceptIfDocumentSizeOver": "", "DocumentNameMatchesWords": [], "ExceptIfDocumentNameMatchesWords": [], "AccessScope": null, "NonBifurcatingAccessScope": null, "ExceptIfAccessScope": null, "FromScope": null, "ExceptIfFromScope": null, "WithImportance": null, "ExceptIfWithImportance": null, "ExternalScenarioDependancies": { "ProtectionAlertId": "b314399f-5d64-4c49-98c3-06deb1be2b6f" }, "ContentPropertyContainsWords": [], "ExceptIfContentPropertyContainsWords": [], "From": null, "ExceptIfFrom": null, "FromMemberOf": null, "ExceptIfFromMemberOf": null, "DocumentIsUnsupported": false, "ExceptIfDocumentIsUnsupported": false, "HasSenderOverride": false, "ExceptIfHasSenderOverride": false, "RestrictBrowserAccess": false, "ProcessingLimitExceeded": false, "ExceptIfProcessingLimitExceeded": false, "SentTo": [], "ExceptIfSentTo": [], "RecipientDomainIs": [], "ExceptIfRecipientDomainIs": [], "DocumentIsPasswordProtected": false, "ExceptIfDocumentIsPasswordProtected": false, "SenderIPRanges": [], "ExceptIfSenderIPRanges": [], "ContentExtensionMatchesWords": [], "ExceptIfContentExtensionMatchesWords": [], "ContentFileTypeMatches": [], "ExceptIfContentFileTypeMatches": [], "HeaderMatchesPatterns": null, "ExceptIfHeaderMatchesPatterns": null, "SubjectMatchesPatterns": [], "ExceptIfSubjectMatchesPatterns": [], "AnyOfRecipientAddressContainsWords": [], "ExceptIfAnyOfRecipientAddressContainsWords": [], "AnyOfRecipientAddressMatchesPatterns": [], "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], "FromAddressMatchesPatterns": [], "ExceptIfFromAddressMatchesPatterns": [], "FromAddressContainsWords": [], "ExceptIfFromAddressContainsWords": [], "SenderDomainIs": [], "ExceptIfSenderDomainIs": [], "SentToMemberOf": null, "ExceptIfSentToMemberOf": null, "DocumentCreatedByMemberOf": null, "ExceptIfDocumentCreatedByMemberOf": null, "HasLabelDowngradedFrom": [], "ContentIsShared": false, "ExceptIfContentIsShared": false, "SharedByIRMUserRisk": [], "RuleErrorAction": null, "RuleXml": "", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", "Priority": 0, "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", "Policy": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", "Comment": "Blocks the minimum items prescribed in the baseline: credit card numbers, TIN numbers, and SSN numbers.", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "c54e50b4-fb46-494d-9ad3-08db45bd017e", "MaximumBlobRuleLength": 0, "CreatedBy": "Alden Hilton - CTR", "LastModifiedBy": "Addam Schroll", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Baseline Rule", "DistinguishedName": "CN=Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1682448227000)/", "WhenCreated": "/Date(1651250001000)/", "WhenChangedUTC": "/Date(1682448227000)/", "WhenCreatedUTC": "/Date(1651250001000)/", "ExchangeObjectId": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "Changed", "IsObjectUnderSystemOperation": false }, { "SubjectContainsWords": [], "ExceptIfSubjectContainsWords": [], "SubjectOrBodyMatchesPatterns": [], "ExceptIfSubjectOrBodyMatchesPatterns": [], "SubjectOrBodyContainsWords": [], "ExceptIfSubjectOrBodyContainsWords": [], "DocumentMatchesPatterns": [], "ExceptIfDocumentMatchesPatterns": [], "DocumentContainsWords": [], "ExceptIfDocumentContainsWords": [], "SenderADAttributeMatchesPatterns": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "SenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeContainsWords": null, "ContentCharacterSetContainsWords": [], "ExceptIfContentCharacterSetContainsWords": [], "DocumentNameMatchesPatterns": [], "ExceptIfDocumentNameMatchesPatterns": [], "MessageSizeOver": "", "ExceptIfMessageSizeOver": "", "MessageTypeMatches": null, "ExceptIfMessageTypeMatches": null, "UnscannableDocumentExtensionIs": [], "ExceptIfUnscannableDocumentExtensionIs": [], "HeaderContainsWords": null, "ExceptIfHeaderContainsWords": null, "DeviceManagementType": null, "ExceptIfDeviceManagementType": null, "AccessedBy": [], "ExceptIfAccessedBy": [], "AccessedByMemberOf": [], "ExceptIfAccessedByMemberOf": [], "BlockAccess": false, "BlockAccessScope": null, "EncryptRMSTemplate": null, "EnforcePortalAccess": true, "ApplyBrandingTemplate": "", "RemoveRMSTemplate": false, "EndpointDlpRestrictions": null, "EndpointDlpBrowserRestrictions": null, "ThirdPartyAppDlpRestrictions": null, "OnPremisesScannerDlpRestrictions": null, "PowerBIDlpRestrictions": null, "AlertProperties": null, "GenerateAlert": [], "GenerateIncidentReport": [], "IncidentReportContent": null, "NotifyUser": ["SiteAdmin", "LastModifier", "Owner"], "NotifyAllowOverride": null, "NotifyEmailCustomText": "", "NotifyEmailCustomSubject": "", "NotifyEmailCustomSenderDisplayName": "", "NotifyEmailExchangeIncludeAttachment": true, "NotifyEmailOnedriveRemediationActions": "NotSet", "NotifyJustificationCustomText": "", "NotifyJustificationCustomTextTranslations": [], "NotifyPolicyTipCustomText": "", "NotifyUserType": "NotSet", "NotifyPolicyTipCustomTextTranslations": [], "NotifyOverrideRequirements": "None", "NotifyPolicyTipDisplayOption": "Tip", "NotifyPolicyTipUrl": "", "NotifyEndpointUser": null, "RemoveHeader": [], "AccessTimeControl": null, "StopPolicyProcessing": false, "SetHeader": null, "AddRecipients": null, "Moderate": null, "ModifySubject": null, "MapRecipients": null, "RedirectMessageTo": null, "PrependSubject": "", "ApplyHtmlDisclaimer": null, "Quarantine": false, "TriggerPowerAutomateFlow": "", "RestrictAccess": null, "Guid": "f2e78982-66b6-488a-a43a-e921800f6304", "AdvancedRuleBuilderContext": null, "ParentPolicyName": "agency DLP Policy for PII", "ReportSeverityLevel": "Low", "ActivationDate": null, "ExpiryDate": null, "SenderType": null, "SenderAddressLocation": null, "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '9',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", "ExecutionRuleGuids": null, "DisplayName": "Low volume of content detected agency DLP Policy for PII", "StorageBindings": null, "EvaluateRulePerComponent": false, "IsAdvancedRule": false, "ContentContainsSensitiveInformation": [ { "maxconfidence": "100", "confidencelevel": "High", "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", "minconfidence": "85", "classifiertype": "Content", "name": "Credit Card Number", "mincount": "1", "maxcount": "9" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Bank Account Number", "mincount": "1", "maxcount": "9" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", "minconfidence": "75", "classifiertype": "Content", "name": "ABA Routing Number", "mincount": "1", "maxcount": "9" } ], "ExceptIfContentContainsSensitiveInformation": null, "ContentMissingSensitivityLabel": null, "ContentIsNotLabeled": false, "DocumentCreatedBy": [], "ExceptIfDocumentCreatedBy": [], "DocumentSizeOver": "", "ExceptIfDocumentSizeOver": "", "DocumentNameMatchesWords": [], "ExceptIfDocumentNameMatchesWords": [], "AccessScope": "NotInOrganization", "NonBifurcatingAccessScope": null, "ExceptIfAccessScope": null, "FromScope": null, "ExceptIfFromScope": null, "WithImportance": null, "ExceptIfWithImportance": null, "ExternalScenarioDependancies": {}, "ContentPropertyContainsWords": [], "ExceptIfContentPropertyContainsWords": [], "From": null, "ExceptIfFrom": null, "FromMemberOf": null, "ExceptIfFromMemberOf": null, "DocumentIsUnsupported": false, "ExceptIfDocumentIsUnsupported": false, "HasSenderOverride": false, "ExceptIfHasSenderOverride": false, "RestrictBrowserAccess": false, "ProcessingLimitExceeded": false, "ExceptIfProcessingLimitExceeded": false, "SentTo": [], "ExceptIfSentTo": [], "RecipientDomainIs": [], "ExceptIfRecipientDomainIs": [], "DocumentIsPasswordProtected": false, "ExceptIfDocumentIsPasswordProtected": false, "SenderIPRanges": [], "ExceptIfSenderIPRanges": [], "ContentExtensionMatchesWords": [], "ExceptIfContentExtensionMatchesWords": [], "ContentFileTypeMatches": [], "ExceptIfContentFileTypeMatches": [], "HeaderMatchesPatterns": null, "ExceptIfHeaderMatchesPatterns": null, "SubjectMatchesPatterns": [], "ExceptIfSubjectMatchesPatterns": [], "AnyOfRecipientAddressContainsWords": [], "ExceptIfAnyOfRecipientAddressContainsWords": [], "AnyOfRecipientAddressMatchesPatterns": [], "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], "FromAddressMatchesPatterns": [], "ExceptIfFromAddressMatchesPatterns": [], "FromAddressContainsWords": [], "ExceptIfFromAddressContainsWords": [], "SenderDomainIs": [], "ExceptIfSenderDomainIs": [], "SentToMemberOf": null, "ExceptIfSentToMemberOf": null, "DocumentCreatedByMemberOf": null, "ExceptIfDocumentCreatedByMemberOf": null, "HasLabelDowngradedFrom": [], "ContentIsShared": false, "ExceptIfContentIsShared": false, "SharedByIRMUserRisk": [], "RuleErrorAction": null, "RuleXml": "", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "3dc18322-891b-436e-8240-755f95fef33c", "Priority": 0, "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", "Comment": "", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "f6f7ec90-c0aa-4ae4-e784-08dafa37f4cf", "MaximumBlobRuleLength": 0, "CreatedBy": "d459e626-e311-4242-bb40-263313097103", "LastModifiedBy": "Addam Schroll", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Low volume of content detected agency DLP Policy for PII", "DistinguishedName": "CN=Low volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1674144746000)/", "WhenCreated": "/Date(1618318043000)/", "WhenChangedUTC": "/Date(1674144746000)/", "WhenCreatedUTC": "/Date(1618318043000)/", "ExchangeObjectId": "f2e78982-66b6-488a-a43a-e921800f6304", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "Changed", "IsObjectUnderSystemOperation": false }, { "SubjectContainsWords": [], "ExceptIfSubjectContainsWords": [], "SubjectOrBodyMatchesPatterns": [], "ExceptIfSubjectOrBodyMatchesPatterns": [], "SubjectOrBodyContainsWords": [], "ExceptIfSubjectOrBodyContainsWords": [], "DocumentMatchesPatterns": [], "ExceptIfDocumentMatchesPatterns": [], "DocumentContainsWords": [], "ExceptIfDocumentContainsWords": [], "SenderADAttributeMatchesPatterns": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "SenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeContainsWords": null, "ContentCharacterSetContainsWords": [], "ExceptIfContentCharacterSetContainsWords": [], "DocumentNameMatchesPatterns": [], "ExceptIfDocumentNameMatchesPatterns": [], "MessageSizeOver": "", "ExceptIfMessageSizeOver": "", "MessageTypeMatches": null, "ExceptIfMessageTypeMatches": null, "UnscannableDocumentExtensionIs": [], "ExceptIfUnscannableDocumentExtensionIs": [], "HeaderContainsWords": null, "ExceptIfHeaderContainsWords": null, "DeviceManagementType": null, "ExceptIfDeviceManagementType": null, "AccessedBy": [], "ExceptIfAccessedBy": [], "AccessedByMemberOf": [], "ExceptIfAccessedByMemberOf": [], "BlockAccess": false, "BlockAccessScope": null, "EncryptRMSTemplate": null, "EnforcePortalAccess": true, "ApplyBrandingTemplate": "", "RemoveRMSTemplate": false, "EndpointDlpRestrictions": null, "EndpointDlpBrowserRestrictions": null, "ThirdPartyAppDlpRestrictions": null, "OnPremisesScannerDlpRestrictions": null, "PowerBIDlpRestrictions": null, "AlertProperties": null, "GenerateAlert": [], "GenerateIncidentReport": [], "IncidentReportContent": null, "NotifyUser": ["LastModifier", "SiteAdmin", "Owner"], "NotifyAllowOverride": null, "NotifyEmailCustomText": "", "NotifyEmailCustomSubject": "", "NotifyEmailCustomSenderDisplayName": "", "NotifyEmailExchangeIncludeAttachment": true, "NotifyEmailOnedriveRemediationActions": "NotSet", "NotifyJustificationCustomText": "", "NotifyJustificationCustomTextTranslations": [], "NotifyPolicyTipCustomText": "", "NotifyUserType": "NotSet", "NotifyPolicyTipCustomTextTranslations": [], "NotifyOverrideRequirements": "None", "NotifyPolicyTipDisplayOption": "Tip", "NotifyPolicyTipUrl": "", "NotifyEndpointUser": null, "RemoveHeader": [], "AccessTimeControl": null, "StopPolicyProcessing": false, "SetHeader": null, "AddRecipients": null, "Moderate": null, "ModifySubject": null, "MapRecipients": null, "RedirectMessageTo": null, "PrependSubject": "", "ApplyHtmlDisclaimer": null, "Quarantine": false, "TriggerPowerAutomateFlow": "", "RestrictAccess": null, "Guid": "8c40d462-f7c0-434d-bd37-d35c083c297a", "AdvancedRuleBuilderContext": null, "ParentPolicyName": "agency DLP Policy for PII", "ReportSeverityLevel": "High", "ActivationDate": null, "ExpiryDate": null, "SenderType": null, "SenderAddressLocation": null, "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", "ExecutionRuleGuids": null, "DisplayName": "High volume of content detected agency DLP Policy for PII", "StorageBindings": null, "EvaluateRulePerComponent": false, "IsAdvancedRule": false, "ContentContainsSensitiveInformation": [ { "maxconfidence": "100", "confidencelevel": "High", "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", "minconfidence": "85", "classifiertype": "Content", "name": "Credit Card Number", "mincount": "10", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Bank Account Number", "mincount": "10", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", "minconfidence": "75", "classifiertype": "Content", "name": "ABA Routing Number", "mincount": "10", "maxcount": "-1" } ], "ExceptIfContentContainsSensitiveInformation": null, "ContentMissingSensitivityLabel": null, "ContentIsNotLabeled": false, "DocumentCreatedBy": [], "ExceptIfDocumentCreatedBy": [], "DocumentSizeOver": "", "ExceptIfDocumentSizeOver": "", "DocumentNameMatchesWords": [], "ExceptIfDocumentNameMatchesWords": [], "AccessScope": "NotInOrganization", "NonBifurcatingAccessScope": null, "ExceptIfAccessScope": null, "FromScope": null, "ExceptIfFromScope": null, "WithImportance": null, "ExceptIfWithImportance": null, "ExternalScenarioDependancies": {}, "ContentPropertyContainsWords": [], "ExceptIfContentPropertyContainsWords": [], "From": null, "ExceptIfFrom": null, "FromMemberOf": null, "ExceptIfFromMemberOf": null, "DocumentIsUnsupported": false, "ExceptIfDocumentIsUnsupported": false, "HasSenderOverride": false, "ExceptIfHasSenderOverride": false, "RestrictBrowserAccess": false, "ProcessingLimitExceeded": false, "ExceptIfProcessingLimitExceeded": false, "SentTo": [], "ExceptIfSentTo": [], "RecipientDomainIs": [], "ExceptIfRecipientDomainIs": [], "DocumentIsPasswordProtected": false, "ExceptIfDocumentIsPasswordProtected": false, "SenderIPRanges": [], "ExceptIfSenderIPRanges": [], "ContentExtensionMatchesWords": [], "ExceptIfContentExtensionMatchesWords": [], "ContentFileTypeMatches": [], "ExceptIfContentFileTypeMatches": [], "HeaderMatchesPatterns": null, "ExceptIfHeaderMatchesPatterns": null, "SubjectMatchesPatterns": [], "ExceptIfSubjectMatchesPatterns": [], "AnyOfRecipientAddressContainsWords": [], "ExceptIfAnyOfRecipientAddressContainsWords": [], "AnyOfRecipientAddressMatchesPatterns": [], "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], "FromAddressMatchesPatterns": [], "ExceptIfFromAddressMatchesPatterns": [], "FromAddressContainsWords": [], "ExceptIfFromAddressContainsWords": [], "SenderDomainIs": [], "ExceptIfSenderDomainIs": [], "SentToMemberOf": null, "ExceptIfSentToMemberOf": null, "DocumentCreatedByMemberOf": null, "ExceptIfDocumentCreatedByMemberOf": null, "HasLabelDowngradedFrom": [], "ContentIsShared": false, "ExceptIfContentIsShared": false, "SharedByIRMUserRisk": [], "RuleErrorAction": null, "RuleXml": "", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "b933b4dd-4152-4d9a-b4b5-0376f8b57d6d", "Priority": 1, "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", "Comment": "", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "daf9a24d-19dd-4978-51b9-08dafa37f6c9", "MaximumBlobRuleLength": 0, "CreatedBy": "d459e626-e311-4242-bb40-263313097103", "LastModifiedBy": "Addam Schroll", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "High volume of content detected agency DLP Policy for PII", "DistinguishedName": "CN=High volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1674144749000)/", "WhenCreated": "/Date(1618318041000)/", "WhenChangedUTC": "/Date(1674144749000)/", "WhenCreatedUTC": "/Date(1618318041000)/", "ExchangeObjectId": "8c40d462-f7c0-434d-bd37-d35c083c297a", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "Changed", "IsObjectUnderSystemOperation": false }, { "SubjectContainsWords": [], "ExceptIfSubjectContainsWords": [], "SubjectOrBodyMatchesPatterns": [], "ExceptIfSubjectOrBodyMatchesPatterns": [], "SubjectOrBodyContainsWords": [], "ExceptIfSubjectOrBodyContainsWords": [], "DocumentMatchesPatterns": [], "ExceptIfDocumentMatchesPatterns": [], "DocumentContainsWords": [], "ExceptIfDocumentContainsWords": [], "SenderADAttributeMatchesPatterns": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "SenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeContainsWords": null, "ContentCharacterSetContainsWords": [], "ExceptIfContentCharacterSetContainsWords": [], "DocumentNameMatchesPatterns": [], "ExceptIfDocumentNameMatchesPatterns": [], "MessageSizeOver": "", "ExceptIfMessageSizeOver": "", "MessageTypeMatches": null, "ExceptIfMessageTypeMatches": null, "UnscannableDocumentExtensionIs": [], "ExceptIfUnscannableDocumentExtensionIs": [], "HeaderContainsWords": null, "ExceptIfHeaderContainsWords": null, "DeviceManagementType": null, "ExceptIfDeviceManagementType": null, "AccessedBy": [], "ExceptIfAccessedBy": [], "AccessedByMemberOf": [], "ExceptIfAccessedByMemberOf": [], "BlockAccess": true, "BlockAccessScope": "All", "EncryptRMSTemplate": null, "EnforcePortalAccess": true, "ApplyBrandingTemplate": "", "RemoveRMSTemplate": false, "EndpointDlpRestrictions": null, "EndpointDlpBrowserRestrictions": null, "ThirdPartyAppDlpRestrictions": null, "OnPremisesScannerDlpRestrictions": null, "PowerBIDlpRestrictions": null, "AlertProperties": { "AggregationType": "None" }, "GenerateAlert": ["true"], "GenerateIncidentReport": [], "IncidentReportContent": null, "NotifyUser": [], "NotifyAllowOverride": null, "NotifyEmailCustomText": "", "NotifyEmailCustomSubject": "", "NotifyEmailCustomSenderDisplayName": "", "NotifyEmailExchangeIncludeAttachment": true, "NotifyEmailOnedriveRemediationActions": null, "NotifyJustificationCustomText": "", "NotifyJustificationCustomTextTranslations": [], "NotifyPolicyTipCustomText": "", "NotifyUserType": null, "NotifyPolicyTipCustomTextTranslations": [], "NotifyOverrideRequirements": null, "NotifyPolicyTipDisplayOption": null, "NotifyPolicyTipUrl": "", "NotifyEndpointUser": null, "RemoveHeader": [], "AccessTimeControl": null, "StopPolicyProcessing": false, "SetHeader": null, "AddRecipients": null, "Moderate": null, "ModifySubject": null, "MapRecipients": null, "RedirectMessageTo": null, "PrependSubject": "", "ApplyHtmlDisclaimer": null, "Quarantine": false, "TriggerPowerAutomateFlow": "", "RestrictAccess": null, "Guid": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", "AdvancedRuleBuilderContext": null, "ParentPolicyName": "MS.DEFENDER.4.1v1 Test", "ReportSeverityLevel": "Low", "ActivationDate": null, "ExpiryDate": null, "SenderType": null, "SenderAddressLocation": null, "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", "ExecutionRuleGuids": null, "DisplayName": "PII Check", "StorageBindings": null, "EvaluateRulePerComponent": false, "IsAdvancedRule": false, "ContentContainsSensitiveInformation": [ { "maxconfidence": "100", "confidencelevel": "High", "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", "minconfidence": "85", "classifiertype": "Content", "name": "Credit Card Number", "mincount": "1", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Individual Taxpayer Identification Number (ITIN)", "mincount": "1", "maxcount": "-1" }, { "maxconfidence": "100", "confidencelevel": "Medium", "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", "minconfidence": "75", "classifiertype": "Content", "name": "U.S. Social Security Number (SSN)", "mincount": "1", "maxcount": "-1" } ], "ExceptIfContentContainsSensitiveInformation": null, "ContentMissingSensitivityLabel": null, "ContentIsNotLabeled": false, "DocumentCreatedBy": [], "ExceptIfDocumentCreatedBy": [], "DocumentSizeOver": "", "ExceptIfDocumentSizeOver": "", "DocumentNameMatchesWords": [], "ExceptIfDocumentNameMatchesWords": [], "AccessScope": null, "NonBifurcatingAccessScope": null, "ExceptIfAccessScope": null, "FromScope": null, "ExceptIfFromScope": null, "WithImportance": null, "ExceptIfWithImportance": null, "ExternalScenarioDependancies": { "ProtectionAlertId": "37a2473a-9a91-4790-a96f-a93db6da9d55" }, "ContentPropertyContainsWords": [], "ExceptIfContentPropertyContainsWords": [], "From": null, "ExceptIfFrom": null, "FromMemberOf": null, "ExceptIfFromMemberOf": null, "DocumentIsUnsupported": false, "ExceptIfDocumentIsUnsupported": false, "HasSenderOverride": false, "ExceptIfHasSenderOverride": false, "RestrictBrowserAccess": false, "ProcessingLimitExceeded": false, "ExceptIfProcessingLimitExceeded": false, "SentTo": [], "ExceptIfSentTo": [], "RecipientDomainIs": [], "ExceptIfRecipientDomainIs": [], "DocumentIsPasswordProtected": false, "ExceptIfDocumentIsPasswordProtected": false, "SenderIPRanges": [], "ExceptIfSenderIPRanges": [], "ContentExtensionMatchesWords": [], "ExceptIfContentExtensionMatchesWords": [], "ContentFileTypeMatches": [], "ExceptIfContentFileTypeMatches": [], "HeaderMatchesPatterns": null, "ExceptIfHeaderMatchesPatterns": null, "SubjectMatchesPatterns": [], "ExceptIfSubjectMatchesPatterns": [], "AnyOfRecipientAddressContainsWords": [], "ExceptIfAnyOfRecipientAddressContainsWords": [], "AnyOfRecipientAddressMatchesPatterns": [], "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], "FromAddressMatchesPatterns": [], "ExceptIfFromAddressMatchesPatterns": [], "FromAddressContainsWords": [], "ExceptIfFromAddressContainsWords": [], "SenderDomainIs": [], "ExceptIfSenderDomainIs": [], "SentToMemberOf": null, "ExceptIfSentToMemberOf": null, "DocumentCreatedByMemberOf": null, "ExceptIfDocumentCreatedByMemberOf": null, "HasLabelDowngradedFrom": [], "ContentIsShared": false, "ExceptIfContentIsShared": false, "SharedByIRMUserRisk": [], "RuleErrorAction": null, "RuleXml": "", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "9a7b93f6-6c70-474c-854a-82116ce288ef", "Priority": 0, "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", "Policy": "cfe272a6-564c-4c7b-96c7-8d187487a755", "Comment": "", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "825da2a8-5b6d-499b-6b2a-08db9cf8a96b", "MaximumBlobRuleLength": 0, "CreatedBy": "Addam Schroll", "LastModifiedBy": "Addam Schroll", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "PII Check", "DistinguishedName": "CN=PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1692039601000)/", "WhenCreated": "/Date(1692039601000)/", "WhenChangedUTC": "/Date(1692039601000)/", "WhenCreatedUTC": "/Date(1692039601000)/", "ExchangeObjectId": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "New", "IsObjectUnderSystemOperation": false } ], "malware_filter_policies": [ { "AdminDisplayName": "", "CustomExternalBody": "", "CustomExternalSubject": "", "CustomInternalBody": "", "CustomInternalSubject": "", "CustomFromAddress": "", "CustomFromName": "", "CustomNotifications": false, "EnableExternalSenderAdminNotifications": false, "EnableFileFilter": true, "EnableInternalSenderAdminNotifications": false, "ExternalSenderAdminAddress": "", "FileTypeAction": "Reject", "FileTypes": null, "InternalSenderAdminAddress": "", "IsDefault": false, "IsPolicyOverrideApplied": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Strict", "ZapEnabled": true, "Identity": "Strict Preset Security Policy1681329957931", "Id": "Strict Preset Security Policy1681329957931", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Strict Preset Security Policy1681329957931", "DistinguishedName": "CN=Strict Preset Security Policy1681329957931,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", "ObjectClass": ["top", "msExchMalwareFilterConfig"], "WhenChanged": "/Date(1681329967000)/", "WhenCreated": "/Date(1681329958000)/", "WhenChangedUTC": "/Date(1681329967000)/", "WhenCreatedUTC": "/Date(1681329958000)/", "ExchangeObjectId": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "AdminDisplayName": "", "CustomExternalBody": "", "CustomExternalSubject": "", "CustomInternalBody": "", "CustomInternalSubject": "", "CustomFromAddress": "", "CustomFromName": "", "CustomNotifications": false, "EnableExternalSenderAdminNotifications": false, "EnableFileFilter": true, "EnableInternalSenderAdminNotifications": false, "ExternalSenderAdminAddress": "", "FileTypeAction": "Reject", "FileTypes": [ "ace", "ani", "apk", "app", "appx", "arj", "bat", "cab", "cmd", "com", "deb", "dex", "dll", "docm", "elf", "exe", "hta", "img", "iso", "jar", "jnlp", "kext", "lha", "lib", "library", "lnk", "lzh", "macho", "msc", "msi", "msix", "msp", "mst", "pif", "ppa", "ppam", "ps1", "ps2", "reg", "rev", "scf", "scr", "sct", "sys", "uif", "vb", "vbe", "vbs", "vxd", "wsc", "wsf", "wsh", "xll", "xz", "z" ], "InternalSenderAdminAddress": "", "IsDefault": true, "IsPolicyOverrideApplied": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Custom", "ZapEnabled": true, "Identity": "Default", "Id": "Default", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Default", "DistinguishedName": "CN=Default,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", "ObjectClass": ["top", "msExchMalwareFilterConfig"], "WhenChanged": "/Date(1691001178000)/", "WhenCreated": "/Date(1619484590000)/", "WhenChangedUTC": "/Date(1691001178000)/", "WhenCreatedUTC": "/Date(1619484590000)/", "ExchangeObjectId": "537d5d48-4157-4f2c-a840-f11be9a5ad50", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "5614934b-8055-41dd-93a4-4f8618ee50ca", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "AdminDisplayName": "", "CustomExternalBody": "", "CustomExternalSubject": "", "CustomInternalBody": "", "CustomInternalSubject": "", "CustomFromAddress": "", "CustomFromName": "", "CustomNotifications": false, "EnableExternalSenderAdminNotifications": false, "EnableFileFilter": true, "EnableInternalSenderAdminNotifications": false, "ExternalSenderAdminAddress": "", "FileTypeAction": "Reject", "FileTypes": [ "ace", "apk", "app", "appx", "ani", "arj", "bat", "cab", "cmd", "com", "deb", "dex", "dll", "docm", "elf", "exe", "hta", "img", "iso", "jar", "jnlp", "kext", "lha", "lib", "library", "lnk", "lzh", "macho", "msc", "msi", "msix", "msp", "mst", "pif", "ppa", "ppam", "reg", "rev", "scf", "scr", "sct", "sys", "uif", "vb", "vbe", "vbs", "vxd", "wsc", "wsf", "wsh", "xll", "xz", "z" ], "InternalSenderAdminAddress": "", "IsDefault": false, "IsPolicyOverrideApplied": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Standard", "ZapEnabled": true, "Identity": "Standard Preset Security Policy1659535435292", "Id": "Standard Preset Security Policy1659535435292", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Standard Preset Security Policy1659535435292", "DistinguishedName": "CN=Standard Preset Security Policy1659535435292,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", "ObjectClass": ["top", "msExchMalwareFilterConfig"], "WhenChanged": "/Date(1688679108000)/", "WhenCreated": "/Date(1659535435000)/", "WhenChangedUTC": "/Date(1688679108000)/", "WhenCreatedUTC": "/Date(1659535435000)/", "ExchangeObjectId": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "anti_phish_policies": [ { "Enabled": true, "ImpersonationProtectionState": "Automatic", "EnableTargetedUserProtection": true, "EnableMailboxIntelligenceProtection": true, "EnableTargetedDomainsProtection": true, "EnableOrganizationDomainsProtection": true, "EnableMailboxIntelligence": true, "EnableFirstContactSafetyTips": false, "EnableSimilarUsersSafetyTips": true, "EnableSimilarDomainsSafetyTips": true, "EnableUnusualCharactersSafetyTips": true, "TargetedUserProtectionAction": "Quarantine", "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "MailboxIntelligenceProtectionAction": "Quarantine", "MailboxIntelligenceQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "TargetedDomainProtectionAction": "Quarantine", "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "AuthenticationFailAction": "Quarantine", "SpoofQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "EnableSpoofIntelligence": true, "EnableViaTag": true, "EnableUnauthenticatedSender": true, "EnableSuspiciousSafetyTip": true, "HonorDmarcPolicy": true, "DmarcRejectAction": "Reject", "DmarcQuarantineAction": "Quarantine", "PhishThresholdLevel": 4, "TargetedUsersToProtect": [], "TargetedUserActionRecipients": [], "MailboxIntelligenceProtectionActionRecipients": [], "TargetedDomainsToProtect": [], "TargetedDomainActionRecipients": [], "ExcludedDomains": [], "ExcludedSenders": [], "IsDefault": false, "AdminDisplayName": "", "PolicyTag": "", "RecommendedPolicyType": "Strict", "Identity": "Strict Preset Security Policy1681329955447", "Id": "Strict Preset Security Policy1681329955447", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Strict Preset Security Policy1681329955447", "DistinguishedName": "CN=Strict Preset Security Policy1681329955447,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1681329967000)/", "WhenCreated": "/Date(1681329956000)/", "WhenChangedUTC": "/Date(1681329967000)/", "WhenCreatedUTC": "/Date(1681329956000)/", "ExchangeObjectId": "dd855979-da0e-4109-b218-cebf593d1771", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "dd855979-da0e-4109-b218-cebf593d1771", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Enabled": true, "ImpersonationProtectionState": "Manual", "EnableTargetedUserProtection": true, "EnableMailboxIntelligenceProtection": true, "EnableTargetedDomainsProtection": true, "EnableOrganizationDomainsProtection": true, "EnableMailboxIntelligence": true, "EnableFirstContactSafetyTips": true, "EnableSimilarUsersSafetyTips": true, "EnableSimilarDomainsSafetyTips": true, "EnableUnusualCharactersSafetyTips": true, "TargetedUserProtectionAction": "Quarantine", "TargetedUserQuarantineTag": "DefaultFullAccessPolicy", "MailboxIntelligenceProtectionAction": "Quarantine", "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", "TargetedDomainProtectionAction": "Quarantine", "TargetedDomainQuarantineTag": "DefaultFullAccessPolicy", "AuthenticationFailAction": "Quarantine", "SpoofQuarantineTag": "DefaultFullAccessPolicy", "EnableSpoofIntelligence": true, "EnableViaTag": true, "EnableUnauthenticatedSender": true, "EnableSuspiciousSafetyTip": false, "HonorDmarcPolicy": true, "DmarcRejectAction": "Reject", "DmarcQuarantineAction": "Quarantine", "PhishThresholdLevel": 2, "TargetedUsersToProtect": [ "ronnie brown - ctr - az;robrown-az@agency.onmicrosoft.com", "rex trotter;rtrotter-az@agency.onmicrosoft.com", "tommy williams - ctr - az;tommy.williams-az@agency.onmicrosoft.com" ], "TargetedUserActionRecipients": [], "MailboxIntelligenceProtectionActionRecipients": [], "TargetedDomainsToProtect": ["agency.mail.onmicrosoft.com"], "TargetedDomainActionRecipients": [], "ExcludedDomains": [], "ExcludedSenders": [], "IsDefault": true, "AdminDisplayName": "", "PolicyTag": "", "RecommendedPolicyType": "Custom", "Identity": "Office365 AntiPhish Default", "Id": "Office365 AntiPhish Default", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Office365 AntiPhish Default", "DistinguishedName": "CN=Office365 AntiPhish Default,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1661272560000)/", "WhenCreated": "/Date(1619484591000)/", "WhenChangedUTC": "/Date(1661272560000)/", "WhenCreatedUTC": "/Date(1619484591000)/", "ExchangeObjectId": "84178a51-0850-4bd4-873c-b8eea28e304c", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "1c36a79e-281c-41ac-adf0-441a9ef992c3", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Enabled": true, "ImpersonationProtectionState": "Automatic", "EnableTargetedUserProtection": true, "EnableMailboxIntelligenceProtection": true, "EnableTargetedDomainsProtection": true, "EnableOrganizationDomainsProtection": true, "EnableMailboxIntelligence": true, "EnableFirstContactSafetyTips": false, "EnableSimilarUsersSafetyTips": true, "EnableSimilarDomainsSafetyTips": true, "EnableUnusualCharactersSafetyTips": true, "TargetedUserProtectionAction": "Quarantine", "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "MailboxIntelligenceProtectionAction": "MoveToJmf", "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", "TargetedDomainProtectionAction": "Quarantine", "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "AuthenticationFailAction": "MoveToJmf", "SpoofQuarantineTag": "DefaultFullAccessPolicy", "EnableSpoofIntelligence": true, "EnableViaTag": true, "EnableUnauthenticatedSender": true, "EnableSuspiciousSafetyTip": false, "HonorDmarcPolicy": true, "DmarcRejectAction": "Reject", "DmarcQuarantineAction": "Quarantine", "PhishThresholdLevel": 3, "TargetedUsersToProtect": [], "TargetedUserActionRecipients": [], "MailboxIntelligenceProtectionActionRecipients": [], "TargetedDomainsToProtect": [], "TargetedDomainActionRecipients": [], "ExcludedDomains": [], "ExcludedSenders": [], "IsDefault": false, "AdminDisplayName": "", "PolicyTag": "", "RecommendedPolicyType": "Standard", "Identity": "Standard Preset Security Policy1659535429826", "Id": "Standard Preset Security Policy1659535429826", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Standard Preset Security Policy1659535429826", "DistinguishedName": "CN=Standard Preset Security Policy1659535429826,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1687302657000)/", "WhenCreated": "/Date(1659535432000)/", "WhenChangedUTC": "/Date(1687302657000)/", "WhenCreatedUTC": "/Date(1659535432000)/", "ExchangeObjectId": "c039f211-68f7-43e8-822f-91c1e0e018f7", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "c039f211-68f7-43e8-822f-91c1e0e018f7", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "hosted_content_filter_policies": [ { "AdminDisplayName": "", "AddXHeaderValue": "", "ModifySubjectValue": "", "RedirectToRecipients": [], "TestModeBccToRecipients": [], "FalsePositiveAdditionalRecipients": [], "QuarantineRetentionPeriod": 30, "TestModeAction": "None", "IncreaseScoreWithImageLinks": "Off", "IncreaseScoreWithNumericIps": "Off", "IncreaseScoreWithRedirectToOtherPort": "Off", "IncreaseScoreWithBizOrInfoUrls": "Off", "MarkAsSpamEmptyMessages": "Off", "MarkAsSpamJavaScriptInHtml": "Off", "MarkAsSpamFramesInHtml": "Off", "MarkAsSpamObjectTagsInHtml": "Off", "MarkAsSpamEmbedTagsInHtml": "Off", "MarkAsSpamFormTagsInHtml": "Off", "MarkAsSpamWebBugsInHtml": "Off", "MarkAsSpamSensitiveWordList": "Off", "MarkAsSpamSpfRecordHardFail": "Off", "MarkAsSpamFromAddressAuthFail": "Off", "MarkAsSpamBulkMail": "On", "MarkAsSpamNdrBackscatter": "Off", "IsDefault": false, "LanguageBlockList": [], "RegionBlockList": [], "HighConfidenceSpamAction": "Quarantine", "SpamAction": "Quarantine", "DownloadLink": false, "EnableRegionBlockList": false, "EnableLanguageBlockList": false, "BulkThreshold": 5, "AllowedSenders": [], "AllowedSenderDomains": [], "BlockedSenders": [], "BlockedSenderDomains": [], "ZapEnabled": true, "InlineSafetyTipsEnabled": true, "BulkSpamAction": "Quarantine", "PhishSpamAction": "Quarantine", "SpamZapEnabled": true, "PhishZapEnabled": true, "IntraOrgFilterState": "Default", "HighConfidencePhishAction": "Quarantine", "RecommendedPolicyType": "Strict", "SpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", "BulkQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "Identity": "Strict Preset Security Policy1681329956650", "Id": "Strict Preset Security Policy1681329956650", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Strict Preset Security Policy1681329956650", "DistinguishedName": "CN=Strict Preset Security Policy1681329956650,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1681329967000)/", "WhenCreated": "/Date(1681329957000)/", "WhenChangedUTC": "/Date(1681329967000)/", "WhenCreatedUTC": "/Date(1681329957000)/", "ExchangeObjectId": "01a6119b-4398-43b1-a329-7335e292bd5d", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "01a6119b-4398-43b1-a329-7335e292bd5d", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "AdminDisplayName": "", "AddXHeaderValue": "", "ModifySubjectValue": "", "RedirectToRecipients": [], "TestModeBccToRecipients": [], "FalsePositiveAdditionalRecipients": [], "QuarantineRetentionPeriod": 30, "TestModeAction": "None", "IncreaseScoreWithImageLinks": "Off", "IncreaseScoreWithNumericIps": "Off", "IncreaseScoreWithRedirectToOtherPort": "Off", "IncreaseScoreWithBizOrInfoUrls": "Off", "MarkAsSpamEmptyMessages": "Off", "MarkAsSpamJavaScriptInHtml": "Off", "MarkAsSpamFramesInHtml": "Off", "MarkAsSpamObjectTagsInHtml": "Off", "MarkAsSpamEmbedTagsInHtml": "Off", "MarkAsSpamFormTagsInHtml": "Off", "MarkAsSpamWebBugsInHtml": "Off", "MarkAsSpamSensitiveWordList": "Off", "MarkAsSpamSpfRecordHardFail": "Off", "MarkAsSpamFromAddressAuthFail": "Off", "MarkAsSpamBulkMail": "On", "MarkAsSpamNdrBackscatter": "Off", "IsDefault": true, "LanguageBlockList": [], "RegionBlockList": [], "HighConfidenceSpamAction": "Quarantine", "SpamAction": "MoveToJmf", "DownloadLink": false, "EnableRegionBlockList": false, "EnableLanguageBlockList": false, "BulkThreshold": 6, "AllowedSenders": [], "AllowedSenderDomains": [], "BlockedSenders": [], "BlockedSenderDomains": [], "ZapEnabled": true, "InlineSafetyTipsEnabled": true, "BulkSpamAction": "Quarantine", "PhishSpamAction": "Quarantine", "SpamZapEnabled": true, "PhishZapEnabled": true, "IntraOrgFilterState": "Default", "HighConfidencePhishAction": "Quarantine", "RecommendedPolicyType": "Custom", "SpamQuarantineTag": "DefaultFullAccessPolicy", "HighConfidenceSpamQuarantineTag": "NotificationEnabledPolicy", "PhishQuarantineTag": "NotificationEnabledPolicy", "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", "BulkQuarantineTag": "NotificationEnabledPolicy", "Identity": "Default", "Id": "Default", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Default", "DistinguishedName": "CN=Default,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1647039792000)/", "WhenCreated": "/Date(1619484590000)/", "WhenChangedUTC": "/Date(1647039792000)/", "WhenCreatedUTC": "/Date(1619484590000)/", "ExchangeObjectId": "c2a6239d-0253-4693-b841-33ccd870af91", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "d07707d6-355e-4be5-a368-61e7757b28f5", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "AdminDisplayName": "", "AddXHeaderValue": "", "ModifySubjectValue": "", "RedirectToRecipients": [], "TestModeBccToRecipients": [], "FalsePositiveAdditionalRecipients": [], "QuarantineRetentionPeriod": 30, "TestModeAction": "None", "IncreaseScoreWithImageLinks": "Off", "IncreaseScoreWithNumericIps": "Off", "IncreaseScoreWithRedirectToOtherPort": "Off", "IncreaseScoreWithBizOrInfoUrls": "Off", "MarkAsSpamEmptyMessages": "Off", "MarkAsSpamJavaScriptInHtml": "Off", "MarkAsSpamFramesInHtml": "Off", "MarkAsSpamObjectTagsInHtml": "Off", "MarkAsSpamEmbedTagsInHtml": "Off", "MarkAsSpamFormTagsInHtml": "Off", "MarkAsSpamWebBugsInHtml": "Off", "MarkAsSpamSensitiveWordList": "Off", "MarkAsSpamSpfRecordHardFail": "Off", "MarkAsSpamFromAddressAuthFail": "Off", "MarkAsSpamBulkMail": "On", "MarkAsSpamNdrBackscatter": "Off", "IsDefault": false, "LanguageBlockList": [], "RegionBlockList": [], "HighConfidenceSpamAction": "Quarantine", "SpamAction": "MoveToJmf", "DownloadLink": false, "EnableRegionBlockList": false, "EnableLanguageBlockList": false, "BulkThreshold": 6, "AllowedSenders": [], "AllowedSenderDomains": [], "BlockedSenders": [], "BlockedSenderDomains": [], "ZapEnabled": true, "InlineSafetyTipsEnabled": true, "BulkSpamAction": "MoveToJmf", "PhishSpamAction": "Quarantine", "SpamZapEnabled": true, "PhishZapEnabled": true, "IntraOrgFilterState": "Default", "HighConfidencePhishAction": "Quarantine", "RecommendedPolicyType": "Standard", "SpamQuarantineTag": "DefaultFullAccessPolicy", "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", "BulkQuarantineTag": "DefaultFullAccessPolicy", "Identity": "Standard Preset Security Policy1659535432883", "Id": "Standard Preset Security Policy1659535432883", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Standard Preset Security Policy1659535432883", "DistinguishedName": "CN=Standard Preset Security Policy1659535432883,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1688679110000)/", "WhenCreated": "/Date(1659535433000)/", "WhenChangedUTC": "/Date(1688679110000)/", "WhenCreatedUTC": "/Date(1659535433000)/", "ExchangeObjectId": "5422a22e-b87d-4400-835d-4a63acc75082", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "5422a22e-b87d-4400-835d-4a63acc75082", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "safe_attachment_policies": [ { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": false, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Custom", "Redirect": true, "RedirectAddress": "david.bui@agency.onmicrosoft.com", "Identity": "Block unknown malware", "Id": "Block unknown malware", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Block unknown malware", "DistinguishedName": "CN=Block unknown malware,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1657151230000)/", "WhenCreated": "/Date(1626469482000)/", "WhenChangedUTC": "/Date(1657151230000)/", "WhenCreatedUTC": "/Date(1626469482000)/", "ExchangeObjectId": "d79581a3-b144-4d95-bdea-2031fca7aebc", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "d79581a3-b144-4d95-bdea-2031fca7aebc", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": true, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Custom", "Redirect": false, "RedirectAddress": "", "Identity": "Built-In Protection Policy", "Id": "Built-In Protection Policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Built-In Protection Policy", "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1643236382000)/", "WhenCreated": "/Date(1643236368000)/", "WhenChangedUTC": "/Date(1643236382000)/", "WhenCreatedUTC": "/Date(1643236368000)/", "ExchangeObjectId": "c34a2328-8f39-4afa-873a-8eba4b467a14", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "c34a2328-8f39-4afa-873a-8eba4b467a14", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": false, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Strict", "Redirect": false, "RedirectAddress": "", "Identity": "Strict Preset Security Policy1681329958553", "Id": "Strict Preset Security Policy1681329958553", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Strict Preset Security Policy1681329958553", "DistinguishedName": "CN=Strict Preset Security Policy1681329958553,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1681329967000)/", "WhenCreated": "/Date(1681329958000)/", "WhenChangedUTC": "/Date(1681329967000)/", "WhenCreatedUTC": "/Date(1681329958000)/", "ExchangeObjectId": "b653a1e5-018a-4f46-8144-4b7da91c6cea", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "b653a1e5-018a-4f46-8144-4b7da91c6cea", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": false, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Custom", "Redirect": false, "RedirectAddress": "", "Identity": "AgencyImplementation", "Id": "AgencyImplementation", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "AgencyImplementation", "DistinguishedName": "CN=AgencyImplementation,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1651250217000)/", "WhenCreated": "/Date(1651250213000)/", "WhenChangedUTC": "/Date(1651250217000)/", "WhenCreatedUTC": "/Date(1651250213000)/", "ExchangeObjectId": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": false, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Custom", "Redirect": false, "RedirectAddress": "", "Identity": "Baseline Policy", "Id": "Baseline Policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Baseline Policy", "DistinguishedName": "CN=Baseline Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1651702853000)/", "WhenCreated": "/Date(1651702851000)/", "WhenChangedUTC": "/Date(1651702853000)/", "WhenCreatedUTC": "/Date(1651702851000)/", "ExchangeObjectId": "9c0b02d9-3b2e-434a-8370-316879ff9905", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "9c0b02d9-3b2e-434a-8370-316879ff9905", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Action": "Block", "AdminDisplayName": "", "Enable": true, "EnableOrganizationBranding": false, "IsBuiltInProtection": false, "IsDefault": false, "QuarantineTag": "AdminOnlyAccessPolicy", "RecommendedPolicyType": "Standard", "Redirect": false, "RedirectAddress": "", "Identity": "Standard Preset Security Policy1659535436109", "Id": "Standard Preset Security Policy1659535436109", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Standard Preset Security Policy1659535436109", "DistinguishedName": "CN=Standard Preset Security Policy1659535436109,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], "WhenChanged": "/Date(1688679110000)/", "WhenCreated": "/Date(1659535436000)/", "WhenChangedUTC": "/Date(1688679110000)/", "WhenCreatedUTC": "/Date(1659535436000)/", "ExchangeObjectId": "0f24b36f-33e9-4e08-89ca-b917a2c75427", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "0f24b36f-33e9-4e08-89ca-b917a2c75427", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "safe_attachment_rules": [ { "SafeAttachmentPolicy": "Block unknown malware", "State": "Enabled", "Priority": 0, "Comments": null, "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027associates.dhs.agency.govu0027 or u0027agency.netu0027 or u0027agency.onmicrosoft.comu0027 or u0027dhs.agency.govu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027rnTake the following actions:rntApply safe attachment policy 'Block unknown malware'.rn", "RuleVersion": { "Major": 15, "Minor": 0, "Build": 5, "Revision": 2, "MajorRevision": 0, "MinorRevision": 2 }, "SentTo": null, "SentToMemberOf": null, "RecipientDomainIs": [ "associates.dhs.agency.gov", "agency.net", "agency.onmicrosoft.com", "dhs.agency.gov", "agency.mail.onmicrosoft.com", "test365.agency.dhs.gov" ], "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" ], "Exceptions": null, "Identity": "Block unknown malware", "DistinguishedName": "CN=Block unknown malware,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", "ImmutableId": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "Block unknown malware", "IsValid": true, "WhenChanged": "/Date(1657146377000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" }, { "SafeAttachmentPolicy": "AgencyImplementation", "State": "Enabled", "Priority": 1, "Comments": null, "Description": "If the message:rntIs sent to u0027alden.hilton@agency.onmicrosoft.comu0027rntand recipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'AgencyImplementation'.rn", "RuleVersion": { "Major": 15, "Minor": 0, "Build": 5, "Revision": 2, "MajorRevision": 0, "MinorRevision": 2 }, "SentTo": ["alden.hilton@agency.onmicrosoft.com"], "SentToMemberOf": null, "RecipientDomainIs": ["agency.onmicrosoft.com"], "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate", "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" ], "Exceptions": null, "Identity": "AgencyImplementation", "DistinguishedName": "CN=AgencyImplementation,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "9c771902-50c2-428a-b15e-4768da56f444", "ImmutableId": "9c771902-50c2-428a-b15e-4768da56f444", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "AgencyImplementation", "IsValid": true, "WhenChanged": "/Date(1651250217000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" }, { "SafeAttachmentPolicy": "Baseline Policy", "State": "Enabled", "Priority": 2, "Comments": null, "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'Baseline Policy'.rn", "RuleVersion": { "Major": 15, "Minor": 0, "Build": 5, "Revision": 2, "MajorRevision": 0, "MinorRevision": 2 }, "SentTo": null, "SentToMemberOf": null, "RecipientDomainIs": ["agency.onmicrosoft.com"], "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" ], "Exceptions": null, "Identity": "Baseline Policy", "DistinguishedName": "CN=Baseline Policy,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", "ImmutableId": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "Baseline Policy", "IsValid": true, "WhenChanged": "/Date(1651702853000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" } ], "all_domains": [ { "DomainName": "dhs.agency.gov", "CatchAllRecipientID": null, "DomainType": "Authoritative", "MatchSubDomains": false, "AddressBookEnabled": true, "Default": false, "EmailOnly": false, "ExternallyManaged": false, "RawAuthenticationType": "Managed", "AuthenticationType": "Managed", "LiveIdInstanceType": "Business", "PendingRemoval": false, "PendingCompletion": false, "FederatedOrganizationLink": "Federation", "MailFlowPartner": null, "OutboundOnly": false, "PendingFederatedAccountNamespace": false, "PendingFederatedDomain": false, "IsCoexistenceDomain": false, "PerimeterDuplicateDetected": false, "IsDefaultFederatedDomain": false, "EnableNego2Authentication": false, "CanHaveCloudCache": false, "SendingFromDomainDisabled": false, "InitialDomain": false, "AdminDisplayName": "", "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "dhs.agency.gov", "DistinguishedName": "CN=dhs.agency.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "dhs.agency.gov", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", "ObjectClass": ["top", "msExchAcceptedDomain"], "WhenChanged": "/Date(1644602837000)/", "WhenCreated": "/Date(1622044989000)/", "WhenChangedUTC": "/Date(1644602837000)/", "WhenCreatedUTC": "/Date(1622044989000)/", "ExchangeObjectId": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "dhs.agency.gov", "Guid": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" }, { "DomainName": "test365.agency.dhs.gov", "CatchAllRecipientID": null, "DomainType": "Authoritative", "MatchSubDomains": false, "AddressBookEnabled": true, "Default": false, "EmailOnly": false, "ExternallyManaged": false, "RawAuthenticationType": "Managed", "AuthenticationType": "Managed", "LiveIdInstanceType": "Business", "PendingRemoval": false, "PendingCompletion": false, "FederatedOrganizationLink": "Federation", "MailFlowPartner": null, "OutboundOnly": false, "PendingFederatedAccountNamespace": false, "PendingFederatedDomain": false, "IsCoexistenceDomain": false, "PerimeterDuplicateDetected": false, "IsDefaultFederatedDomain": false, "EnableNego2Authentication": false, "CanHaveCloudCache": false, "SendingFromDomainDisabled": false, "InitialDomain": false, "AdminDisplayName": "", "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "test365.agency.dhs.gov", "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "test365.agency.dhs.gov", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", "ObjectClass": ["top", "msExchAcceptedDomain"], "WhenChanged": "/Date(1644607747000)/", "WhenCreated": "/Date(1644607740000)/", "WhenChangedUTC": "/Date(1644607747000)/", "WhenCreatedUTC": "/Date(1644607740000)/", "ExchangeObjectId": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "test365.agency.dhs.gov", "Guid": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" }, { "DomainName": "agency.mail.onmicrosoft.com", "CatchAllRecipientID": null, "DomainType": "Authoritative", "MatchSubDomains": false, "AddressBookEnabled": true, "Default": false, "EmailOnly": false, "ExternallyManaged": false, "RawAuthenticationType": "Managed", "AuthenticationType": "Managed", "LiveIdInstanceType": "Business", "PendingRemoval": false, "PendingCompletion": false, "FederatedOrganizationLink": "Federation", "MailFlowPartner": null, "OutboundOnly": false, "PendingFederatedAccountNamespace": false, "PendingFederatedDomain": false, "IsCoexistenceDomain": true, "PerimeterDuplicateDetected": false, "IsDefaultFederatedDomain": false, "EnableNego2Authentication": false, "CanHaveCloudCache": false, "SendingFromDomainDisabled": false, "InitialDomain": false, "AdminDisplayName": "", "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency.mail.onmicrosoft.com", "DistinguishedName": "CN=agency.mail.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "agency.mail.onmicrosoft.com", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", "ObjectClass": ["top", "msExchAcceptedDomain"], "WhenChanged": "/Date(1638297172000)/", "WhenCreated": "/Date(1638297171000)/", "WhenChangedUTC": "/Date(1638297172000)/", "WhenCreatedUTC": "/Date(1638297171000)/", "ExchangeObjectId": "b9ca153b-90dc-4583-87c4-d74af214be2d", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "agency.mail.onmicrosoft.com", "Guid": "b9ca153b-90dc-4583-87c4-d74af214be2d", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" }, { "DomainName": "agency.onmicrosoft.com", "CatchAllRecipientID": null, "DomainType": "Authoritative", "MatchSubDomains": false, "AddressBookEnabled": true, "Default": true, "EmailOnly": false, "ExternallyManaged": false, "RawAuthenticationType": "Managed", "AuthenticationType": "Managed", "LiveIdInstanceType": "Business", "PendingRemoval": false, "PendingCompletion": false, "FederatedOrganizationLink": "Federation", "MailFlowPartner": null, "OutboundOnly": false, "PendingFederatedAccountNamespace": false, "PendingFederatedDomain": false, "IsCoexistenceDomain": false, "PerimeterDuplicateDetected": false, "IsDefaultFederatedDomain": false, "EnableNego2Authentication": false, "CanHaveCloudCache": false, "SendingFromDomainDisabled": false, "InitialDomain": true, "AdminDisplayName": "", "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency.onmicrosoft.com", "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "agency.onmicrosoft.com", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", "ObjectClass": ["top", "msExchAcceptedDomain"], "WhenChanged": "/Date(1638297928000)/", "WhenCreated": "/Date(1619484595000)/", "WhenChangedUTC": "/Date(1638297928000)/", "WhenCreatedUTC": "/Date(1619484595000)/", "ExchangeObjectId": "e4efdb30-a9d0-4418-b5dc-a2e05cfce7a8", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "agency.onmicrosoft.com", "Guid": "4bb75a29-a0ad-46bc-b70c-e3928a29256a", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" } ], "protection_alerts": [ { "Filter": null, "Operation": ["DlpRuleGenerateAlertMatch"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": { "DlpRuleId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", "EndpointDlpRestrictiveOperations": "FileUploadedToCloud,FileAccessedByUnallowedApp" }, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "DataLossPrevention", "IsSystemRule": false, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", "Priority": 0, "Workload": "AuditAlerting", "Policy": "3b7a951e-cfb8-4c75-ae74-f93079e0f31a", "Comment": "", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "1dc97d3c-e298-4fef-d90f-08db45bcfdbb", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "b314399f-5d64-4c49-98c3-06deb1be2b6f", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "DLP-Baseline Rule", "DistinguishedName": "CN=DLP-Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1682448225000)/", "WhenCreated": "/Date(1651249999000)/", "WhenChangedUTC": "/Date(1682448225000)/", "WhenCreatedUTC": "/Date(1651249999000)/", "ExchangeObjectId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["DlpRuleGenerateAlertMatch"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": { "DlpRuleId": "9a7b93f6-6c70-474c-854a-82116ce288ef" }, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "DataLossPrevention", "IsSystemRule": false, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "37a2473a-9a91-4790-a96f-a93db6da9d55", "Priority": 0, "Workload": "AuditAlerting", "Policy": "389ecc86-2adf-4498-be19-81c3fd5ef512", "Comment": "", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "b7142061-eba9-4341-594a-08db9cf8a82e", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "37a2473a-9a91-4790-a96f-a93db6da9d55", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "DLP-PII Check", "DistinguishedName": "CN=DLP-PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1692039599000)/", "WhenCreated": "/Date(1692039599000)/", "WhenChangedUTC": "/Date(1692039599000)/", "WhenCreatedUTC": "/Date(1692039599000)/", "ExchangeObjectId": "37a2473a-9a91-4790-a96f-a93db6da9d55", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["MipAutoLabelSimulationCompletion"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", "Priority": 0, "Workload": "AuditAlerting", "Policy": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", "Comment": "AutoLabel policy simulation has been completed. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "38ef539d-4bbc-403b-ba71-08d8e31643f7", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "MIP AutoLabel simulation completed", "DistinguishedName": "CN=MIP AutoLabel simulation completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1615306404000)/", "WhenCreated": "/Date(1615306404000)/", "WhenChangedUTC": "/Date(1615306404000)/", "WhenCreatedUTC": "/Date(1615306404000)/", "ExchangeObjectId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", "Operation": ["CompromisedWarningAccount"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "be215649-fba8-4339-9ddd-05991a43b948", "Priority": 0, "Workload": "AuditAlerting", "Policy": "105a3254-0eca-4a3d-8686-a66115a99235", "Comment": "User has been detected as sending suspicious messages outside the organization and will be restricted if this activity continues. -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "6ab41379-a75a-4432-6909-08d7b68de580", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "be215649-fba8-4339-9ddd-05991a43b948", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Suspicious email sending patterns detected", "DistinguishedName": "CN=Suspicious email sending patterns detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1582262485000)/", "WhenCreated": "/Date(1556224605000)/", "WhenChangedUTC": "/Date(1582262485000)/", "WhenCreatedUTC": "/Date(1556224605000)/", "ExchangeObjectId": "be215649-fba8-4339-9ddd-05991a43b948", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and (Mail.IsGenericZapped -eq 1) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malicious", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", "Priority": 0, "Workload": "AuditAlerting", "Policy": "a1f563cc-fb1f-466b-1fb5-08d8d71a3050", "Comment": "Malicious emails were delivered and later removed -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "9f756b13-a826-4e49-bb3e-08da1c767a9f", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "b8f6b088-5487-4c70-037c-08d8d71a43fe", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages removed after delivery​", "DistinguishedName": "CN=Email messages removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1649762441000)/", "WhenCreated": "/Date(1620114418000)/", "WhenChangedUTC": "/Date(1649762441000)/", "WhenCreatedUTC": "/Date(1620114418000)/", "ExchangeObjectId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsCampaignZapped -eq 1 -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malicious", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", "Priority": 0, "Workload": "AuditAlerting", "Policy": "ef850570-5624-42b2-ff0a-08d8d899d578", "Comment": "Emails messages from a campaign were delivered and later removed -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "be3e023e-6cff-4e27-926d-08da1c767be1", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages from a campaign removed after delivery​", "DistinguishedName": "CN=Email messages from a campaign removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1649762443000)/", "WhenCreated": "/Date(1620114417000)/", "WhenChangedUTC": "/Date(1649762443000)/", "WhenCreatedUTC": "/Date(1620114417000)/", "ExchangeObjectId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.AirItemType -eq u0027Useru0027", "Operation": ["AirManualInvestigation"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "845686e4-f843-42cf-36d7-08d8e2eca19c", "Priority": 0, "Workload": "AuditAlerting", "Policy": "fbb0585f-318a-4e26-eec9-08d8e2ec980c", "Comment": "This alert is triggered because an admin triggered investigation of a user -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "9ea1637e-f98f-4a7f-a6ae-08d9565f1334", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "845686e4-f843-42cf-36d7-08d8e2eca19c", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Admin triggered user compromise investigation", "DistinguishedName": "CN=Admin triggered user compromise investigation,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1627982059000)/", "WhenCreated": "/Date(1627982059000)/", "WhenChangedUTC": "/Date(1627982059000)/", "WhenCreatedUTC": "/Date(1627982059000)/", "ExchangeObjectId": "845686e4-f843-42cf-36d7-08d8e2eca19c", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Click.IsSystemBlockOverriden -eq 1) -or (Click.IsTenantBlockOverriden -eq 1)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "None", "ThreatType": "MaliciousUrlClick", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "MaliciousUrlClick", "Scenario": "MaliciousUrlClick", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", "Priority": 0, "Workload": "AuditAlerting", "Policy": "e7fec753-4e4b-491c-2152-08d97b58ad34", "Comment": "We have detected that one of your users has recently clicked through on a link that was found to be malicious. -V1.0.0.3", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "5634e57e-6702-4cdd-f4a0-08da42ee473d", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "A user clicked through to a potentially malicious URL​", "DistinguishedName": "CN=A user clicked through to a potentially malicious URL​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1653992039000)/", "WhenCreated": "/Date(1653992039000)/", "WhenChangedUTC": "/Date(1653992039000)/", "WhenCreatedUTC": "/Date(1653992039000)/", "ExchangeObjectId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["ConnectorAbuse"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", "Priority": 0, "Workload": "AuditAlerting", "Policy": "d1de9ca1-fcd8-4ce1-f041-08da05b11773", "Comment": "Connector has been restricted from sending messages due to potential compromise activity. -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "df6b603b-1b0b-4b0a-7440-08da326d8875", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Suspicious connector activity", "DistinguishedName": "CN=Suspicious connector activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1652177524000)/", "WhenCreated": "/Date(1652177524000)/", "WhenChangedUTC": "/Date(1652177524000)/", "WhenCreatedUTC": "/Date(1652177524000)/", "ExchangeObjectId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["UploadDataCompleted"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1647059763913)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "55272906-f9a5-4adf-9395-0abeec18aee1", "Priority": 0, "Workload": "AuditAlerting", "Policy": "8d58b459-63cd-4b73-aca0-f24ed896f018", "Comment": "New sensitive information was uploaded and is ready to be protected. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "a6a5ec5d-6e43-43c3-420c-08d8d285b1f9", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "55272906-f9a5-4adf-9395-0abeec18aee1", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Successful exact data match upload", "DistinguishedName": "CN=Successful exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1613485093000)/", "WhenCreated": "/Date(1613485093000)/", "WhenChangedUTC": "/Date(1613485093000)/", "WhenCreatedUTC": "/Date(1613485093000)/", "ExchangeObjectId": "55272906-f9a5-4adf-9395-0abeec18aee1", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["GrantAdminPermission"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "AccessGovernance", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "17d51759-88e1-40c1-8df3-20bcf2e43057", "Priority": 0, "Workload": "AuditAlerting", "Policy": "ae6108c1-8814-4a00-bf93-22396aad4bd8", "Comment": "This alert is triggered when someone in your organization becomes an Exchange admin or gets new Exchange admin permissions -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "18bb7a7d-0b75-4033-cc22-08d6bdf100e3", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "17d51759-88e1-40c1-8df3-20bcf2e43057", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Elevation of Exchange admin privilege", "DistinguishedName": "CN=Elevation of Exchange admin privilege,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1554927211000)/", "WhenCreated": "/Date(1554927211000)/", "WhenChangedUTC": "/Date(1554927211000)/", "WhenCreatedUTC": "/Date(1554927211000)/", "ExchangeObjectId": "17d51759-88e1-40c1-8df3-20bcf2e43057", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Message.Verdict -eq u0027Blocku0027", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": 1, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "None", "ThreatType": "MailFlow", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "MailFlow", "Scenario": "MailFlowProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "CustomAggregation", "Category": "MailFlow", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "ce504573-4841-4e45-81e2-21e8a11ba221", "Priority": 0, "Workload": "AuditAlerting", "Policy": "497d08c4-ecce-4a94-b8f4-bcce7de01389", "Comment": "This alert is triggered when a reply-all storm is detected and at least one reply-all to the mail thread has been blocked. See the Reply-all Storm Protection mail flow report for more information. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "a41b6668-24a9-47f8-67a4-08dba3f19809", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "ce504573-4841-4e45-81e2-21e8a11ba221", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Reply-all storm detected", "DistinguishedName": "CN=Reply-all storm detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1692806223000)/", "WhenCreated": "/Date(1692806223000)/", "WhenChangedUTC": "/Date(1692806223000)/", "WhenCreatedUTC": "/Date(1692806223000)/", "ExchangeObjectId": "ce504573-4841-4e45-81e2-21e8a11ba221", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Mail.IsSystemZappedMalware -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malware", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659550035493)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "0179b3f7-3fda-40c3-8f24-278563978dbb", "Priority": 0, "Workload": "AuditAlerting", "Policy": "b7d4272b-96c3-4514-b9bd-e4d4c051d162", "Comment": "Emails with malware that were delivered and later removed -V1.0.0.8", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "bd13b65f-ccaf-4fd4-669b-08d90ed0cca9", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "0179b3f7-3fda-40c3-8f24-278563978dbb", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages containing malware removed after delivery", "DistinguishedName": "CN=Email messages containing malware removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1620114419000)/", "WhenCreated": "/Date(1554927210000)/", "WhenChangedUTC": "/Date(1620114419000)/", "WhenCreatedUTC": "/Date(1554927210000)/", "ExchangeObjectId": "0179b3f7-3fda-40c3-8f24-278563978dbb", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByURLs -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malicious", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659550031883)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", "Priority": 0, "Workload": "AuditAlerting", "Policy": "435ca8f9-fb3b-4514-9bec-52fed47d84f9", "Comment": "Emails with malicious URL that were delivered and later removed -V1.0.0.3", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "3f3a9e91-d013-4e37-4a62-08da1c767922", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages containing malicious URL removed after delivery​", "DistinguishedName": "CN=Email messages containing malicious URL removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1649762439000)/", "WhenCreated": "/Date(1612829713000)/", "WhenChangedUTC": "/Date(1649762439000)/", "WhenCreatedUTC": "/Date(1612829713000)/", "ExchangeObjectId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["UserRestrictedByDistributingForms"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618341750470)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "f86c81d5-272e-4825-a957-366e964f702c", "Priority": 0, "Workload": "AuditAlerting", "Policy": "29af60e8-9eae-4962-ba2e-a030fc6f7661", "Comment": "Microsoft Forms identified repeated phishing attempts by a user in your tenant. This user is now blocked from sharing forms and collecting responses. -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "b0409299-daa4-491d-20f0-08d8d285b2c2", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "f86c81d5-272e-4825-a957-366e964f702c", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "User restricted from sharing forms and collecting responses", "DistinguishedName": "CN=User restricted from sharing forms and collecting responses,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1613485094000)/", "WhenCreated": "/Date(1613485094000)/", "WhenChangedUTC": "/Date(1613485094000)/", "WhenCreatedUTC": "/Date(1613485094000)/", "ExchangeObjectId": "f86c81d5-272e-4825-a957-366e964f702c", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Activity.SubmissionType -eq u0027Phishu0027) -or (Activity.SubmissionType -eq u0027Malwareu0027)", "Operation": ["UserSubmission"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659550021173)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", "Priority": 0, "Workload": "AuditAlerting", "Policy": "d326019d-b122-450c-a96e-de82aaf46ab9", "Comment": "This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "63e2710c-398f-46dd-e621-08d909846bab", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email reported by user as malware or phish", "DistinguishedName": "CN=Email reported by user as malware or phish,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1619531859000)/", "WhenCreated": "/Date(1554927209000)/", "WhenChangedUTC": "/Date(1619531859000)/", "WhenCreatedUTC": "/Date(1554927209000)/", "ExchangeObjectId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["RetentionAutoLabelSimulationCompletion"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", "Priority": 0, "Workload": "AuditAlerting", "Policy": "404fd903-ef34-43df-8362-ac45c1bb2a1c", "Comment": "Retention auto-labeling policy simulation has been completed. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "2ad7b104-a45f-4b35-896a-08da6efbe6cf", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Retention Auto-labeling Policy Simulation Completed", "DistinguishedName": "CN=Retention Auto-labeling Policy Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1658835741000)/", "WhenCreated": "/Date(1658835741000)/", "WhenChangedUTC": "/Date(1658835741000)/", "WhenCreatedUTC": "/Date(1658835741000)/", "ExchangeObjectId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.AirItemType -eq u0027Emailu0027", "Operation": ["AirManualInvestigation"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360321020)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "cfb0af3a-7410-445c-a872-45f95c45f0de", "Priority": 0, "Workload": "AuditAlerting", "Policy": "8aa5392e-0533-4a43-9952-b25fcea4af4b", "Comment": "This alert is triggered because an admin triggered manual investigation of an Email from explorer -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "9f5f9152-5833-4255-a2b6-08d88b0fc747", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "cfb0af3a-7410-445c-a872-45f95c45f0de", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Admin triggered manual investigation of email", "DistinguishedName": "CN=Admin triggered manual investigation of email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1605627915000)/", "WhenCreated": "/Date(1605627915000)/", "WhenChangedUTC": "/Date(1605627915000)/", "WhenCreatedUTC": "/Date(1605627915000)/", "ExchangeObjectId": "cfb0af3a-7410-445c-a872-45f95c45f0de", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["eDiscoverySearchStartedOrExported"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360396727)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", "Priority": 0, "Workload": "AuditAlerting", "Policy": "f39d84d4-568b-47d2-8f6d-b4ae9d4aba97", "Comment": "The alert is triggered when users start content searches or eDiscovery searches or when search results are downloaded or exported -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "a2b6879c-35c4-4147-7c67-08d909846d2b", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "6fdc5710-3998-47f0-afbb-57cefd7378ae", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "eDiscovery search started or exported", "DistinguishedName": "CN=eDiscovery search started or exported,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1619531862000)/", "WhenCreated": "/Date(1554927214000)/", "WhenChangedUTC": "/Date(1619531862000)/", "WhenCreatedUTC": "/Date(1554927214000)/", "ExchangeObjectId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["QuarantineRequestReleaseMessage"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "34116cef-7761-4cdf-a30b-5aa944d93d74", "Priority": 0, "Workload": "AuditAlerting", "Policy": "c633eeaf-090e-4dc2-ad59-770158128390", "Comment": "A user has requested to release an email from quarantine. -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "e57d8c5b-83f6-4c92-bf85-08d9a96de94d", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "34116cef-7761-4cdf-a30b-5aa944d93d74", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "User requested to release a quarantined message", "DistinguishedName": "CN=User requested to release a quarantined message,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1637114378000)/", "WhenCreated": "/Date(1637114378000)/", "WhenChangedUTC": "/Date(1637114378000)/", "WhenCreatedUTC": "/Date(1637114378000)/", "ExchangeObjectId": "34116cef-7761-4cdf-a30b-5aa944d93d74", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByFiles -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malicious", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659550000637)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", "Priority": 0, "Workload": "AuditAlerting", "Policy": "c056ed0c-0a2c-4c2f-989e-c32681100d63", "Comment": "Emails with malicious file that were delivered and later removed -V1.0.0.3", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "bdbe591f-7207-4f25-9ea0-08da1c767b27", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages containing malicious file removed after delivery​", "DistinguishedName": "CN=Email messages containing malicious file removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1649762442000)/", "WhenCreated": "/Date(1612829714000)/", "WhenChangedUTC": "/Date(1649762442000)/", "WhenCreatedUTC": "/Date(1612829714000)/", "ExchangeObjectId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.Operation -eq u0027MSTICNationStateNotificationu0027", "Operation": ["MSTICNationStateNotification"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", "Priority": 0, "Workload": "AuditAlerting", "Policy": "3942e844-78a9-4110-9f47-9f6c1e1d1c99", "Comment": "Microsoft Threat Intelligence Center detected an attempt to compromise accounts from your tenant. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "9b5ff5c6-ff67-43a3-31ab-08d9a96de846", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Potential Nation-State Activity", "DistinguishedName": "CN=Potential Nation-State Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1637114376000)/", "WhenCreated": "/Date(1637114376000)/", "WhenChangedUTC": "/Date(1637114376000)/", "WhenCreatedUTC": "/Date(1637114376000)/", "ExchangeObjectId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["EmailSendingLimitExceeded"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360467210)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", "Priority": 0, "Workload": "AuditAlerting", "Policy": "66420b7c-b772-4749-8e23-01672295fcc2", "Comment": "User has exceeded their email sending limit and the action defined within the Outbound Spam policy has been applied. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "31f20d68-c10f-47b4-20ea-08d74b7e0175", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email sending limit exceeded", "DistinguishedName": "CN=Email sending limit exceeded,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1570490885000)/", "WhenCreated": "/Date(1570490885000)/", "WhenChangedUTC": "/Date(1570490885000)/", "WhenCreatedUTC": "/Date(1570490885000)/", "ExchangeObjectId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Activity.AirAdminActionType -eq u0027MailActionu0027 -or Activity.AirAdminActionType -eq u0027BlockUrlActionu0027 -or Activity.AirAdminActionType -eq u0027BlockSenderActionu0027)", "Operation": ["AirAdminActionInvestigation"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659549993130)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "39c5b427-a54f-4c38-a799-8541c5a105a8", "Priority": 0, "Workload": "AuditAlerting", "Policy": "bcafb035-406a-4a14-b5c3-67396c524edc", "Comment": "This alert is triggered when an admin takes remediation action on the selected entity -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "846b7457-58a3-439c-1d0e-08d88b0fc808", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "39c5b427-a54f-4c38-a799-8541c5a105a8", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Remediation action taken by admin on emails or URL or sender", "DistinguishedName": "CN=Remediation action taken by admin on emails or URL or sender,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1605627917000)/", "WhenCreated": "/Date(1605627917000)/", "WhenChangedUTC": "/Date(1605627917000)/", "WhenCreatedUTC": "/Date(1605627917000)/", "ExchangeObjectId": "39c5b427-a54f-4c38-a799-8541c5a105a8", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["MailRedirect"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Priority": 0, "Workload": "AuditAlerting", "Policy": "bc59a7c1-2cfd-49da-b762-f643f204babe", "Comment": "This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "0d925ec2-9609-4c1b-cea4-08d909846c4c", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Creation of forwarding/redirect rule", "DistinguishedName": "CN=Creation of forwarding/redirect rule,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1619531860000)/", "WhenCreated": "/Date(1554927211000)/", "WhenChangedUTC": "/Date(1619531860000)/", "WhenCreatedUTC": "/Date(1554927211000)/", "ExchangeObjectId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", "Operation": ["CompromisedAccount"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618341798657)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", "Priority": 0, "Workload": "AuditAlerting", "Policy": "743af9b5-f679-418a-88e9-77360cd02fce", "Comment": "User has been restricted from sending messages outside the organization due to potential compromised activity. -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "2ba121d0-5190-4209-d909-08d7b68de683", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "7a4e7306-bbcb-401f-b112-8ca5f798a230", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "User restricted from sending email", "DistinguishedName": "CN=User restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1582262487000)/", "WhenCreated": "/Date(1554927215000)/", "WhenChangedUTC": "/Date(1582262487000)/", "WhenCreatedUTC": "/Date(1554927215000)/", "ExchangeObjectId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.EventId -eq u002712u0027", "Operation": ["TenantAllowBlockListItemRemoved"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", "Priority": 0, "Workload": "AuditAlerting", "Policy": "19668d63-14b5-46f9-ab2e-382f2c949ba4", "Comment": "A Tenant Allow/Block List entry will be removed. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "8ae64027-d367-4e6b-cd08-08db2726a5b7", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "d0d83ae6-5fbc-4400-8863-9276921a9cad", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Removed an entry in Tenant Allow/Block List", "DistinguishedName": "CN=Removed an entry in Tenant Allow/Block List,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1679085114000)/", "WhenCreated": "/Date(1679085114000)/", "WhenChangedUTC": "/Date(1679085114000)/", "WhenCreatedUTC": "/Date(1679085114000)/", "ExchangeObjectId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.SubmissionType -eq u0027Junku0027", "Operation": ["UserSubmission"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "a0e277be-7157-4907-874e-93e7b5170657", "Priority": 0, "Workload": "AuditAlerting", "Policy": "452dd2e4-5755-46a1-bbc4-18775737762b", "Comment": "This alert is triggered when any email message is reported as junk by users -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "d5ff0075-b39c-408f-0a5f-08db354d4c0d", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "a0e277be-7157-4907-874e-93e7b5170657", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email reported by user as junk", "DistinguishedName": "CN=Email reported by user as junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1680641030000)/", "WhenCreated": "/Date(1680641030000)/", "WhenChangedUTC": "/Date(1680641030000)/", "WhenCreatedUTC": "/Date(1680641030000)/", "ExchangeObjectId": "a0e277be-7157-4907-874e-93e7b5170657", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.IsMailZAPFailed -eq 1) -and ((((Mail.IsSystemZappedByFiles -eq 1) -or (Mail.IsSystemZappedByURLs -eq 1)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)) -or (((Mail.IsGenericZapped -eq 1) -or(Mail.IsCampaignZapped -eq 1)) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malicious", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "663e723a-4a74-47d9-9690-9638f0d496af", "Priority": 0, "Workload": "AuditAlerting", "Policy": "01fb826b-ea22-426e-b553-75fa3afd16f9", "Comment": "Messages containing a malicious entity were delivered, and we could not remove them after delivery. Manual action is required. Please remove the malicious messages for the affected users. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "d0778db8-27f7-4d8f-3e2e-08da1c7679dc", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "663e723a-4a74-47d9-9690-9638f0d496af", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Messages containing malicious entity not removed after delivery", "DistinguishedName": "CN=Messages containing malicious entity not removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1649762440000)/", "WhenCreated": "/Date(1649762440000)/", "WhenChangedUTC": "/Date(1649762440000)/", "WhenCreatedUTC": "/Date(1649762440000)/", "ExchangeObjectId": "663e723a-4a74-47d9-9690-9638f0d496af", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["UnifiedSimulationCompletionNotification"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "7b99aef6-dca7-43b5-828a-96679dd553fc", "Priority": 0, "Workload": "AuditAlerting", "Policy": "1eb13e5b-2a40-4fca-85e7-a1a3072c04ed", "Comment": "Simulation Horizontal policy simulation has been completed. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "7f9d151a-1148-43f5-5417-08db9f8e3469", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "7b99aef6-dca7-43b5-828a-96679dd553fc", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "SimH Simulation Completed", "DistinguishedName": "CN=SimH Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1692323731000)/", "WhenCreated": "/Date(1692323731000)/", "WhenChangedUTC": "/Date(1692323731000)/", "WhenCreatedUTC": "/Date(1692323731000)/", "ExchangeObjectId": "7b99aef6-dca7-43b5-828a-96679dd553fc", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["ExternalFileSharing"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": ["Tenant"], "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360542547)/", "AggregationType": "AnomalousAggregation", "Category": "DataGovernance", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", "Priority": 0, "Workload": "AuditAlerting", "Policy": "94b6d359-065a-493d-a050-2a8c64ea1092", "Comment": "This alert is triggered when the volume of external file sharing activities in your organization becomes unusual -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "46a87444-31c5-4676-a7a6-08d6bdf101db", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "d0ec2b5e-b51e-4b83-a232-972d3971d370", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Unusual volume of external file sharing", "DistinguishedName": "CN=Unusual volume of external file sharing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1554927213000)/", "WhenCreated": "/Date(1554927213000)/", "WhenChangedUTC": "/Date(1554927213000)/", "WhenCreatedUTC": "/Date(1554927213000)/", "ExchangeObjectId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["AutoBlockedForm"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618341910120)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "3d408d75-3093-40de-8611-9d1a273a11dc", "Priority": 0, "Workload": "AuditAlerting", "Policy": "a135d1a5-12e6-432d-8b01-7ea84090691e", "Comment": "Microsoft Forms detected a potential phishing attempt from a form and blocked it from distribution and response collection. -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "4c68e64d-1cb4-41f5-5125-08d8d285b239", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "3d408d75-3093-40de-8611-9d1a273a11dc", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Form blocked due to potential phishing attempt", "DistinguishedName": "CN=Form blocked due to potential phishing attempt,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1613485093000)/", "WhenCreated": "/Date(1613485093000)/", "WhenChangedUTC": "/Date(1613485093000)/", "WhenCreatedUTC": "/Date(1613485093000)/", "ExchangeObjectId": "3d408d75-3093-40de-8611-9d1a273a11dc", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.SubmissionType -eq u0027SecurityRisku0027", "Operation": ["UserSubmission"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", "Priority": 0, "Workload": "AuditAlerting", "Policy": "661febed-80bc-46c2-a413-315d745fecaa", "Comment": "This alert is triggered when any Teams message is reported as security risk by users -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "e4930e0c-0347-49fb-1224-08db2726a78b", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "34c03748-ee5d-415e-bb65-9fbac7d3a358", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Teams message reported by user as security risk", "DistinguishedName": "CN=Teams message reported by user as security risk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1679085117000)/", "WhenCreated": "/Date(1679085117000)/", "WhenChangedUTC": "/Date(1679085117000)/", "WhenCreatedUTC": "/Date(1679085117000)/", "ExchangeObjectId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ETRu0027 -or Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Phish", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360572847)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", "Priority": 0, "Workload": "AuditAlerting", "Policy": "ce633f0a-0361-46b7-bbb0-5452f5669eec", "Comment": "This alert fires when message containing phish was delivered due to an ETR override. -V1.0.0.5", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "51f32097-ce41-4c33-b1cb-08db52c776a6", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Phish delivered due to an ETR override", "DistinguishedName": "CN=Phish delivered due to an ETR override,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1683882084000)/", "WhenCreated": "/Date(1683882084000)/", "WhenChangedUTC": "/Date(1683882084000)/", "WhenCreatedUTC": "/Date(1683882084000)/", "ExchangeObjectId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Malware", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659550158373)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", "Priority": 0, "Workload": "AuditAlerting", "Policy": "2dc8e550-89dc-4e6b-9a0d-9d7135aa9452", "Comment": "This alert fires when message containing malware was not zapped because ZAP is disabled. -V1.0.0.6", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "973b64cd-8165-4c8c-59ba-08da84ea1d2a", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Malware not zapped because ZAP is disabled", "DistinguishedName": "CN=Malware not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1661247027000)/", "WhenCreated": "/Date(1661247027000)/", "WhenChangedUTC": "/Date(1661247027000)/", "WhenCreatedUTC": "/Date(1661247027000)/", "ExchangeObjectId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["SuspiciousForwarding"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360602643)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "bfd48f06-0865-41a6-85ff-adb746423ebf", "Priority": 0, "Workload": "AuditAlerting", "Policy": "1aa1676e-04c0-4b5e-bd0c-bf21c3a44971", "Comment": "This alert is triggered once suspicious email forwarding is detected. -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "168fa645-e76c-41d5-1e2f-08d909846ed2", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "bfd48f06-0865-41a6-85ff-adb746423ebf", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Suspicious Email Forwarding Activity", "DistinguishedName": "CN=Suspicious Email Forwarding Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1619531864000)/", "WhenCreated": "/Date(1602615783000)/", "WhenChangedUTC": "/Date(1619531864000)/", "WhenCreatedUTC": "/Date(1602615783000)/", "ExchangeObjectId": "bfd48f06-0865-41a6-85ff-adb746423ebf", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Mail.IsSystemZappedPhish -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Phish", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1659549976010)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "ea8169fa-0678-4751-8854-aebea7adeceb", "Priority": 0, "Workload": "AuditAlerting", "Policy": "6df73299-4af9-4173-97ff-800926831e09", "Comment": "Emails with phish URLs that were delivered and later removed -V1.0.0.8", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "bf7b7b1f-b824-432a-1c94-08d90ed0cae4", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "ea8169fa-0678-4751-8854-aebea7adeceb", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email messages containing phish URLs removed after delivery", "DistinguishedName": "CN=Email messages containing phish URLs removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1620114416000)/", "WhenCreated": "/Date(1554927211000)/", "WhenChangedUTC": "/Date(1620114416000)/", "WhenCreatedUTC": "/Date(1554927211000)/", "ExchangeObjectId": "ea8169fa-0678-4751-8854-aebea7adeceb", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "MessagesQueued.QueuedType -eq u0027ConnectorBasedMessagesQueuedu0027", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@cacilabs.net"], "Severity": "High", "Threshold": 2000, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "None", "ThreatType": "MailFlow", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "MailFlow", "Scenario": "MailFlowProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360686427)/", "AggregationType": "CustomAggregation", "Category": "MailFlow", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", "Priority": 0, "Workload": "AuditAlerting", "Policy": "ba52bbe8-d298-494f-893f-b1e9a4c18b86", "Comment": "When Office 365 canu0027t deliver a message to your on-premises or partner servers via a connector, the message is queued in Office 365. This alert is triggered when the number of queued messages exceeds the policy threshold and have been queued for more than an hour. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "0ffd792e-cb1d-4ae7-6444-08d6bdf1012f", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "37a4e852-e711-45ca-b0f4-b076bae3adfd", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Messages have been delayed", "DistinguishedName": "CN=Messages have been delayed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1554927212000)/", "WhenCreated": "/Date(1554927212000)/", "WhenChangedUTC": "/Date(1554927212000)/", "WhenCreatedUTC": "/Date(1554927212000)/", "ExchangeObjectId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["ComplianceManagerActionScoreChange"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": 60, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ComplianceManager", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", "Priority": 0, "Workload": "AuditAlerting", "Policy": "c96a4b5c-8274-4f09-9d6f-badfa5744011", "Comment": "This default policy will generate an alert for events that happen within 60 minutes of alert creation -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "3a773fda-8402-4264-5a78-08da4de2a787", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Compliance Manager Default Alert Policy", "DistinguishedName": "CN=Compliance Manager Default Alert Policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1655196509000)/", "WhenCreated": "/Date(1655196509000)/", "WhenChangedUTC": "/Date(1655196509000)/", "WhenCreatedUTC": "/Date(1655196509000)/", "ExchangeObjectId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["CompromisedUnprovisionedTenantAccount"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360702013)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", "Priority": 0, "Workload": "AuditAlerting", "Policy": "50e7139b-1e4f-43ed-90e3-ce2e4fc5a2cf", "Comment": "The majority of traffic related to unprovisioned domains from this tenant has been detected as suspicious and the tenant has been restricted from sending email with unregistered domains. Investigate any potentially compromised user/admins, new connectors, or open relays and contact support to unblock your tenant. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "56aa9a70-8ff4-4d79-0afa-08d77d1227cb", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Tenant restricted from sending unprovisioned email", "DistinguishedName": "CN=Tenant restricted from sending unprovisioned email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1575942122000)/", "WhenCreated": "/Date(1575942122000)/", "WhenChangedUTC": "/Date(1575942122000)/", "WhenCreatedUTC": "/Date(1575942122000)/", "ExchangeObjectId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["CompromisedTenantAccount"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618341961437)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "a7032ff5-7eee-412b-805b-d1295c7e0932", "Priority": 0, "Workload": "AuditAlerting", "Policy": "e16d6517-4230-46e3-9514-4adf9c162d98", "Comment": "The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending ability for the tenant. Ensure that any compromises or open relays have been resolved, and then contact support through your regular channel. -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "89dbe751-2576-4aee-2501-08d77d12288d", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "a7032ff5-7eee-412b-805b-d1295c7e0932", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Tenant restricted from sending email", "DistinguishedName": "CN=Tenant restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1575942123000)/", "WhenCreated": "/Date(1561476913000)/", "WhenChangedUTC": "/Date(1575942123000)/", "WhenCreatedUTC": "/Date(1561476913000)/", "ExchangeObjectId": "a7032ff5-7eee-412b-805b-d1295c7e0932", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["TenantAllowBlockListItemGraderDisagree"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "5ba37278-d17b-4674-bde7-d19ad231e324", "Priority": 0, "Workload": "AuditAlerting", "Policy": "00341b6e-c377-4f92-9fcb-57808f9bc1c2", "Comment": "A Tenant Allow/Block List entry has been found malicious by grader. We recommend you remove the allow entry from the Tenant Allow/Block List. -V1.0.0.1", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "101ef390-a5cf-4d88-cef1-08db3668d570", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "5ba37278-d17b-4674-bde7-d19ad231e324", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "A Tenant Allow Block List entry has been found malicious", "DistinguishedName": "CN=A Tenant Allow Block List entry has been found malicious,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1680762808000)/", "WhenCreated": "/Date(1680762808000)/", "WhenChangedUTC": "/Date(1680762808000)/", "WhenCreatedUTC": "/Date(1680762808000)/", "ExchangeObjectId": "5ba37278-d17b-4674-bde7-d19ad231e324", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "Activity.SubmissionType -eq u0027NotJunku0027", "Operation": ["UserSubmission"], "LogicalOperationName": null, "NotificationEnabled": false, "NotifyUser": ["TenantAdmins"], "Severity": "Low", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", "Priority": 0, "Workload": "AuditAlerting", "Policy": "8d510111-35c2-49df-9589-d582b05d7312", "Comment": "This alert is triggered when any email message is reported as not junk by users -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "1fb1dac9-9db3-4384-1b23-08db354d4af6", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "79b0a077-8446-4d8c-b335-d89cdcd60b08", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Email reported by user as not junk", "DistinguishedName": "CN=Email reported by user as not junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1680641029000)/", "WhenCreated": "/Date(1680641029000)/", "WhenChangedUTC": "/Date(1680641029000)/", "WhenCreatedUTC": "/Date(1680641029000)/", "ExchangeObjectId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ConnPolicyu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Phish", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360742317)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", "Priority": 0, "Workload": "AuditAlerting", "Policy": "cab1e16d-c018-40aa-9bcd-0f507e952fb5", "Comment": "This alert fires when message containing phish was delivered due to an IP allow policy. -V1.0.0.4", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "bdf55924-0f02-4fb5-beea-08db52c774a3", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "8bd89c8d-1425-45ba-838a-e15fb89808d2", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Phish delivered due to an IP allow policy", "DistinguishedName": "CN=Phish delivered due to an IP allow policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1683882081000)/", "WhenCreated": "/Date(1683882081000)/", "WhenChangedUTC": "/Date(1683882081000)/", "WhenCreatedUTC": "/Date(1683882081000)/", "ExchangeObjectId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["cloudsecurity@agency.net"], "Severity": "Medium", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Mail", "ThreatType": "Phish", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Protection", "Scenario": "ProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": "/Date(1618360763477)/", "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", "Priority": 0, "Workload": "AuditAlerting", "Policy": "4cfaefb2-b4bd-4306-becb-141044e80cd5", "Comment": "This alert fires when message containing phish was not zapped because ZAP is disabled -V1.0.0.4", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "1b714863-ceae-4e25-7fda-08da84ea1e7a", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "c2a1f0cd-a669-49bc-a22b-e501350935e3", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Phish not zapped because ZAP is disabled", "DistinguishedName": "CN=Phish not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1661247029000)/", "WhenCreated": "/Date(1661247029000)/", "WhenChangedUTC": "/Date(1661247029000)/", "WhenCreatedUTC": "/Date(1661247029000)/", "ExchangeObjectId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["UploadDataFailed"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "cafdbfad-0084-4052-8371-ea098aab3f64", "Priority": 0, "Workload": "AuditAlerting", "Policy": "fe23dc56-038d-483c-a528-64d9d4ff6d34", "Comment": "New sensitive information failed to upload. Try again later. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "5dbae4ff-5372-42f4-ce34-08d8d285b158", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "cafdbfad-0084-4052-8371-ea098aab3f64", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Failed exact data match upload", "DistinguishedName": "CN=Failed exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1613485092000)/", "WhenCreated": "/Date(1613485092000)/", "WhenChangedUTC": "/Date(1613485092000)/", "WhenCreatedUTC": "/Date(1613485092000)/", "ExchangeObjectId": "cafdbfad-0084-4052-8371-ea098aab3f64", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["OSTTakenDownForm"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "2d161684-8def-403c-9df6-f20c66c64161", "Priority": 0, "Workload": "AuditAlerting", "Policy": "6f6b38f4-718f-496e-8c4c-211509eb9eb4", "Comment": "A form created in Microsoft Forms from within your organization has been identified as phishing through Report Abuse and confirmed as phishing. -V1.0.0.2", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "349611dd-92fb-4c99-8650-08d8d285b310", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "2d161684-8def-403c-9df6-f20c66c64161", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Form flagged and confirmed as phishing", "DistinguishedName": "CN=Form flagged and confirmed as phishing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1613485094000)/", "WhenCreated": "/Date(1613485094000)/", "WhenChangedUTC": "/Date(1613485094000)/", "WhenCreatedUTC": "/Date(1613485094000)/", "ExchangeObjectId": "2d161684-8def-403c-9df6-f20c66c64161", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["TenantAllowBlockListItemExpiry"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "Informational", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "d063f1c3-572d-40ea-a32c-f339cab57a33", "Priority": 0, "Workload": "AuditAlerting", "Policy": "b50db3b4-fb66-4950-a7c0-389dd7d5b09d", "Comment": "A Tenant Allow/Block List entry will be removed due to expiration. -V1.0.0.0", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "9b245f7b-cb18-400a-2722-08d98900fc0a", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "d063f1c3-572d-40ea-a32c-f339cab57a33", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Tenant Allow/Block List entry is about to expire", "DistinguishedName": "CN=Tenant Allow/Block List entry is about to expire,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1633549157000)/", "WhenCreated": "/Date(1633549157000)/", "WhenChangedUTC": "/Date(1633549157000)/", "WhenCreatedUTC": "/Date(1633549157000)/", "ExchangeObjectId": "d063f1c3-572d-40ea-a32c-f339cab57a33", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": null, "Operation": ["TenantExceedsThresholdEarlyAlert"], "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "Activity", "ThreatType": "Activity", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "Activity", "Scenario": "AuditProtectionAlert", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", "Priority": 0, "Workload": "AuditAlerting", "Policy": "9e6a79f3-b756-47a6-9a6c-3f82cce2a4f5", "Comment": "Suspicious sending patterns have been observed in your tenant, which may lead to your tenant being blocked from sending emails. Investigate any potentially compromised user and admin accounts, new connectors, or open relays to avoid tenant exceed threshold blocks. -V1.0.0.5", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "bf127ae6-a71d-46fa-8a31-08da9019a851", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Suspicious tenant sending patterns observed", "DistinguishedName": "CN=Suspicious tenant sending patterns observed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1662476909000)/", "WhenCreated": "/Date(1662476909000)/", "WhenChangedUTC": "/Date(1662476909000)/", "WhenCreatedUTC": "/Date(1662476909000)/", "ExchangeObjectId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" }, { "Filter": "(Click.IsLookBack -eq 1)", "Operation": null, "LogicalOperationName": null, "NotificationEnabled": true, "NotifyUser": ["TenantAdmins"], "Severity": "High", "Threshold": null, "VolumeThreshold": null, "ExternalScenarioData": null, "TimeWindow": null, "NotifyUserOnFilterMatch": false, "MergedRuleXml": null, "StreamType": "None", "ThreatType": "MaliciousUrlClick", "PrivacyManagementScopedSensitiveInformationTypes": null, "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, "AlertBy": null, "AlertFor": null, "AlertScenario": "MaliciousUrlClick", "Scenario": "MaliciousUrlClick", "NotifyUserThrottleThreshold": null, "NotifyUserThrottleWindow": null, "NotifyUserSuppressionExpiryDate": null, "NotificationCulture": null, "AlertOverrideChangedUtc": null, "AggregationType": "None", "Category": "ThreatManagement", "IsSystemRule": true, "TagFilter": null, "UserTags": null, "RecipientTags": null, "SenderTags": null, "CustomProperties": null, "UseCreatedDateTime": null, "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", "ReadOnly": false, "ErrorMetadata": null, "ExternalIdentity": "", "ImmutableId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", "Priority": 0, "Workload": "AuditAlerting", "Policy": "e9a4983d-9f4e-47b0-80d1-fb2097adb484", "Comment": "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5", "Disabled": false, "Mode": "Enforce", "ObjectVersion": "93862b30-0045-4564-44b2-08da42ee4857", "MaximumBlobRuleLength": 0, "CreatedBy": "", "LastModifiedBy": "", "Guid": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "A potentially malicious URL click was detected", "DistinguishedName": "CN=A potentially malicious URL click was detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", "ObjectCategory": null, "ObjectClass": ["msExchUnifiedRule"], "WhenChanged": "/Date(1653992040000)/", "WhenCreated": "/Date(1554927215000)/", "WhenChangedUTC": "/Date(1653992040000)/", "WhenCreatedUTC": "/Date(1554927215000)/", "ExchangeObjectId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", "OriginatingServer": "", "ObjectState": "New" } ], "admin_audit_log_config": [ { "AdminAuditLogEnabled": true, "LogLevel": "None", "TestCmdletLoggingEnabled": false, "AdminAuditLogCmdlets": ["*"], "AdminAuditLogParameters": ["*"], "AdminAuditLogExcludedCmdlets": [], "AdminAuditLogAgeLimit": "90.00:00:00", "LoadBalancerCount": 3, "RefreshInterval": 10, "PartitionInfo": [], "AdminAuditLogMailbox": "", "UnifiedAuditLogIngestionEnabled": true, "UnifiedAuditLogFirstOptInDate": "/Date(1618327011162)/", "AdminDisplayName": "", "ExchangeVersion": "0.10 (14.0.100.0)", "Name": "Admin Audit Log Settings", "DistinguishedName": "CN=Admin Audit Log Settings,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "Admin Audit Log Settings", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Admin-Audit-Log-Config", "ObjectClass": ["top", "msExchAdminAuditLogConfig"], "WhenChanged": "/Date(1619484611000)/", "WhenCreated": "/Date(1619484594000)/", "WhenChangedUTC": "/Date(1619484611000)/", "WhenCreatedUTC": "/Date(1619484594000)/", "ExchangeObjectId": "35b89a9b-b235-4d67-ba7f-7ddeab032801", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "Admin Audit Log Settings", "Guid": "97423bd9-ae36-4a1f-a225-5e007478854f", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Changed" } ], "safe_links_policies": [ { "EnableSafeLinksForEmail": true, "EnableSafeLinksForTeams": true, "EnableSafeLinksForOffice": true, "TrackClicks": true, "AllowClickThrough": true, "ScanUrls": true, "EnableForInternalSenders": false, "DeliverMessageAfterScan": true, "DisableUrlRewrite": true, "DoNotRewriteUrls": [], "AdminDisplayName": "", "CustomNotificationText": "", "LocalizedNotificationTextList": [], "EnableOrganizationBranding": false, "RecommendedPolicyType": "Custom", "IsBuiltInProtection": true, "Identity": "Built-In Protection Policy", "Id": "Built-In Protection Policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Built-In Protection Policy", "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], "WhenChanged": "/Date(1659712331000)/", "WhenCreated": "/Date(1643236367000)/", "WhenChangedUTC": "/Date(1659712331000)/", "WhenCreatedUTC": "/Date(1643236367000)/", "ExchangeObjectId": "ddcb4f6e-396f-4208-a314-17e89fcf481c", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "ddcb4f6e-396f-4208-a314-17e89fcf481c", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "EnableSafeLinksForEmail": true, "EnableSafeLinksForTeams": true, "EnableSafeLinksForOffice": true, "TrackClicks": true, "AllowClickThrough": false, "ScanUrls": true, "EnableForInternalSenders": true, "DeliverMessageAfterScan": true, "DisableUrlRewrite": false, "DoNotRewriteUrls": [], "AdminDisplayName": "", "CustomNotificationText": "", "LocalizedNotificationTextList": [], "EnableOrganizationBranding": false, "RecommendedPolicyType": "Strict", "IsBuiltInProtection": false, "Identity": "Strict Preset Security Policy1681329959203", "Id": "Strict Preset Security Policy1681329959203", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Strict Preset Security Policy1681329959203", "DistinguishedName": "CN=Strict Preset Security Policy1681329959203,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], "WhenChanged": "/Date(1681329967000)/", "WhenCreated": "/Date(1681329959000)/", "WhenChangedUTC": "/Date(1681329967000)/", "WhenCreatedUTC": "/Date(1681329959000)/", "ExchangeObjectId": "27887a2d-22de-4656-a7fd-636c4ed5b765", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "27887a2d-22de-4656-a7fd-636c4ed5b765", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "EnableSafeLinksForEmail": true, "EnableSafeLinksForTeams": true, "EnableSafeLinksForOffice": true, "TrackClicks": true, "AllowClickThrough": false, "ScanUrls": true, "EnableForInternalSenders": true, "DeliverMessageAfterScan": true, "DisableUrlRewrite": false, "DoNotRewriteUrls": [], "AdminDisplayName": "", "CustomNotificationText": "", "LocalizedNotificationTextList": [], "EnableOrganizationBranding": true, "RecommendedPolicyType": "Custom", "IsBuiltInProtection": false, "Identity": "agency Safe Links Policy", "Id": "agency Safe Links Policy", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency Safe Links Policy", "DistinguishedName": "CN=agency Safe Links Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], "WhenChanged": "/Date(1651250012000)/", "WhenCreated": "/Date(1619484593000)/", "WhenChangedUTC": "/Date(1651250012000)/", "WhenCreatedUTC": "/Date(1619484593000)/", "ExchangeObjectId": "df4b69fe-c42a-4458-a3ff-9ee56509724b", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "8b74f795-60d5-4d5d-8d49-acc928045c42", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "EnableSafeLinksForEmail": true, "EnableSafeLinksForTeams": true, "EnableSafeLinksForOffice": true, "TrackClicks": true, "AllowClickThrough": false, "ScanUrls": true, "EnableForInternalSenders": true, "DeliverMessageAfterScan": true, "DisableUrlRewrite": false, "DoNotRewriteUrls": [], "AdminDisplayName": "", "CustomNotificationText": "", "LocalizedNotificationTextList": [], "EnableOrganizationBranding": false, "RecommendedPolicyType": "Standard", "IsBuiltInProtection": false, "Identity": "Standard Preset Security Policy1659535436756", "Id": "Standard Preset Security Policy1659535436756", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Standard Preset Security Policy1659535436756", "DistinguishedName": "CN=Standard Preset Security Policy1659535436756,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], "WhenChanged": "/Date(1659535439000)/", "WhenCreated": "/Date(1659535437000)/", "WhenChangedUTC": "/Date(1659535439000)/", "WhenCreatedUTC": "/Date(1659535437000)/", "ExchangeObjectId": "8c2861f1-a488-4120-8c37-6968f6bddcd3", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "8c2861f1-a488-4120-8c37-6968f6bddcd3", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "safe_links_rules": [ { "SafeLinksPolicy": "agency Safe Links Policy", "State": "Enabled", "Priority": 0, "Comments": null, "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027 or u0027dhs.agency.govu0027rnTake the following actions:rntApply safe links policy 'agency Safe Links Policy'.rn", "RuleVersion": { "Major": 15, "Minor": 0, "Build": 5, "Revision": 2, "MajorRevision": 0, "MinorRevision": 2 }, "SentTo": null, "SentToMemberOf": null, "RecipientDomainIs": [ "agency.onmicrosoft.com", "agency.mail.onmicrosoft.com", "test365.agency.dhs.gov", "dhs.agency.gov" ], "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfRecipientDomainIs": null, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" ], "Exceptions": null, "Identity": "agency Safe Links Policy", "DistinguishedName": "CN=agency Safe Links Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", "ImmutableId": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "agency Safe Links Policy", "IsValid": true, "WhenChanged": "/Date(1664811214000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" } ], "atp_policy_for_o365": [ { "AdminDisplayName": "", "EnableATPForSPOTeamsODB": true, "EnableSafeDocs": true, "AllowSafeDocsOpen": false, "Identity": "Default", "Id": "Default", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Default", "DistinguishedName": "CN=Default,CN=Atp Policy For O365,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1626469554000)/", "WhenCreated": "/Date(1626469503000)/", "WhenChangedUTC": "/Date(1626469554000)/", "WhenCreatedUTC": "/Date(1626469503000)/", "ExchangeObjectId": "2aaee10f-6955-4976-be8b-ac1952fcb627", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "2aaee10f-6955-4976-be8b-ac1952fcb627", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "defender_license": true, "defender_successful_commands": [ "Get-AdminAuditLogConfig", "Get-EOPProtectionPolicyRule", "Get-MalwareFilterPolicy", "Get-AntiPhishPolicy", "Get-HostedContentFilterPolicy", "Get-AcceptedDomain", "Get-SafeAttachmentPolicy", "Get-SafeAttachmentRule", "Get-SafeLinksPolicy", "Get-SafeLinksRule", "Get-AtpPolicyForO365", "Get-DlpCompliancePolicy", "Get-ProtectionAlert", "Get-DlpComplianceRule" ], "defender_unsuccessful_commands": [], "remote_domains": [ { "DomainName": "*", "IsInternal": false, "TargetDeliveryDomain": false, "ByteEncoderTypeFor7BitCharsets": "Undefined", "CharacterSet": "iso-8859-1", "NonMimeCharacterSet": "iso-8859-1", "AllowedOOFType": "External", "SmtpDaneMandatoryModeEnabled": false, "AutoReplyEnabled": true, "AutoForwardEnabled": false, "DeliveryReportEnabled": false, "NDREnabled": true, "MeetingForwardNotificationEnabled": true, "ContentType": "MimeHtmlText", "DisplaySenderName": true, "PreferredInternetCodePageForShiftJis": "Undefined", "RequiredCharsetCoverage": null, "TNEFEnabled": false, "LineWrapSize": "Unlimited", "TrustedMailOutboundEnabled": false, "TrustedMailInboundEnabled": false, "UseSimpleDisplayName": false, "NDRDiagnosticInfoEnabled": true, "MessageCountThreshold": 2147483647, "AdminDisplayName": "", "ExchangeVersion": "0.1 (8.0.535.0)", "Name": "Default", "DistinguishedName": "CN=Default,CN=Internet Message Formats,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "Default", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Domain-Content-Config", "ObjectClass": ["top", "msExchDomainContentConfig"], "WhenChanged": "/Date(1652740539000)/", "WhenCreated": "/Date(1619484412000)/", "WhenChangedUTC": "/Date(1652740539000)/", "WhenCreatedUTC": "/Date(1619484412000)/", "ExchangeObjectId": "2042facf-0e9e-4738-ad60-56d6c5d43b5d", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "Default", "Guid": "5c597b00-69f6-44cf-b30b-474fb38a1e0a", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" } ], "spf_records": [ { "domain": "dhs.agency.gov", "rdata": ["v=spf1 include:spf.protection.outlook.com -all"], "log": [ { "query_method": "traditional", "query_result": "Query returned 1 txt records", "query_name": "dhs.agency.gov" } ] }, { "domain": "test365.agency.dhs.gov", "rdata": ["v=spf1 include:spf.protection.outlook.com -all"], "log": [ { "query_method": "traditional", "query_result": "Query returned 1 txt records", "query_name": "test365.agency.dhs.gov" } ] }, { "domain": "agency.mail.onmicrosoft.com", "rdata": ["v=spf1 include:outlook.com -all"], "log": [ { "query_method": "traditional", "query_result": "Query returned 1 txt records", "query_name": "agency.mail.onmicrosoft.com" } ] }, { "domain": "agency.onmicrosoft.com", "rdata": [ "v=spf1 include:spf.protection.outlook.com -all", "checkov:skip=CKV_SECRET_3:This is not an Azure Storage Account access key.", "mscid=d/1e071KOhkmP8Aanr5sNgUqyTBrvrMx5nKSswPxu5ZsqL0bdAgVo3m7f5VYu+inbKA5YviUPzz/SxNS0ploJQ==" ], "log": [ { "query_method": "traditional", "query_result": "Query returned 2 txt records", "query_name": "agency.onmicrosoft.com" } ] } ], "dkim_config": [ { "Domain": "dhs.agency.gov", "AdminDisplayName": "", "Selector1KeySize": 2048, "Selector1CNAME": "selector1-dhs-agency-gov._domainkey.agency.onmicrosoft.com", "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lftsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;", "Selector2KeySize": 2048, "Selector2CNAME": "selector2-dhs-agency-gov._domainkey.agency.onmicrosoft.com", "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmn5LZHYWK9CebUh/P+sris0fCvFhbwTQCGv9U/0QMtDygpX6AG8PUI4wAUURCQ3jESsh7OKARvukQ7T5E30FOA9GrEkRgLgQt//7KftdvWSakpCcNUUQ7IJllUEOKgxo04wZDY8gC66nMy7KvM63ja6+YhxbVJDbqextHYH5gTGGVQbM93Txt8WNQ0ws/IZljDlPv4/Cp+jPf1cnmdCngEWadlm8vT1gsD/eR1GcLL+VsnD1NoyRYwEPTsWTHEJVwki1KADdv1VvrUUWcZ6ofFoElbLydUCeDtDoELeqhUqvG8vFGce2cjGd+WkJ9l0YXeIsU9eY1HS+Dmq0A0gKhQIDAQAB;", "Enabled": true, "IsDefault": false, "HeaderCanonicalization": "Relaxed", "BodyCanonicalization": "Relaxed", "Algorithm": "RsaSHA256", "NumberOfBytesToSign": "All", "IncludeSignatureCreationTime": true, "IncludeKeyExpiration": false, "KeyCreationTime": "/Date(1626472130517)/", "LastChecked": "/Date(1626472130517)/", "RotateOnDate": "/Date(1626817730517)/", "SelectorBeforeRotateOnDate": "selector1", "SelectorAfterRotateOnDate": "selector2", "Status": "Valid", "Identity": "dhs.agency.gov", "Id": "dhs.agency.gov", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "dhs.agency.gov", "DistinguishedName": "CN=dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1626472136000)/", "WhenCreated": "/Date(1626471047000)/", "WhenChangedUTC": "/Date(1626472136000)/", "WhenCreatedUTC": "/Date(1626471047000)/", "ExchangeObjectId": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Domain": "associates.dhs.agency.gov", "AdminDisplayName": "", "Selector1KeySize": 2048, "Selector1CNAME": "selector1-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiJqFoGnKm/i107OGE0xPgaozjujMVN6EAqaJ4RqCqDaHoErrFbuev5u2D1ZlDAAn3aEJ2KvObey6sLl/OcsULS2rO9ooUAOL0tMUR+1bfFiNz8ypH3eJfL7UN5v2bS+xcauTMusMw9lq88mrC1loS78K1sYiqjnUiEIvExO6wEEKXO0mFPpJRkG4pN+TmiByAAabzx+XxnmYdu1ZbRkAlxNxUAcPykhdIJ0UuQmFeQwYBmOhhu8dTaS51bt+SkxQMq9fm1UYcAGaHKKMceGD+agOgI7lPLBoByK/3PwnxGUptJQmZnk6TJ9a1kMbLzllXSneqRkLCv0SCa6SXa2/QIDAQAB;", "Selector2KeySize": 2048, "Selector2CNAME": "selector2-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA05Me3QPcAtSW6CMtxZq7y89zmpvq8QY/4srelDXznTvo/wpMPLLsrsd+lDsbKjX8t7KE+AhNBByRBogbJe9UPAIC2qqAQRgW3cEO89Vt9IJbYxIfzvLEZCiJlo+ixw+K7WvsMlC2M7pwfgWB5YHTcDjkN6Ix8q4FDFNWjReCqJpuaAgeC+2dqprKYVF2XgDk17+4JxuPBQqje8T/9mixIxKEnBHF+LHXDYJaTYZBZbfEwbg7s7ArqqqBYxToPrkbUJbpsF7c/xS+S12uUtxw7sHR5jXU4V15yJT9ed61flsDKTG/nQlSOpyfYgtlfXUm7SfUD532PoIxnuWvv1TJEQIDAQAB;", "Enabled": true, "IsDefault": false, "HeaderCanonicalization": "Relaxed", "BodyCanonicalization": "Relaxed", "Algorithm": "RsaSHA256", "NumberOfBytesToSign": "All", "IncludeSignatureCreationTime": true, "IncludeKeyExpiration": false, "KeyCreationTime": "/Date(1651609815797)/", "LastChecked": "/Date(1651609815797)/", "RotateOnDate": "/Date(1651955415797)/", "SelectorBeforeRotateOnDate": "selector2", "SelectorAfterRotateOnDate": "selector1", "Status": "Valid", "Identity": "associates.dhs.agency.gov", "Id": "associates.dhs.agency.gov", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "associates.dhs.agency.gov", "DistinguishedName": "CN=associates.dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1651609818000)/", "WhenCreated": "/Date(1626471070000)/", "WhenChangedUTC": "/Date(1651609818000)/", "WhenCreatedUTC": "/Date(1626471070000)/", "ExchangeObjectId": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Domain": "test365.agency.dhs.gov", "AdminDisplayName": "", "Selector1KeySize": 2048, "Selector1CNAME": "selector1-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5C8aVe0pDvH1I6/e4sC1IJhNu/OdO9TANT6YG5Q61XQrc4hSyJsW75f3qENcXZAMmsCUZhn7hYdtTv6tcpP/cebcFzmoEatBaVoVWl6R+Gy9/6uPjIrg8s/83le+KXK+TFgR5fighyMlwM937FS9Ii8HQVVzoFU08w6lfDjewLXCwBIk0Y5P0NjW510iaWxTMsnjZ/hrL/REnRRsYB2x8Ll/SHC9nltlGIP3IgcmGPS4DWSdNXTGu10Hz3zML9tRruU96K0TTWs2lRoQoNAn0eu2YLQ5RR8JaLiQ5EYn5lY3ZhDK/4FlAG52AdvkrdbQelwlJiZpBbTUjMk5PvtNUQIDAQAB;", "Selector2KeySize": 2048, "Selector2CNAME": "selector2-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vogy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;", "Enabled": true, "IsDefault": false, "HeaderCanonicalization": "Relaxed", "BodyCanonicalization": "Relaxed", "Algorithm": "RsaSHA256", "NumberOfBytesToSign": "All", "IncludeSignatureCreationTime": true, "IncludeKeyExpiration": false, "KeyCreationTime": "/Date(1653603314013)/", "LastChecked": "/Date(1653603314013)/", "RotateOnDate": "/Date(1653948914013)/", "SelectorBeforeRotateOnDate": "selector1", "SelectorAfterRotateOnDate": "selector2", "Status": "Valid", "Identity": "test365.agency.dhs.gov", "Id": "test365.agency.dhs.gov", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "test365.agency.dhs.gov", "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1653603321000)/", "WhenCreated": "/Date(1651689371000)/", "WhenChangedUTC": "/Date(1653603321000)/", "WhenCreatedUTC": "/Date(1651689371000)/", "ExchangeObjectId": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Domain": "agency.onmicrosoft.com", "AdminDisplayName": "", "Selector1KeySize": 2048, "Selector1CNAME": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNXqII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;", "Selector2KeySize": 2048, "Selector2CNAME": "selector2-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0N9/MWtBA7REPZSGKz9hfYIgF5jm5uri7RVSkaptlnvK0AI6jmJ4TvZ4beFzrfJDh6cIt5gX0UqnTzF9/0UZeyfRuUQAUew/sXU8FZXEnt+Bxr9k8PkAaqr2ksYhY/n46DxrWu1X/Cz7tye5FBnsTbyI6PnaBCfcgzwFnULaojUtdqSQGF7dt4HcyZGnUX1YLNwhp4Lyi9g1bZF6EdNMYHuKXFIsRo5qmEMagIsi557jGlGNTqTKJ9aZWGiCgjFJ14mTUN/itKXb5RqBAfG9KeZQXk6hWGTe7H9lVOshMZgV4t0FyaisrGg5GselbKZukxcA8xsOnCLpjSRUJiUmAQIDAQAB;", "Enabled": true, "IsDefault": true, "HeaderCanonicalization": "Relaxed", "BodyCanonicalization": "Relaxed", "Algorithm": "RsaSHA256", "NumberOfBytesToSign": "All", "IncludeSignatureCreationTime": true, "IncludeKeyExpiration": false, "KeyCreationTime": "/Date(1653603718610)/", "LastChecked": "/Date(1653603718610)/", "RotateOnDate": "/Date(1653949318610)/", "SelectorBeforeRotateOnDate": "selector1", "SelectorAfterRotateOnDate": "selector2", "Status": "Valid", "Identity": "agency.onmicrosoft.com", "Id": "agency.onmicrosoft.com", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency.onmicrosoft.com", "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1653603723000)/", "WhenCreated": "/Date(1619484596000)/", "WhenChangedUTC": "/Date(1653603723000)/", "WhenCreatedUTC": "/Date(1619484596000)/", "ExchangeObjectId": "ea1866b3-b7fa-4dbe-b9c9-48087391a536", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "476371c0-bf15-4101-84a7-a3a03b4266f1", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" }, { "Domain": "agency.net", "AdminDisplayName": "", "Selector1KeySize": 2048, "Selector1CNAME": "selector1-agency-net._domainkey.agency.onmicrosoft.com", "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxV9ibpvnJt6CCoHMtsiGp1D0JPqsPMjI5aP+vDzVtrRSz34yMTvVXQ0UhCjVLoOJL9SSWobjhFnK+26+sOMSbWf1ARUhcVItUjOutZ/8RBW/LYyCTrPVZBsFcgjfK+ugBx7ygPWyvLsAryNL4aMGOe1YKHTvTaPoXImUtq4FyjUNkzVL+N1m2nkpj2PtRja8iHVvXe0v59KhJeFpEI7XHsNYk14RZHflP5zpUi8wqER9RokPpWVRJRwqPBqh4krm0WWmlfGksUzJI2MqmE1rOzTKedri6F2o0vZY1m6XCPi3StTXVFXH09NgxlLbI3i+98qGGvkJPaKwLGP+ajjYpQIDAQAB;", "Selector2KeySize": 2048, "Selector2CNAME": "selector2-agency-net._domainkey.agency.onmicrosoft.com", "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtoKjm+o74krUkXM2gDW7kLHVA29qVN2pX3gTWS8ahdOahUphlg2EYS4nuIeiGljPbBWJpyRXLIxWsd9FctUgw75fj7MCa1jZz/rHqiHOnT0kNOLkMadSk6aTJvgPVpknV4T0TLhrz9rdIsOX6TjyB0n1MIpKNZTVrwDpGRfO2x/KkzaAvqevGu8i0NBj9dyFk2i7rmpV4SYt5j3QyONuW5M+s+XzkNmPUZuFt/9qP1Jm7A11Wnu9z/9WuiAPJsVCNZh2ZizXE6IQzBMrb1qJtbnjqqnOeJUJ057lcUzwjADV3JJi9Oj7GPN+AChlbiFx+82F9Fwf4md2N7UlrzbZgQIDAQAB;", "Enabled": true, "IsDefault": false, "HeaderCanonicalization": "Relaxed", "BodyCanonicalization": "Relaxed", "Algorithm": "RsaSHA256", "NumberOfBytesToSign": "All", "IncludeSignatureCreationTime": true, "IncludeKeyExpiration": false, "KeyCreationTime": "/Date(1618337906904)/", "LastChecked": "/Date(1618339026879)/", "RotateOnDate": "/Date(1618337906904)/", "SelectorBeforeRotateOnDate": "selector2", "SelectorAfterRotateOnDate": "selector1", "Status": "Valid", "Identity": "agency.net", "Id": "agency.net", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "agency.net", "DistinguishedName": "CN=agency.net,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", "ObjectClass": ["top", "msExchHostedContentFilterConfig"], "WhenChanged": "/Date(1619484611000)/", "WhenCreated": "/Date(1619484597000)/", "WhenChangedUTC": "/Date(1619484611000)/", "WhenCreatedUTC": "/Date(1619484597000)/", "ExchangeObjectId": "28c37edc-ac62-41ce-933e-0f02f1af767c", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "8e977acc-dd79-4c83-be46-f792a515ab97", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "dkim_records": [ { "domain": "dhs.agency.gov", "rdata": [ "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lf", "tsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;" ], "log": [ { "query_method": "traditional", "query_result": "Query returned 2 txt records", "query_name": "selector1._domainkey.dhs.agency.gov" } ] }, { "domain": "test365.agency.dhs.gov", "rdata": [ "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vo", "gy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;" ], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.test365.agency.dhs.gov" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.test365.agency.dhs.gov" }, { "query_method": "traditional", "query_result": "Query returned 2 txt records", "query_name": "selector2._domainkey.test365.agency.dhs.gov" } ] }, { "domain": "agency.mail.onmicrosoft.com", "rdata": [], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" } ] }, { "domain": "agency.onmicrosoft.com", "rdata": [ "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNX", "qII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;" ], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.agency.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector1._domainkey.agency.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "selector2._domainkey.agency.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "selector2._domainkey.agency.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned 2 txt records", "query_name": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com" } ] } ], "dmarc_records": [ { "domain": "dhs.agency.gov", "rdata": ["v=DMARC1; p=reject; sp=none;"], "log": [ { "query_method": "traditional", "query_result": "Query returned 1 txt records", "query_name": "_dmarc.dhs.agency.gov" } ] }, { "domain": "test365.agency.dhs.gov", "rdata": [ "v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov" ], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "_dmarc.test365.agency.dhs.gov" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "_dmarc.test365.agency.dhs.gov" }, { "query_method": "traditional", "query_result": "Query returned 1 txt records", "query_name": "_dmarc.dhs.gov" } ] }, { "domain": "agency.mail.onmicrosoft.com", "rdata": [], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "_dmarc.agency.mail.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "_dmarc.agency.mail.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "_dmarc.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "_dmarc.onmicrosoft.com" } ] }, { "domain": "agency.onmicrosoft.com", "rdata": [], "log": [ { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "_dmarc.agency.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "_dmarc.agency.onmicrosoft.com" }, { "query_method": "traditional", "query_result": "Query returned NXDomain", "query_name": "_dmarc.onmicrosoft.com" }, { "query_method": "DoH", "query_result": "Query returned NXDomain", "query_name": "_dmarc.onmicrosoft.com" } ] } ], "transport_config": [ { "Name": "Transport Settings", "TLSReceiveDomainSecureList": [], "TLSSendDomainSecureList": [], "GenerateCopyOfDSNFor": [], "InternalSMTPServers": [], "JournalingReportNdrTo": "u003cu003e", "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@agency.onmicrosoft.com", "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", "MaxDumpsterTime": "7.00:00:00", "VerifySecureSubmitEnabled": false, "ClearCategories": true, "AddressBookPolicyRoutingEnabled": false, "ConvertDisclaimerWrapperToEml": false, "PreserveReportBodypart": true, "ConvertReportToMessage": false, "DSNConversionMode": "PreserveDSNBody", "VoicemailJournalingEnabled": true, "HeaderPromotionModeSetting": "NoCreate", "Xexch50Enabled": true, "Rfc2231EncodingEnabled": false, "OpenDomainRoutingEnabled": false, "MaxReceiveSize": "Unlimited", "MaxRecipientEnvelopeLimit": "Unlimited", "MaxSendSize": "Unlimited", "ExternalDelayDsnEnabled": true, "ExternalDsnDefaultLanguage": null, "ExternalDsnLanguageDetectionEnabled": true, "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", "ExternalDsnReportingAuthority": null, "ExternalDsnSendHtml": true, "ExternalPostmasterAddress": null, "InternalDelayDsnEnabled": true, "InternalDsnDefaultLanguage": null, "InternalDsnLanguageDetectionEnabled": true, "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", "InternalDsnReportingAuthority": null, "InternalDsnSendHtml": true, "SupervisionTags": ["Reject", "Allow"], "HygieneSuite": "Premium", "MigrationEnabled": true, "LegacyJournalingMigrationEnabled": false, "LegacyArchiveJournalingEnabled": false, "RedirectDLMessagesForLegacyArchiveJournaling": false, "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, "LegacyArchiveLiveJournalingEnabled": false, "JournalArchivingEnabled": false, "SafetyNetHoldTime": "7.00:00:00", "TransportRuleConfig": [ "TransportRuleMinProductVersion:14.0.0.0", "TransportRuleRegexValidationTimeout:00:00:00.3000000", "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", "TransportRuleSizeLimit:8 KB (8,192 bytes)", "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", "TransportRuleLimit:300", "TransportRuleCollectionAddedRecipientsLimit:100" ], "TransportRuleCollectionAddedRecipientsLimit": 100, "TransportRuleLimit": 300, "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", "TransportRuleSizeLimit": "8 KB (8,192 bytes)", "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", "TransportRuleRegexValidationTimeout": "00:00:00.3000000", "TransportRuleMinProductVersion": { "Major": 14, "Minor": 0, "Build": 0, "Revision": 0, "MajorRevision": 0, "MinorRevision": 0 }, "AnonymousSenderToRecipientRatePerHour": 1800, "QueueDiagnosticsAggregationInterval": "00:01:00", "JournalReportDLMemberSubstitutionEnabled": false, "DiagnosticsAggregationServicePort": 9710, "TransportSystemState": "", "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, "MaxAllowedAgentGeneratedMessageDepth": 3, "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, "AttributionRejectConsumerMessages": false, "AttributionRejectBeforeMServRequest": false, "SmtpClientAuthenticationDisabled": true, "JournalMessageExpirationDays": 0, "ReplyAllStormProtectionEnabled": true, "ReplyAllStormDetectionMinimumRecipients": 2500, "ReplyAllStormDetectionMinimumReplies": 10, "AllowLegacyTLSClients": null, "ReplyAllStormBlockDurationHours": 6, "MessageExpiration": "1.00:00:00", "EnableExternalHTTPMailDelivery": false, "CurrentTransportSystemState": "Green", "OtherWellKnownObjects": [], "AdminDisplayName": "", "ExchangeVersion": "0.1 (8.0.535.0)", "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "Transport Settings", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", "ObjectClass": ["top", "container", "msExchTransportSettings"], "WhenChanged": "/Date(1654713404000)/", "WhenCreated": "/Date(1619484398000)/", "WhenChangedUTC": "/Date(1654713404000)/", "WhenCreatedUTC": "/Date(1619484398000)/", "ExchangeObjectId": "7ef195bd-4f88-46bc-97e6-db6c7665321b", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "Transport Settings", "Guid": "01d25010-40a8-4d0a-9419-fb1d775b4d16", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Unchanged" } ], "sharing_policy": [ { "Domains": ["Anonymous:0"], "Enabled": false, "Default": true, "AdminDisplayName": "", "ExchangeVersion": "0.10 (14.0.100.0)", "Name": "Default Sharing Policy", "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Identity": "Default Sharing Policy", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", "ObjectClass": ["top", "msExchSharingPolicy"], "WhenChanged": "/Date(1691164284000)/", "WhenCreated": "/Date(1619484547000)/", "WhenChangedUTC": "/Date(1691164284000)/", "WhenCreatedUTC": "/Date(1619484547000)/", "ExchangeObjectId": "2d52a1ae-4c17-42e0-925e-919b2bf68a18", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Id": "Default Sharing Policy", "Guid": "137df5c0-4fe4-49bb-923c-e2bdfd89f448", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "IsValid": true, "ObjectState": "Changed" } ], "transport_rule": [ { "Priority": 0, "DlpPolicy": null, "DlpPolicyId": "00000000-0000-0000-0000-000000000000", "Comments": null, "CreatedBy": "Grant Brown - CTR", "LastModifiedBy": "Addam Schroll", "ManuallyModified": false, "ActivationDate": null, "ExpiryDate": null, "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", "RuleVersion": { "Major": 14, "Minor": 0, "Build": 0, "Revision": 0, "MajorRevision": 0, "MinorRevision": 0 }, "Size": 398, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" ], "Exceptions": null, "Actions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" ], "State": "Disabled", "Mode": "Enforce", "IsRuleConfigurationSupported": true, "RuleConfigurationUnsupportedReason": "", "RuleErrorAction": "Ignore", "SenderAddressLocation": "Header", "RecipientAddressType": "Resolved", "RuleSubType": "None", "RegexSize": 0, "UseLegacyRegex": false, "From": null, "FromMemberOf": null, "FromScope": "NotInOrganization", "SentTo": null, "SentToMemberOf": null, "SentToScope": null, "BetweenMemberOf1": null, "BetweenMemberOf2": null, "ManagerAddresses": null, "ManagerForEvaluatedUser": null, "SenderManagementRelationship": null, "ADComparisonAttribute": null, "ADComparisonOperator": null, "SenderADAttributeContainsWords": null, "SenderADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "AnyOfToHeader": null, "AnyOfToHeaderMemberOf": null, "AnyOfCcHeader": null, "AnyOfCcHeaderMemberOf": null, "AnyOfToCcHeader": null, "AnyOfToCcHeaderMemberOf": null, "HasClassification": null, "HasNoClassification": false, "SubjectContainsWords": null, "SubjectOrBodyContainsWords": null, "HeaderContainsMessageHeader": null, "HeaderContainsWords": null, "FromAddressContainsWords": null, "SenderDomainIs": null, "RecipientDomainIs": null, "SubjectMatchesPatterns": null, "SubjectOrBodyMatchesPatterns": null, "HeaderMatchesMessageHeader": null, "HeaderMatchesPatterns": null, "FromAddressMatchesPatterns": null, "AttachmentNameMatchesPatterns": null, "AttachmentExtensionMatchesWords": null, "AttachmentPropertyContainsWords": null, "ContentCharacterSetContainsWords": null, "HasSenderOverride": false, "MessageContainsDataClassifications": null, "MessageContainsAllDataClassifications": null, "SenderIpRanges": null, "SCLOver": null, "AttachmentSizeOver": null, "MessageSizeOver": null, "WithImportance": null, "MessageTypeMatches": null, "RecipientAddressContainsWords": null, "RecipientAddressMatchesPatterns": null, "SenderInRecipientList": null, "RecipientInSenderList": null, "AttachmentContainsWords": null, "AttachmentMatchesPatterns": null, "AttachmentIsUnsupported": false, "AttachmentProcessingLimitExceeded": false, "AttachmentHasExecutableContent": false, "AttachmentIsPasswordProtected": false, "AnyOfRecipientAddressContainsWords": null, "AnyOfRecipientAddressMatchesPatterns": null, "ExceptIfFrom": null, "ExceptIfFromMemberOf": null, "ExceptIfFromScope": null, "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfSentToScope": null, "ExceptIfBetweenMemberOf1": null, "ExceptIfBetweenMemberOf2": null, "ExceptIfManagerAddresses": null, "ExceptIfManagerForEvaluatedUser": null, "ExceptIfSenderManagementRelationship": null, "ExceptIfADComparisonAttribute": null, "ExceptIfADComparisonOperator": null, "ExceptIfSenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "ExceptIfAnyOfToHeader": null, "ExceptIfAnyOfToHeaderMemberOf": null, "ExceptIfAnyOfCcHeader": null, "ExceptIfAnyOfCcHeaderMemberOf": null, "ExceptIfAnyOfToCcHeader": null, "ExceptIfAnyOfToCcHeaderMemberOf": null, "ExceptIfHasClassification": null, "ExceptIfHasNoClassification": false, "ExceptIfSubjectContainsWords": null, "ExceptIfSubjectOrBodyContainsWords": null, "ExceptIfHeaderContainsMessageHeader": null, "ExceptIfHeaderContainsWords": null, "ExceptIfFromAddressContainsWords": null, "ExceptIfSenderDomainIs": null, "ExceptIfRecipientDomainIs": null, "ExceptIfSubjectMatchesPatterns": null, "ExceptIfSubjectOrBodyMatchesPatterns": null, "ExceptIfHeaderMatchesMessageHeader": null, "ExceptIfHeaderMatchesPatterns": null, "ExceptIfFromAddressMatchesPatterns": null, "ExceptIfAttachmentNameMatchesPatterns": null, "ExceptIfAttachmentExtensionMatchesWords": null, "ExceptIfAttachmentPropertyContainsWords": null, "ExceptIfContentCharacterSetContainsWords": null, "ExceptIfSCLOver": null, "ExceptIfAttachmentSizeOver": null, "ExceptIfMessageSizeOver": null, "ExceptIfWithImportance": null, "ExceptIfMessageTypeMatches": null, "ExceptIfRecipientAddressContainsWords": null, "ExceptIfRecipientAddressMatchesPatterns": null, "ExceptIfSenderInRecipientList": null, "ExceptIfRecipientInSenderList": null, "ExceptIfAttachmentContainsWords": null, "ExceptIfAttachmentMatchesPatterns": null, "ExceptIfAttachmentIsUnsupported": false, "ExceptIfAttachmentProcessingLimitExceeded": false, "ExceptIfAttachmentHasExecutableContent": false, "ExceptIfAttachmentIsPasswordProtected": false, "ExceptIfAnyOfRecipientAddressContainsWords": null, "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, "ExceptIfHasSenderOverride": false, "ExceptIfMessageContainsDataClassifications": null, "ExceptIfMessageContainsAllDataClassifications": null, "ExceptIfSenderIpRanges": null, "PrependSubject": "[External]", "SetAuditSeverity": null, "ApplyClassification": null, "ApplyHtmlDisclaimerLocation": null, "ApplyHtmlDisclaimerText": null, "ApplyHtmlDisclaimerFallbackAction": null, "ApplyRightsProtectionTemplate": null, "ApplyRightsProtectionCustomizationTemplate": null, "SetSCL": null, "SetHeaderName": null, "SetHeaderValue": null, "RemoveHeader": null, "AddToRecipients": null, "CopyTo": null, "BlindCopyTo": null, "AddManagerAsRecipientType": null, "ModerateMessageByUser": null, "ModerateMessageByManager": false, "RedirectMessageTo": null, "RejectMessageEnhancedStatusCode": null, "RejectMessageReasonText": null, "DeleteMessage": false, "Disconnect": false, "Quarantine": false, "SmtpRejectMessageRejectText": null, "SmtpRejectMessageRejectStatusCode": null, "LogEventText": null, "StopRuleProcessing": false, "SenderNotificationType": null, "GenerateIncidentReport": null, "IncidentReportContent": null, "RouteMessageOutboundConnector": null, "RouteMessageOutboundRequireTls": false, "ApplyOME": false, "RemoveOME": false, "RemoveOMEv2": false, "RemoveRMSAttachmentEncryption": false, "GenerateNotification": null, "Identity": "Sender is located outside the organization prepend '[External]'", "DistinguishedName": "CN=Sender is located outside the organization prepend '[External]',CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", "ImmutableId": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "Sender is located outside the organization prepend '[External]'", "IsValid": true, "WhenChanged": "/Date(1675365355000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" }, { "Priority": 1, "DlpPolicy": null, "DlpPolicyId": "00000000-0000-0000-0000-000000000000", "Comments": null, "CreatedBy": "Addam Schroll", "LastModifiedBy": "Addam Schroll", "ManuallyModified": false, "ActivationDate": null, "ExpiryDate": null, "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", "RuleVersion": { "Major": 14, "Minor": 0, "Build": 0, "Revision": 0, "MajorRevision": 0, "MinorRevision": 0 }, "Size": 327, "Conditions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" ], "Exceptions": null, "Actions": [ "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" ], "State": "Enabled", "Mode": "Enforce", "IsRuleConfigurationSupported": true, "RuleConfigurationUnsupportedReason": "", "RuleErrorAction": "Ignore", "SenderAddressLocation": "Header", "RecipientAddressType": "Resolved", "RuleSubType": "None", "RegexSize": 0, "UseLegacyRegex": false, "From": null, "FromMemberOf": null, "FromScope": "NotInOrganization", "SentTo": null, "SentToMemberOf": null, "SentToScope": null, "BetweenMemberOf1": null, "BetweenMemberOf2": null, "ManagerAddresses": null, "ManagerForEvaluatedUser": null, "SenderManagementRelationship": null, "ADComparisonAttribute": null, "ADComparisonOperator": null, "SenderADAttributeContainsWords": null, "SenderADAttributeMatchesPatterns": null, "RecipientADAttributeContainsWords": null, "RecipientADAttributeMatchesPatterns": null, "AnyOfToHeader": null, "AnyOfToHeaderMemberOf": null, "AnyOfCcHeader": null, "AnyOfCcHeaderMemberOf": null, "AnyOfToCcHeader": null, "AnyOfToCcHeaderMemberOf": null, "HasClassification": null, "HasNoClassification": false, "SubjectContainsWords": null, "SubjectOrBodyContainsWords": null, "HeaderContainsMessageHeader": null, "HeaderContainsWords": null, "FromAddressContainsWords": null, "SenderDomainIs": null, "RecipientDomainIs": null, "SubjectMatchesPatterns": null, "SubjectOrBodyMatchesPatterns": null, "HeaderMatchesMessageHeader": null, "HeaderMatchesPatterns": null, "FromAddressMatchesPatterns": null, "AttachmentNameMatchesPatterns": null, "AttachmentExtensionMatchesWords": null, "AttachmentPropertyContainsWords": null, "ContentCharacterSetContainsWords": null, "HasSenderOverride": false, "MessageContainsDataClassifications": null, "MessageContainsAllDataClassifications": null, "SenderIpRanges": null, "SCLOver": null, "AttachmentSizeOver": null, "MessageSizeOver": null, "WithImportance": null, "MessageTypeMatches": null, "RecipientAddressContainsWords": null, "RecipientAddressMatchesPatterns": null, "SenderInRecipientList": null, "RecipientInSenderList": null, "AttachmentContainsWords": null, "AttachmentMatchesPatterns": null, "AttachmentIsUnsupported": false, "AttachmentProcessingLimitExceeded": false, "AttachmentHasExecutableContent": false, "AttachmentIsPasswordProtected": false, "AnyOfRecipientAddressContainsWords": null, "AnyOfRecipientAddressMatchesPatterns": null, "ExceptIfFrom": null, "ExceptIfFromMemberOf": null, "ExceptIfFromScope": null, "ExceptIfSentTo": null, "ExceptIfSentToMemberOf": null, "ExceptIfSentToScope": null, "ExceptIfBetweenMemberOf1": null, "ExceptIfBetweenMemberOf2": null, "ExceptIfManagerAddresses": null, "ExceptIfManagerForEvaluatedUser": null, "ExceptIfSenderManagementRelationship": null, "ExceptIfADComparisonAttribute": null, "ExceptIfADComparisonOperator": null, "ExceptIfSenderADAttributeContainsWords": null, "ExceptIfSenderADAttributeMatchesPatterns": null, "ExceptIfRecipientADAttributeContainsWords": null, "ExceptIfRecipientADAttributeMatchesPatterns": null, "ExceptIfAnyOfToHeader": null, "ExceptIfAnyOfToHeaderMemberOf": null, "ExceptIfAnyOfCcHeader": null, "ExceptIfAnyOfCcHeaderMemberOf": null, "ExceptIfAnyOfToCcHeader": null, "ExceptIfAnyOfToCcHeaderMemberOf": null, "ExceptIfHasClassification": null, "ExceptIfHasNoClassification": false, "ExceptIfSubjectContainsWords": null, "ExceptIfSubjectOrBodyContainsWords": null, "ExceptIfHeaderContainsMessageHeader": null, "ExceptIfHeaderContainsWords": null, "ExceptIfFromAddressContainsWords": null, "ExceptIfSenderDomainIs": null, "ExceptIfRecipientDomainIs": null, "ExceptIfSubjectMatchesPatterns": null, "ExceptIfSubjectOrBodyMatchesPatterns": null, "ExceptIfHeaderMatchesMessageHeader": null, "ExceptIfHeaderMatchesPatterns": null, "ExceptIfFromAddressMatchesPatterns": null, "ExceptIfAttachmentNameMatchesPatterns": null, "ExceptIfAttachmentExtensionMatchesWords": null, "ExceptIfAttachmentPropertyContainsWords": null, "ExceptIfContentCharacterSetContainsWords": null, "ExceptIfSCLOver": null, "ExceptIfAttachmentSizeOver": null, "ExceptIfMessageSizeOver": null, "ExceptIfWithImportance": null, "ExceptIfMessageTypeMatches": null, "ExceptIfRecipientAddressContainsWords": null, "ExceptIfRecipientAddressMatchesPatterns": null, "ExceptIfSenderInRecipientList": null, "ExceptIfRecipientInSenderList": null, "ExceptIfAttachmentContainsWords": null, "ExceptIfAttachmentMatchesPatterns": null, "ExceptIfAttachmentIsUnsupported": false, "ExceptIfAttachmentProcessingLimitExceeded": false, "ExceptIfAttachmentHasExecutableContent": false, "ExceptIfAttachmentIsPasswordProtected": false, "ExceptIfAnyOfRecipientAddressContainsWords": null, "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, "ExceptIfHasSenderOverride": false, "ExceptIfMessageContainsDataClassifications": null, "ExceptIfMessageContainsAllDataClassifications": null, "ExceptIfSenderIpRanges": null, "PrependSubject": "[External]", "SetAuditSeverity": null, "ApplyClassification": null, "ApplyHtmlDisclaimerLocation": null, "ApplyHtmlDisclaimerText": null, "ApplyHtmlDisclaimerFallbackAction": null, "ApplyRightsProtectionTemplate": null, "ApplyRightsProtectionCustomizationTemplate": null, "SetSCL": null, "SetHeaderName": null, "SetHeaderValue": null, "RemoveHeader": null, "AddToRecipients": null, "CopyTo": null, "BlindCopyTo": null, "AddManagerAsRecipientType": null, "ModerateMessageByUser": null, "ModerateMessageByManager": false, "RedirectMessageTo": null, "RejectMessageEnhancedStatusCode": null, "RejectMessageReasonText": null, "DeleteMessage": false, "Disconnect": false, "Quarantine": false, "SmtpRejectMessageRejectText": null, "SmtpRejectMessageRejectStatusCode": null, "LogEventText": null, "StopRuleProcessing": false, "SenderNotificationType": null, "GenerateIncidentReport": null, "IncidentReportContent": null, "RouteMessageOutboundConnector": null, "RouteMessageOutboundRequireTls": false, "ApplyOME": false, "RemoveOME": false, "RemoveOMEv2": false, "RemoveRMSAttachmentEncryption": false, "GenerateNotification": null, "Identity": "ALS Sender Warning", "DistinguishedName": "CN=ALS Sender Warning,CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "Guid": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", "ImmutableId": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Name": "ALS Sender Warning", "IsValid": true, "WhenChanged": "/Date(1691002182000)/", "ExchangeVersion": "0.1 (8.0.535.0)", "ObjectState": "Unchanged" } ], "conn_filter": [ { "AdminDisplayName": "", "IsDefault": true, "IPAllowList": [], "IPBlockList": [], "EnableSafeList": false, "DirectoryBasedEdgeBlockMode": "Default", "Identity": "Default", "Id": "Default", "IsValid": true, "ExchangeVersion": "0.20 (15.0.0.0)", "Name": "Default", "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", "ObjectClass": ["top", "msExchHostedConnectionFilterPolicy"], "WhenChanged": "/Date(1619484593000)/", "WhenCreated": "/Date(1619484586000)/", "WhenChangedUTC": "/Date(1619484593000)/", "WhenCreatedUTC": "/Date(1619484586000)/", "ExchangeObjectId": "7021b7cf-b9fa-4280-94ff-fba468dbb0ab", "OrganizationalUnitRoot": "agency.onmicrosoft.com", "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", "Guid": "ddb99cb3-211b-47ee-bc9c-86e6c8d0e692", "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", "ObjectState": "Unchanged" } ], "org_config": [ { "Name": "agency.onmicrosoft.com", "DisplayName": "Cybersecurity and Infrastructure Security Agency", "AuditDisabled": false } ], "exo_successful_commands": [ "Get-RemoteDomain", "Get-AcceptedDomain", "Get-ScubaSpfRecords", "Get-DkimSigningConfig", "Get-ScubaDkimRecords", "Get-ScubaDmarcRecords", "Get-TransportConfig", "Get-SharingPolicy", "Get-TransportRule", "Get-HostedConnectionFilterPolicy", "Get-OrganizationConfig" ], "exo_unsuccessful_commands": [], "tenant_id": "3c19c757-3b55-411f-b03f-2bcc514a598d", "environment_creation": [ { "walkMeOptOut": false, "disableNPSCommentsReachout": false, "disableNewsletterSendout": false, "disableEnvironmentCreationByNonAdminUsers": true, "disablePortalsCreationByNonAdminUsers": true, "disableSurveyFeedback": false, "disableTrialEnvironmentCreationByNonAdminUsers": true, "disableCapacityAllocationByEnvironmentAdmins": false, "disableSupportTicketsVisibleByAllUsers": false, "powerPlatform": { "search": "@{disableDocsSearch=True; disableCommunitySearch=False; disableBingVideoSearch=False}", "teamsIntegration": "@{shareWithColleaguesUserLimit=10000}", "powerApps": "@{disableShareWithEveryone=False; enableGuestsToMake=False; disableMembersIndicator=False; disableMakerMatch=False; disableUnusedLicenseAssignment=False; disableCreateFromImage=False; disableCreateFromFigma=False}", "powerAutomate": "@{disableCopilot=False}", "environments": "@{disablePreferredDataLocationForTeamsEnvironment=False}", "governance": "@{disableAdminDigest=False; disableDeveloperEnvironmentCreationByNonAdminUsers=False; enableDefaultEnvironmentRouting=False; policy=}", "licensing": "@{disableBillingPolicyCreationByNonAdminUsers=False; enableTenantCapacityReportForEnvironmentAdmins=False; storageCapacityConsumptionWarningThreshold=85; enableTenantLicensingReportForEnvironmentAdmins=False}", "powerPages": "", "champions": "@{disableChampionsInvitationReachout=False; disableSkillsMatchInvitationReachout=False}", "intelligence": "@{disableCopilot=False; enableOpenAiBotPublishing=True}", "modelExperimentation": "@{enableModelDataSharing=False; disableDataLogging=False}", "catalogSettings": "@{powerCatalogAudienceSetting=All}" } } ], "dlp_policies": [ { "value": [ { "name": "981a935c-8c66-4d97-a1f6-b3c314ee07ef", "displayName": "DefaultEnvironmentPolicy", "defaultConnectorsClassification": "General", "connectorGroups": [ { "classification": "Confidential", "connectors": [ { "id": "/providers/Microsoft.PowerApps/apis/shared_sharepointonline", "name": "SharePoint", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_onedriveforbusiness", "name": "OneDrive for Business", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_approvals", "name": "Approvals", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_arcgis", "name": "ArcGIS", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_arcgispaas", "name": "ArcGIS PaaS", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_commondataservice", "name": "Microsoft Dataverse (legacy)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps", "name": "Microsoft Dataverse", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_excelonlinebusiness", "name": "Excel Online (Business)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftformspro", "name": "Dynamics 365 Customer Voice", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_office365", "name": "Office 365 Outlook", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_office365groups", "name": "Office 365 Groups", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_office365users", "name": "Office 365 Users", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_onenote", "name": "OneNote (Business)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_planner", "name": "Planner", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotification", "name": "Power Apps Notification", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerbi", "name": "Power BI", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_shifts", "name": "Shifts for Microsoft Teams", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_teams", "name": "Microsoft Teams", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_todo", "name": "Microsoft To-Do (Business)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_yammer", "name": "Yammer", "type": "Microsoft.PowerApps/apis" } ] }, { "classification": "General", "connectors": [] }, { "classification": "Blocked", "connectors": [ { "id": "/providers/Microsoft.PowerApps/apis/shared_salesforce", "name": "Salesforce", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_onedrive", "name": "OneDrive", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sql", "name": "SQL Server", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_dropbox", "name": "Dropbox", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_aci", "name": "Azure Container Instance", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_adobepdftools", "name": "Adobe PDF Services", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_adobesign", "name": "Adobe Sign", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_applicationinsights", "name": "Azure Application Insights", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_arm", "name": "Azure Resource Manager", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_asiteusgov", "name": "Asite (US Gov.)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_avepointcloudgovernance", "name": "AvePoint Cloud Governance", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azuread", "name": "Azure AD", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureappservice", "name": "Azure App Service", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureautomation", "name": "Azure Automation", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureblob", "name": "Azure Blob Storage", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azuredatafactory", "name": "Azure Data Factory", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgrid", "name": "Azure Event Grid", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgridpublish", "name": "Azure Event Grid Publish", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azurefile", "name": "Azure File Storage", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azureloganalyticsdatacollector", "name": "Azure Log Analytics Data Collector", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azurequeues", "name": "Azure Queues", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azuretables", "name": "Azure Table Storage", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_azurevm", "name": "Azure VM", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_bingmaps", "name": "Bing Maps", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_bingsearch", "name": "Bing Search", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_bitly", "name": "Bitly", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_bizzy", "name": "AtBot Logic", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_blockchaincorda", "name": "Corda Blockchain", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_blockchainethereum", "name": "Ethereum Blockchain", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_box", "name": "Box", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_civicplustransform", "name": "CivicPlus Transform", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cloudappsecurity", "name": "Defender for Cloud Apps", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cloudmersive", "name": "Cloudmersive Virus Scan", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescomputervision", "name": "Computer Vision API", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescontentmoderator", "name": "Content Moderator", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescustomvision", "name": "Custom Vision", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicesqnamaker", "name": "QnA Maker", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicestextanalytics", "name": "Azure Cognitive Service for Language", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_cognitoforms", "name": "Cognito Forms", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_customerinsights", "name": "Dynamics 365 Customer Insights", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_dataflows", "name": "Power Query Dataflows", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_db2", "name": "DB2", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_documentdb", "name": "Azure Cosmos DB", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_docusign", "name": "DocuSign", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_docusigndemo", "name": "DocuSign Demo", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicsax", "name": "Fin u0026 Ops Apps (Dynamics 365)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbonprem", "name": "Business Central (on-premises)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbsaas", "name": "Business Central", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_easyvista", "name": "EasyVista Service Manager", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_encodiandocumentmanager", "name": "Encodian", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_eventhubs", "name": "Event Hubs", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_excel", "name": "Excel", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_excelonline", "name": "Excel Online (OneDrive)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_faceapi", "name": "Face API", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_facebook", "name": "Facebook", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_filesystem", "name": "File System", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_flowmanagement", "name": "Power Automate Management", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_formstackforms", "name": "Formstack Forms", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_freshdesk", "name": "Freshdesk", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_ftp", "name": "FTP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_github", "name": "GitHub", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_gmail", "name": "Gmail", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_googlecalendar", "name": "Google Calendar", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_googledrive", "name": "Google Drive", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_googlesheet", "name": "Google Sheets", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_googletasks", "name": "Google Tasks", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_instagram", "name": "Instagram", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_instapaper", "name": "Instapaper", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_jira", "name": "JIRA", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_jotform", "name": "JotForm", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_jotformenterprise", "name": "JotForm Enterprise", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_keyvault", "name": "Azure Key Vault", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_kusto", "name": "Azure Data Explorer", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_linkedinv2", "name": "LinkedIn V2", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_lms365", "name": "LMS365", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_luis", "name": "LUIS", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_m365messagecenter", "name": "Microsoft 365 message center", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_mailchimp", "name": "MailChimp", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsoft365compliance", "name": "Microsoft 365 compliance", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftflowforadmins", "name": "Power Automate for Admins", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftforms", "name": "Microsoft Forms", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftgraphsecurity", "name": "Microsoft Graph Security", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_microsofttranslator", "name": "Microsoft Translator", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_msnweather", "name": "MSN Weather", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_muhimbi", "name": "Muhimbi PDF", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_mysql", "name": "MySQL", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_office365groupsmail", "name": "Office 365 Groups Mail", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_oracle", "name": "Oracle Database", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_outlook", "name": "Outlook.com", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_outlooktasks", "name": "Outlook Tasks", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_pagerduty", "name": "PagerDuty", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_plumsail", "name": "Plumsail Documents", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailforms", "name": "Plumsail Forms", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailhelpdesk", "name": "Plumsail HelpDesk", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailsp", "name": "Plumsail SP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_postgresql", "name": "PostgreSQL", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforadmins", "name": "Power Apps for Admins", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforappmakers", "name": "Power Apps for Makers", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotificationv2", "name": "Power Apps Notification V2", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powerplatformforadmins", "name": "Power Platform for Admins", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_powervirtualagents", "name": "Power Virtual Agents", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_projectonline", "name": "Project Online", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_projectroadmap", "name": "Project Roadmap", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_rss", "name": "RSS", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_saperp", "name": "SAP ERP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sendgrid", "name": "SendGrid", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sendmail", "name": "Mail", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_servicebus", "name": "Service Bus", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_service-now", "name": "ServiceNow", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sftp", "name": "SFTP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sftpwithssh", "name": "SFTP - SSH", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_slack", "name": "Slack", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_smartsheet", "name": "Smartsheet", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_smtp", "name": "SMTP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_sqldw", "name": "Azure SQL Data Warehouse", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_survey123", "name": "Survey123", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_surveymonkey", "name": "SurveyMonkey", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_teradata", "name": "Teradata", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_translatorv2", "name": "Microsoft Translator V2", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_trello", "name": "Trello", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_twilio", "name": "Twilio", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_twitter", "name": "Twitter", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_typeform", "name": "Typeform", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_uiflow", "name": "Desktop flows", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_videoindexer-v2", "name": "Video Indexer (V2)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_visualstudioteamservices", "name": "Azure DevOps", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_wdatp", "name": "Microsoft Defender ATP", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_webcontents", "name": "HTTP with Azure AD", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_webmerge", "name": "Formstack Documents", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_wordonlinebusiness", "name": "Word Online (Business)", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_wordpress", "name": "WordPress", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_youtube", "name": "YouTube", "type": "Microsoft.PowerApps/apis" }, { "id": "/providers/Microsoft.PowerApps/apis/shared_zendesk", "name": "Zendesk", "type": "Microsoft.PowerApps/apis" }, { "id": "Http", "name": "HTTP", "type": "Microsoft.PowerApps/apis" }, { "id": "HttpRequestReceived", "name": "When a HTTP request is received", "type": "Microsoft.PowerApps/apis" }, { "id": "HttpWebhook", "name": "HTTP Webhook", "type": "Microsoft.PowerApps/apis" } ] } ], "environmentType": "OnlyEnvironments", "environments": [ { "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", "type": "Microsoft.BusinessAppPlatform/scopes/environments" } ], "createdBy": { "displayName": "David Bui - CTR" }, "createdTime": "2022-05-09T22:15:45.3391351Z", "lastModifiedBy": { "displayName": "David Bui - CTR" }, "lastModifiedTime": "2022-05-31T17:03:57.6942145Z", "etag": "cf928b78-e411-4341-96df-9a6570fc52eb", "isLegacySchemaVersion": false } ] } ], "tenant_isolation": [ { "properties": { "tenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", "isDisabled": true, "allowedTenants": "" } } ], "environment_list": [ { "EnvironmentName": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", "DisplayName": "Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc)", "Description": null, "IsDefault": true, "Location": "usgov", "CreatedTime": "2021-12-13T20:40:14.1749137Z", "CreatedBy": { "id": "SYSTEM", "displayName": "SYSTEM", "type": "NotSpecified" }, "LastModifiedTime": null, "LastModifiedBy": null, "CreationType": "DefaultTenant", "EnvironmentType": "Default", "CommonDataServiceDatabaseProvisioningState": "Succeeded", "CommonDataServiceDatabaseType": "Common Data Service for Apps", "Internal": { "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", "type": "Microsoft.BusinessAppPlatform/scopes/environments", "location": "usgov", "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", "properties": "@{tenantId=3c19c757-3b55-411f-b03f-2bcc514a598d; azureRegionHint=usgovtexas; displayName=Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc); createdTime=2021-12-13T20:40:14.1749137Z; createdBy=; provisioningState=Succeeded; creationType=DefaultTenant; environmentSku=Default; environmentType=Production; isDefault=True; permissions=; runtimeEndpoints=; linkedEnvironmentMetadata=; trialScenarioType=None; retentionPeriod=P7D; states=; updateCadence=; retentionDetails=; protectionStatus=; cluster=; connectedGroups=System.Object[]; lifecycleOperationsEnforcement=; governanceConfiguration=}" }, "InternalCds": null, "OrganizationId": "ff4adc41-8f11-42a1-9e5a-d208f91a6db4", "RetentionPeriod": 7 } ], "powerplatform_successful_commands": [ "Get-TenantDetailsFromGraph", "Get-TenantSettings", "Get-AdminPowerAppEnvironment", "Get-DlpPolicy", "Get-PowerAppTenantIsolationPolicy" ], "powerplatform_unsuccessful_commands": [], "SPO_tenant": [ { "StorageQuota": 1355776, "StorageQuotaAllocated": 0, "ResourceQuota": 0, "ResourceQuotaAllocated": 0, "OneDriveStorageQuota": 1048576, "CompatibilityRange": "15,15", "ExternalServicesEnabled": true, "NoAccessRedirectUrl": null, "ArchiveRedirectUrl": null, "SharingCapability": 2, "DisplayStartASiteOption": true, "StartASiteFormUrl": null, "ShowEveryoneClaim": false, "ShowAllUsersClaim": false, "OfficeClientADALDisabled": false, "LegacyAuthProtocolsEnabled": false, "DisableCustomAppAuthentication": true, "SiteOwnerManageLegacyServicePrincipalEnabled": true, "ShowEveryoneExceptExternalUsersClaim": true, "AllowEveryoneExceptExternalUsersClaimInPrivateSite": true, "SearchResolveExactEmailOrUPN": false, "RequireAcceptingAccountMatchInvitedAccount": true, "ProvisionSharedWithEveryoneFolder": false, "SignInAccelerationDomain": "", "EnableGuestSignInAcceleration": false, "UsePersistentCookiesForExplorerView": false, "ContentTypeSyncSiteTemplatesList": [], "BccExternalSharingInvitations": false, "BccExternalSharingInvitationsList": null, "UserVoiceForFeedbackEnabled": true, "PublicCdnEnabled": false, "PublicCdnAllowedFileTypes": "CSS,EOT,GIF,ICO,JPEG,JPG,JS,MAP,PNG,SVG,TTF,WOFF", "PublicCdnOrigins": [], "RequireAnonymousLinksExpireInDays": -1, "SharingAllowedDomainList": "agency.onmicrosoft.com yahoo.com", "SharingBlockedDomainList": null, "SharingDomainRestrictionMode": 1, "OneDriveForGuestsEnabled": false, "IPAddressEnforcement": false, "IPAddressAllowList": "", "IPAddressWACTokenLifetime": 15, "EnablePromotedFileHandlers": true, "UseFindPeopleInPeoplePicker": false, "DefaultSharingLinkType": 2, "ODBMembersCanShare": 0, "ODBAccessRequests": 0, "PreventExternalUsersFromResharing": true, "ShowPeoplePickerSuggestionsForGuestUsers": false, "FileAnonymousLinkType": 2, "FolderAnonymousLinkType": 2, "NotifyOwnersWhenItemsReshared": true, "NotifyOwnersWhenInvitationsAccepted": true, "NotificationsInOneDriveForBusinessEnabled": true, "NotificationsInSharePointEnabled": true, "SpecialCharactersStateInFileFolderNames": 1, "OwnerAnonymousNotification": true, "CommentsOnSitePagesDisabled": false, "CommentsOnFilesDisabled": false, "CommentsOnListItemsDisabled": false, "ViewersCanCommentOnMediaDisabled": false, "SocialBarOnSitePagesDisabled": false, "OrphanedPersonalSitesRetentionPeriod": 90, "PermissiveBrowserFileHandlingOverride": false, "DisallowInfectedFileDownload": false, "DefaultLinkPermission": 2, "CustomizedExternalSharingServiceUrl": "", "ConditionalAccessPolicy": 0, "AllowDownloadingNonWebViewableFiles": true, "LimitedAccessFileType": 1, "AllowEditing": true, "ApplyAppEnforcedRestrictionsToAdHocRecipients": true, "FilePickerExternalImageSearchEnabled": true, "EmailAttestationRequired": true, "EmailAttestationReAuthDays": 100, "DisabledWebPartIds": null, "EnableMinimumVersionRequirement": true, "MarkNewFilesSensitiveByDefault": 0, "EnableAIPIntegration": false, "AllowCommentsTextOnEmailEnabled": true, "ConditionalAccessPolicyErrorHelpLink": "", "EnableAzureADB2BIntegration": false, "IncludeAtAGlanceInShareEmails": true, "ExternalUserExpirationRequired": true, "ExternalUserExpireInDays": 100, "BlockDownloadLinksFileType": 1, "AnyoneLinkTrackUsers": false, "OneDriveLoopDefaultSharingLinkScope": -1, "OneDriveLoopDefaultSharingLinkRole": 0, "OneDriveRequestFilesLinkEnabled": true, "OneDriveRequestFilesLinkExpirationInDays": 1, "OneDriveSharingCapability": 2, "OneDriveDefaultShareLinkScope": -1, "OneDriveDefaultShareLinkRole": 0, "OneDriveDefaultLinkToExistingAccess": false, "OneDriveBlockGuestsAsSiteAdmin": 0, "CoreLoopDefaultSharingLinkScope": -1, "CoreLoopDefaultSharingLinkRole": 0, "CoreSharingCapability": 3, "CoreRequestFilesLinkEnabled": true, "CoreRequestFilesLinkExpirationInDays": 10, "CoreDefaultShareLinkScope": -1, "CoreDefaultShareLinkRole": 0, "CoreDefaultLinkToExistingAccess": false, "CoreBlockGuestsAsSiteAdmin": 0, "BlockAppAccessWithAuthenticationContext": false, "ContainerSharingCapability": 2, "ContainerDefaultShareLinkScope": -1, "ContainerDefaultShareLinkRole": 0, "ContainerDefaultLinkToExistingAccess": false, "ContainerLoopDefaultShareLinkScope": -1, "ContainerLoopDefaultShareLinkRole": 0, "AllowAnonymousMeetingParticipantsToAccessWhiteboards": 0, "Workflows2013State": 2, "IsFluidEnabled": true, "IsWBFluidEnabled": true, "IsCollabMeetingNotesFluidEnabled": true, "IsLoopEnabled": true, "DisableDocumentLibraryDefaultLabeling": false, "EnableSensitivityLabelForPDF": false, "BlockSendLabelMismatchEmail": false, "LabelMismatchEmailHelpLink": null, "DisableAddShortcutsToOneDrive": false, "EnableAutoNewsDigest": true, "Workflow2010Disabled": true, "StopNew2010Workflows": false, "StopNew2013Workflows": false, "DisableBackToClassic": false, "BlockUserInfoVisibility": "", "BlockUserInfoVisibilityInOneDrive": 0, "BlockUserInfoVisibilityInSharePoint": 0, "AllowOverrideForBlockUserInfoVisibility": false, "InformationBarriersSuspension": true, "IBImplicitGroupBased": false, "AppBypassInformationBarriers": false, "DefaultOneDriveInformationBarrierMode": "Explicit", "DisablePersonalListCreation": false, "DisableListSync": false, "DisabledModernListTemplateIds": [], "DisableSpacesActivation": false, "DisableVivaConnectionsAnalytics": false, "HideSyncButtonOnTeamSite": false, "AllowGuestUserShareToUsersNotInSiteCollection": false, "DisableOutlookPSTVersionTrimming": false, "EnableAutoExpirationVersionTrim": false, "ExpireVersionsAfterDays": 0, "MajorVersionLimit": 500, "StreamLaunchConfig": 0, "MediaTranscription": 0, "MediaTranscriptionAutomaticFeatures": 0, "ViewInFileExplorerEnabled": false, "AuthContextResilienceMode": 0, "ReduceTempTokenLifetimeEnabled": false, "ReduceTempTokenLifetimeValue": 15, "ShowOpenInDesktopOptionForSyncedFiles": false, "ShowPeoplePickerGroupSuggestionsForIB": false, "EnableRestrictedAccessControl": false, "BlockDownloadFileTypePolicy": false, "BlockDownloadFileTypeIds": [], "ExcludedBlockDownloadGroupIds": [], "TlsTokenBindingPolicyValue": 0, "LegacyBrowserAuthProtocolsEnabled": true, "RecycleBinRetentionPeriod": 93, "IsEnableAppAuthPopUpEnabled": false, "MassDeleteNotificationDisabled": false } ], "SPO_site": [ { "LastContentModifiedDate": "/Date(1692410434457)/", "Status": "Active", "ArchiveStatus": null, "ResourceUsageCurrent": 0, "ResourceUsageAverage": 0, "StorageUsageCurrent": 1, "LockIssue": null, "WebsCount": 1, "CompatibilityLevel": 15, "DisableSharingForNonOwnersStatus": null, "HubSiteId": "00000000-0000-0000-0000-000000000000", "IsHubSite": false, "RelatedGroupId": "00000000-0000-0000-0000-000000000000", "GroupId": "00000000-0000-0000-0000-000000000000", "Url": "https://agency.sharepoint.com/", "LocaleId": 1033, "LockState": "Unlock", "Owner": "c64580cf-5b99-4c0a-b15b-db035c63e177", "StorageQuota": 26214400, "StorageQuotaWarningLevel": 25574400, "ResourceQuota": 300, "ResourceQuotaWarningLevel": 255, "Template": "SITEPAGEPUBLISHING#0", "Title": "Communication site", "AllowSelfServiceUpgrade": true, "DenyAddAndCustomizePages": 2, "PWAEnabled": 1, "SharingCapability": 3, "SiteDefinedSharingCapability": 2, "SandboxedCodeActivationCapability": 2, "DisableCompanyWideSharingLinks": 2, "DisableAppViews": 2, "DisableFlows": 2, "AuthenticationContextName": null, "StorageQuotaType": null, "RestrictedToGeo": 3, "ShowPeoplePickerSuggestionsForGuestUsers": false, "SharingDomainRestrictionMode": 0, "SharingAllowedDomainList": "", "SharingBlockedDomainList": "", "ConditionalAccessPolicy": 0, "AllowDownloadingNonWebViewableFiles": false, "LimitedAccessFileType": 1, "AllowEditing": true, "SensitivityLabel": null, "CommentsOnSitePagesDisabled": false, "SocialBarOnSitePagesDisabled": false, "DefaultSharingLinkType": 0, "DefaultLinkPermission": 0, "DefaultLinkToExistingAccess": false, "AnonymousLinkExpirationInDays": 30, "OverrideTenantAnonymousLinkExpirationPolicy": true, "ExternalUserExpirationInDays": 0, "OverrideTenantExternalUserExpirationPolicy": false, "SharingLockDownEnabled": false, "SharingLockDownCanBeCleared": true, "InformationSegment": [], "InformationBarriersMode": "", "BlockDownloadLinksFileType": 1, "OverrideBlockUserInfoVisibility": 0, "IsTeamsConnected": false, "IsTeamsChannelConnected": false, "TeamsChannelType": 0, "MediaTranscription": 0, "ExcludedBlockDownloadGroupIds": [], "ExcludeBlockDownloadPolicySiteOwners": false, "ReadOnlyForBlockDownloadPolicy": false, "ExcludeBlockDownloadSharePointGroups": null, "BlockDownloadPolicy": false, "LoopDefaultSharingLinkScope": -1, "LoopDefaultSharingLinkRole": 0, "RequestFilesLinkEnabled": true, "RequestFilesLinkExpirationInDays": 10, "OverrideSharingCapability": false, "DefaultShareLinkScope": -1, "DefaultShareLinkRole": 0, "BlockGuestsAsSiteAdmin": 0, "ReadOnlyForUnmanagedDevices": false, "RestrictedAccessControl": false, "AuthenticationContextLimitedAccess": false, "RestrictedAccessControlGroups": [], "ListsShowHeaderAndNavigation": false } ], "OneDrive_PnP_Flag": false, "SharePoint_successful_commands": [ "Get-MgBetaOrganization", "Get-SPOTenant", "Get-SPOSite", "Get-PnPTenant", "Get-PnPTenantSite" ], "SharePoint_unsuccessful_commands": [], "teams_tenant_info": [ { "AnnouncementsDisabled": null, "AssignedPlan": ["MCOEV", "Teams_GCC", "MCOProfessional", "MCOMEETADD"], "City": "Washington", "CompanyPartnership": [ "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.CompanyPartnership" ], "CompanyTags": [ "servicescope.microsoft.com/ServiceScope=GCC", "o365.microsoft.com/startdate=637492760673881089", "o365.microsoft.com/version=15" ], "Country": null, "CountryAbbreviation": "US", "DefaultPoolFqdn": null, "DirSyncEnabled": true, "DisplayName": "Cybersecurity and Infrastructure Security Agency", "LastSyncTimeStamp": "/Date(1692396091546)/", "NameRecordingDisabled": null, "Pools": null, "PostalCode": "20528-0380", "PreferredLanguage": "en", "ProvisionedPlan": [ "exchange", "RMSOnline", "RMSOnline", "RMSOnline", "exchange", "Adallom", "RMSOnline", "RMSOnline", "exchange", "exchange", "exchange", "exchange", "SCO", "SharePoint", "SharePoint", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "exchange", "MicrosoftCommunicationsOnline", "MicrosoftCommunicationsOnline", "MicrosoftCommunicationsOnline", "ProjectWorkManagement", "Adallom", "RMSOnline", "SCO" ], "ServiceInfo": "[{}]", "ServiceInstance": "MicrosoftCommunicationsOnline/GOV-1B-G6", "ServiceNumberCount": null, "SipDomain": [ "agency.onmicrosoft.com", "dhs.agency.gov", "test365.agency.dhs.gov" ], "StateOrProvince": "DC", "Street": "245 Murray Lane", "SubscriberNumberCount": null, "SyncInLyncAdInfo": { "IsSyncDisabledAtTenantCreation": null, "IsUserSyncDisabled": true, "IsUserSyncStateChanging": null, "StopSyncRevertCompleteTimestamp": null, "StopSyncRevertTimestamp": null, "StopSyncTimestamp": "/Date(1675422759251)/" }, "TeamsUpgradeEffectiveMode": "TeamsOnly", "TeamsUpgradeNotificationsEnabled": false, "TeamsUpgradeOverridePolicy": "ProvisionedAsTeams", "TeamsUpgradePolicyIsReadOnly": "ModeAndNotifications", "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", "TnmAccountId": null, "VerifiedDomains": [ "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain" ], "WhenChanged": "/Date(1692188532143)/", "WhenCreated": "/Date(-62135596800000)/", "LastProvisionTimeStamps": { "TenantSipDomains": "2023-08-16T12:21:39.4275558+00:00", "TenantRegistrarPool": "2023-08-16T12:21:39.5213122+00:00", "ConfigDistributionStatus": "2023-08-16T12:22:12.1434748+00:00" }, "LastPublishTimeStamps": { "ProvisionedPlanPublishAuthoredProps": "2023-08-16T12:21:47.569208+00:00", "ProvisionCpcTenantConfigProcessor": "2023-08-16T12:21:44.5681938+00:00", "PublishProvisionedPlanProcessor": "2022-10-20T21:16:44.2365367+00:00", "UpdateBvdTenantProcessor": "2023-08-16T12:21:45.0863487+00:00" } } ], "meeting_policies": [ { "Identity": "Global", "Description": null, "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "DisabledUserOverride", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInCompanyExcludingGuests", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:Custom Policy 1", "Description": "Used to test multiple Teams policy baselines", "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "DisabledUserOverride", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": false, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInSameAndFederatedCompany", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": true, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:NKK-Temp", "Description": null, "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "DisabledUserOverride", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": "", "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "Everyone", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": true, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": "", "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:AllOn", "Description": "Do not assign. This policy is same as global defaults and would be deprecated", "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "DisabledUserOverride", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:RestrictedAnonymousAccess", "Description": "Do not assign. This policy is same as global defaults and would be deprecated", "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "Disabled", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:AllOff", "Description": null, "AllowChannelMeetingScheduling": false, "AllowMeetNow": false, "AllowPrivateMeetNow": false, "MeetingChatEnabledType": "Disabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "Disabled", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": false, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": false, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": false, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": false, "AllowPowerPointSharing": false, "AllowParticipantGiveRequestControl": false, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": false, "AllowWhiteboard": false, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "Disabled", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:RestrictedAnonymousNoRecording", "Description": "Do not assign. This policy is similar to global defaults and would be deprecated", "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "Disabled", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": false, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:Default", "Description": null, "AllowChannelMeetingScheduling": true, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "DisabledUserOverride", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": true, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": true, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": true, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" }, { "Identity": "Tag:Kiosk", "Description": null, "AllowChannelMeetingScheduling": false, "AllowMeetNow": true, "AllowPrivateMeetNow": true, "MeetingChatEnabledType": "Enabled", "AllowExternalNonTrustedMeetingChat": true, "LiveCaptionsEnabledType": "Disabled", "DesignatedPresenterRoleMode": "EveryoneUserOverride", "AllowIPAudio": true, "AllowIPVideo": true, "AllowEngagementReport": "Enabled", "AllowTrackingInReport": "EnabledUserOverride", "IPAudioMode": "EnabledOutgoingIncoming", "IPVideoMode": "EnabledOutgoingIncoming", "AllowAnonymousUsersToDialOut": false, "AllowAnonymousUsersToStartMeeting": false, "AllowAnonymousUsersToJoinMeeting": true, "BlockedAnonymousJoinClientTypes": null, "AllowedStreamingMediaInput": null, "ExplicitRecordingConsent": "Disabled", "AllowLocalRecording": false, "AllowPrivateMeetingScheduling": false, "AutoAdmittedUsers": "EveryoneInCompany", "AllowCloudRecording": false, "AllowRecordingStorageOutsideRegion": false, "RecordingStorageMode": "OneDriveForBusiness", "AllowOutlookAddIn": false, "AllowPowerPointSharing": true, "AllowParticipantGiveRequestControl": true, "AllowExternalParticipantGiveRequestControl": false, "AllowSharedNotes": true, "AllowWhiteboard": true, "AllowTranscription": false, "AllowNetworkConfigurationSettingsLookup": false, "MediaBitRateKb": 50000, "ScreenSharingMode": "EntireScreen", "VideoFiltersMode": "AllFilters", "AllowPSTNUsersToBypassLobby": false, "AllowOrganizersToOverrideLobbySettings": false, "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", "AllowNDIStreaming": false, "AllowUserToJoinExternalMeeting": "Disabled", "SpeakerAttributionMode": "EnabledUserOverride", "EnrollUserOverride": "Disabled", "RoomAttributeUserOverride": "Off", "StreamingAttendeeMode": "Disabled", "AttendeeIdentityMasking": "DisabledUserOverride", "AllowBreakoutRooms": true, "TeamsCameraFarEndPTZMode": "Disabled", "AllowMeetingReactions": true, "AllowMeetingRegistration": true, "WhoCanRegister": "Everyone", "AllowScreenContentDigitization": "Enabled", "AllowCarbonSummary": true, "RoomPeopleNameUserOverride": "Off", "AllowMeetingCoach": true, "NewMeetingRecordingExpirationDays": 120, "LiveStreamingMode": "Disabled", "MeetingInviteLanguages": null, "ChannelRecordingDownload": "Allow", "AllowCartCaptionsScheduling": "DisabledUserOverride", "AllowTasksFromTranscript": "Enabled", "InfoShownInReportMode": "FullInformation", "LiveInterpretationEnabledType": "DisabledUserOverride", "QnAEngagementMode": "Enabled", "AllowImmersiveView": true, "AllowAvatarsInGallery": true, "AllowAnnotations": true, "AllowDocumentCollaboration": "Enabled", "AllowWatermarkForScreenSharing": false, "AllowWatermarkForCameraVideo": false, "AllowWatermarkCustomizationForCameraVideo": true, "WatermarkForCameraVideoOpacity": 30, "WatermarkForCameraVideoPattern": "Tiled", "AllowWatermarkCustomizationForScreenSharing": true, "WatermarkForScreenSharingOpacity": 30, "WatermarkForScreenSharingPattern": "Tiled", "AudibleRecordingNotification": "PstnOnly", "ConnectToMeetingControls": "Enabled" } ], "federation_configuration": [ { "AllowedDomains": { "AllowedDomain": "Domain=mitre.org" }, "BlockedDomains": [], "AllowFederatedUsers": true, "AllowPublicUsers": false, "AllowTeamsSms": true, "AllowTeamsConsumer": false, "AllowTeamsConsumerInbound": true, "TreatDiscoveredPartnersAsUnverified": false, "SharedSipAddressSpace": false, "RestrictTeamsConsumerToExternalUserProfiles": false, "DataSource": null, "Key": { "ScopeClass": "Global", "SchemaId": "XName=", "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" }, "Identity": "Global" } ], "client_configuration": [ { "AllowEmailIntoChannel": true, "RestrictedSenderList": null, "AllowDropBox": true, "AllowBox": true, "AllowGoogleDrive": true, "AllowShareFile": true, "AllowEgnyte": true, "AllowOrganizationTab": true, "AllowSkypeBusinessInterop": true, "ContentPin": "RequiredOutsideScheduleMeeting", "AllowResourceAccountSendMessage": true, "ResourceAccountContentAccess": "NoAccess", "AllowGuestUser": true, "AllowScopedPeopleSearchandAccess": false, "AllowRoleBasedChatPermissions": false, "DataSource": null, "Key": { "ScopeClass": "Global", "SchemaId": "XName=", "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" }, "Identity": "Global" } ], "app_policies": [ { "Identity": "Global", "DefaultCatalogApps": [], "GlobalCatalogApps": [], "PrivateCatalogApps": [], "Description": null, "DefaultCatalogAppsType": "AllowedAppList", "GlobalCatalogAppsType": "BlockedAppList", "PrivateCatalogAppsType": "AllowedAppList" } ], "broadcast_policies": [ { "Description": null, "AllowBroadcastScheduling": true, "AllowBroadcastTranscription": false, "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", "BroadcastRecordingMode": "UserOverride", "DataSource": null, "Key": { "ScopeClass": "Global", "SchemaId": "XName=", "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" }, "Identity": "Global" }, { "Description": null, "AllowBroadcastScheduling": true, "AllowBroadcastTranscription": false, "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", "BroadcastRecordingMode": "AlwaysEnabled", "DataSource": "Memory", "Key": { "ScopeClass": "Tag", "SchemaId": "XName=", "AuthorityId": "Class=Host;InstanceId=00000000-0000-0000-0000-000000000000;XmlRoot=", "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" }, "Identity": "Tag:Default" } ], "license_information": [ { "SkuId": "f30db892-07e9-47e9-837c-80727f46fd3d", "SkuPartNumber": "FLOW_FREE", "ConsumedUnits": 3, "PrepaidUnits": { "Enabled": 10000, "LockedOut": 0, "Suspended": 0, "Warning": 0 } }, { "SkuId": "c42b9cae-ea4f-4ab7-9717-81576235ccac", "SkuPartNumber": "DEVELOPERPACK_E5", "ConsumedUnits": 22, "PrepaidUnits": { "Enabled": 25, "LockedOut": 0, "Suspended": 0, "Warning": 0 } } ], "total_user_count": 51, "teams_successful_commands": [ "Get-CsTenant", "Get-CsTeamsMeetingPolicy", "Get-CsTenantFederationConfiguration", "Get-CsTeamsClientConfiguration", "Get-CsTeamsAppPermissionPolicy", "Get-CsTeamsMeetingBroadcastPolicy" ], "teams_unsuccessful_commands": [] } |