Checks/EXO/MET-EXO018-RemoteDomainForwarding.ps1
|
$referenceUrl = 'https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/remote-domains/remote-domains' try { $remoteDomains = @(Get-RemoteDomain -ErrorAction Stop) } catch { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Fail -Severity High -AffectedObject 'Remote Domains' ` -Finding 'Unable to retrieve remote domain configuration' ` -Recommendation 'Ensure the account has Exchange View-Only Configuration or higher permissions.' ` -ReferenceUrl $referenceUrl -ErrorMessage $_.ToString() return } if ($remoteDomains.Count -eq 0) { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Info -Severity High -AffectedObject 'Remote Domains' ` -Finding 'No remote domains are configured in this tenant, so automatic forwarding behaviour cannot be assessed from this control plane' ` -ReferenceUrl $referenceUrl return } foreach ($remoteDomain in $remoteDomains) { $domainName = [string]$remoteDomain.DomainName $identity = [string]$remoteDomain.Name if ([string]::IsNullOrWhiteSpace($identity)) { $identity = $domainName } $affectedObject = "Remote Domain '$identity' ($domainName)" $isDefaultDomain = $domainName -eq '*' $hasProperty = $null -ne $remoteDomain.PSObject.Properties['AutoForwardEnabled'] -and $null -ne $remoteDomain.AutoForwardEnabled $recommendation = "Run: Set-RemoteDomain -Identity '$identity' -AutoForwardEnabled `$false. This is only one of three independent control planes for automatic forwarding, and all three must be closed: the remote domain setting assessed here, the outbound spam filter policy's AutoForwardingMode (assessed by MET-MDO007), and per-mailbox forwarding addresses (assessed by MET-EXO012). Closing one while leaving the others open still allows mail to leave the tenant automatically. Before disabling, confirm no business process depends on forwarding to this domain - disabling it breaks legitimate automatic forwarding to that domain, and affected users are not notified." if (-not $hasProperty) { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Pass -Severity High -AffectedObject $affectedObject ` -Finding 'The AutoForwardEnabled property was absent or null on this remote domain, so automatic forwarding was not asserted as enabled and is treated as not permitted - verify directly with Get-RemoteDomain if this domain matters to you' ` -ReferenceUrl $referenceUrl continue } if ($remoteDomain.AutoForwardEnabled -eq $true) { if ($isDefaultDomain) { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Fail -Severity High -AffectedObject $affectedObject ` -Finding 'Automatic forwarding is enabled on the tenant-wide default remote domain (DomainName ''*''), so mail can be automatically forwarded from any mailbox to every external domain - by inbox rule or by a forwarding SMTP address. This is the standard business email compromise exfiltration path: an attacker who compromises a mailbox creates a forwarding rule and silently receives a copy of all subsequent mail, long after the password is reset.' ` -Recommendation $recommendation ` -ReferenceUrl $referenceUrl } else { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Warning -Severity High -AffectedObject $affectedObject ` -Finding "Automatic forwarding is enabled for the specific remote domain '$domainName'. This is a scoped exception rather than tenant-wide exposure, but mail can still leave the tenant automatically to that destination and the exception needs periodic review to confirm it is still required and still points at a domain you control or trust." ` -Recommendation $recommendation ` -ReferenceUrl $referenceUrl } } else { New-METCheckResult -CheckId 'MET-EXO018' -Category EXO -Name 'Remote Domain Automatic Forwarding' ` -Result Pass -Severity High -AffectedObject $affectedObject ` -Finding 'Automatic forwarding is disabled for this remote domain' ` -ReferenceUrl $referenceUrl } } |