MDOThreatPolicyChecker

Download the latest release: MDOThreatPolicyChecker.ps1

This script checks which Microsoft Defender for Office 365 and Exchange Online Protection threat policies cover a particular user, including anti-malware, anti-phishing, inbound and outbound anti-spam, as well as Safe Attachments and Safe Links policies in case these are licensed for your tenant. In addition, the script can check for threat policies that have inclusion and/or exclusion settings that may be redundant or confusing and lead to missed coverage of users or coverage by an unexpected threat policy.

It also includes an option to show all the actions and settings of the policies that apply to a user.

Common Usage

The script uses Exchange Online cmdlets from Exchange Online module and Microsoft.Graph cmdLets from Microsoft.Graph.Authentication, Microsoft.Graph.Groups and Microsoft.Graph.Users modules.

To run the PowerShell Graph cmdlets used in this script, you need only the following modules from the Microsoft.Graph PowerShell SDK: - Microsoft.Graph.Groups: Contains cmdlets for managing groups, including Get-MgGroup and Get-MgGroupMember. - Microsoft.Graph.Users: Includes cmdlets for managing users, such as Get-MgUser. - Microsoft.Graph.Authentication: Required for authentication purposes and to run any cmdlet that interacts with Microsoft Graph.

You can find the Microsoft Graph modules in the following link:
    https://www.powershellgallery.com/packages/Microsoft.Graph/
    https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation?view=graph-powershell-1.0#installation

Here's how you can install the required submodules for the PowerShell Graph SDK cmdlets:

Install-Module -Name Microsoft.Graph.Authentication -Scope CurrentUser
Install-Module -Name Microsoft.Graph.Groups -Scope CurrentUser
Install-Module -Name Microsoft.Graph.Users -Scope CurrentUser

NOTE

Remember to run these commands in a PowerShell session with the appropriate permissions. The -Scope CurrentUser parameter installs the modules for the current user only, which doesn't require administrative privileges.

In the Graph connection you will need the following scopes 'Group.Read.All','User.Read.All'

Connect-MgGraph -Scopes 'Group.Read.All','User.Read.All'

You need as well an Exchange Online session.

Connect-ExchangeOnline

You can find the Exchange module and information in the following links:
    https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps
    https://www.powershellgallery.com/packages/ExchangeOnlineManagement

Examples:

To check all threat policies for potentially confusing user inclusion and/or exclusion conditions and print them out for review, run the following:

.\MDOThreatPolicyChecker.ps1

To provide a CSV input file with email addresses and see only EOP policies, run the following:

.\MDOThreatPolicyChecker.ps1 -CsvFilePath [Path\filename.csv]

To provide multiple email addresses by command line and see only EOP policies, run the following:

.\MDOThreatPolicyChecker.ps1 -EmailAddress user1@contoso.com,user2@fabrikam.com

To provide a CSV input file with email addresses and see both EOP and MDO policies, run the following:

.\MDOThreatPolicyChecker.ps1 -CsvFilePath [Path\filename.csv] -IncludeMDOPolicies

To provide an email address and see only MDO (Safe Attachment and Safe Links) policies, run the following:

.\MDOThreatPolicyChecker.ps1 -EmailAddress user1@contoso.com -OnlyMDOPolicies

To see the details of the policies applied to mailbox in a CSV file for both EOP and MDO, run the following:

.\MDOThreatPolicyChecker.ps1 -CsvFilePath [Path\filename.csv] -IncludeMDOPolicies -ShowDetailedPolicies

To get all mailboxes in your tenant and print out their EOP and MDO policies, run the following:

.\MDOThreatPolicyChecker.ps1 -IncludeMDOPolicies -EmailAddress @(Get-ExOMailbox -ResultSize unlimited | Select-Object -ExpandProperty PrimarySmtpAddress)

Parameters

Parameter	Description
CsvFilePath	Allows you to specify a CSV file with a list of email addresses to check. Csv file must include a first line with header Email.
EmailAddress	Allows you to specify email address or multiple addresses separated by commas.
IncludeMDOPolicies	Checks both EOP and MDO (Safe Attachment and Safe Links) policies for user(s) specified in the CSV file or EmailAddress parameter.
OnlyMDOPolicies	Checks only MDO (Safe Attachment and Safe Links) policies for user(s) specified in the CSV file or EmailAddress parameter.
ShowDetailedPolicies	In addition to the policy applied, show any policy details that are set to True, On, or not blank.
SkipConnectionCheck	Skips connection check for Graph and Exchange Online.
SkipVersionCheck	Skips the version check of the script.
ScriptUpdateOnly	Just updates script version to latest one.