Keep the connection filter IP allow list empty and the safe list off

Description

The default connection filter policy has:

• an empty Always allow messages from the following IP addresses or address range list (IPAllowList);
• Turn on safe list cleared (EnableSafeList $false).

Mail from trusted systems is handled with an inbound connector (CB-M365-MAIL-036), Enhanced Filtering (CB-M365-MAIL-018) or the advanced delivery policy, not by skipping filtering.

Rationale

Allowed IP addresses skip spam filtering, and shared hosting or cloud ranges added for one partner let any customer of that provider in. The safe list is a third-party list of senders Microsoft does not control for the tenant. Both create blind spots that attackers using the same infrastructure can exploit.

Impact

Messages from formerly allowed IP addresses go through normal filtering and some may be marked as spam until the sender fixes its authentication or a narrower exception is set up.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-spam > Connection filter policy (Default).
3. Check that Always allow messages from the following IP addresses or address range is empty and Turn on safe list is cleared.
4. In Exchange Online PowerShell (read-only):

   Get-HostedConnectionFilterPolicy | Format-List Name, IPAllowList, EnableSafeList
   

5. Fail if IPAllowList holds any entry or EnableSafeList is True.

Remediation

1. For each allowed IP address, find out which sender it serves and set up a proper path (connector, Enhanced Filtering, Tenant Allow/Block List entry for the sender).
2. In the Defender portal, edit Connection filter policy (Default) (Security Administrator), remove the IP addresses, clear Turn on safe list and save.
3. PowerShell equivalent:

   Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList $null -EnableSafeList $false
   

Rollback

Re-add the IP address (-IPAllowList @{Add="192.0.2.10"}) while the proper path is set up.

References

• Configure connection filtering Microsoft, vendor-doc, accessed 2026-10-24
• Set-HostedConnectionFilterPolicy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-114) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-002 Do not bypass spam filtering for sender domains in mail flow rules
• related CB-M365-MAIL-030 Apply the recommended inbound anti-spam actions with no allowed senders or domains

People and lifecycle