{
  "id": "CB-M365-MAIL-032",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-032",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-032.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-032.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-032",
    "title": "Keep the connection filter IP allow list empty and the safe list off",
    "finding": {
      "title": "The connection filter lets mail from listed IP addresses or Microsoft's safe list skip spam filtering",
      "description": "Messages from these sources bypass spam filtering and part of spoof detection, whatever they contain."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online-protection",
      "connection-filter",
      "allow-list",
      "spoofing"
    ],
    "description": "The default connection filter policy has:\n\n- an empty **Always allow messages from the following IP addresses or address range** list\n  (`IPAllowList`);\n- **Turn on safe list** cleared (`EnableSafeList $false`).\n\nMail from trusted systems is handled with an inbound connector (CB-M365-MAIL-036), Enhanced\nFiltering (CB-M365-MAIL-018) or the advanced delivery policy, not by skipping filtering.\n",
    "rationale": "Allowed IP addresses skip spam filtering, and shared hosting or cloud ranges added for one\npartner let any customer of that provider in. The safe list is a third-party list of senders\nMicrosoft does not control for the tenant. Both create blind spots that attackers using the same\ninfrastructure can exploit.\n",
    "impact": "Messages from formerly allowed IP addresses go through normal filtering and some may be marked as\nspam until the sender fixes its authentication or a narrower exception is set up.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Email & collaboration** > **Policies & rules** > **Threat policies** >\n   **Anti-spam** > **Connection filter policy (Default)**.\n3. Check that **Always allow messages from the following IP addresses or address range** is empty\n   and **Turn on safe list** is cleared.\n4. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-HostedConnectionFilterPolicy | Format-List Name, IPAllowList, EnableSafeList\n   ```\n5. Fail if `IPAllowList` holds any entry or `EnableSafeList` is `True`.\n"
    },
    "remediation": {
      "manual": "1. For each allowed IP address, find out which sender it serves and set up a proper path\n   (connector, Enhanced Filtering, Tenant Allow/Block List entry for the sender).\n2. In the Defender portal, edit **Connection filter policy (Default)** (Security Administrator),\n   remove the IP addresses, clear **Turn on safe list** and save.\n3. PowerShell equivalent:\n   ```powershell\n   Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList $null -EnableSafeList $false\n   ```\n",
      "rollback": "Re-add the IP address (`-IPAllowList @{Add=\"192.0.2.10\"}`) while the proper path is set up.\n"
    },
    "references": [
      {
        "title": "Configure connection filtering",
        "url": "https://learn.microsoft.com/defender-office-365/connection-filter-policies-configure",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-HostedConnectionFilterPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-hostedconnectionfilterpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft 365 security suite baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/securitysuite.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-114)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.8.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.8.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-002",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-030",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}