IP allow lists SHOULD NOT be created

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Exchange Online · Anti-spam · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.12.1

Overview

IP allow lists SHOULD NOT be created.

Rationale: Messages sent from IP addresses on an allow list bypass important security mechanisms, including spam filtering and sender authentication checks. Avoiding use of IP allow lists prevents potential threats from circumventing security mechanisms.

Remediation action:

To modify the connection filters, follow the instructions found in Use the Microsoft 365 Defender portal to modify the default connection filter policy.

1. Sign in to Microsoft 365 Defender portal.
2. From the left-hand menu, find Email & collaboration and select Policies and Rules.
3. Select Threat Policies from the list of policy names.
4. Under Policies, select Anti-spam.
5. Select Connection filter policy (Default).
6. Click Edit connection filter policy.
7. Ensure no addresses are specified under Always allow messages from the following IP addresses or address range.

Related links

• Defender admin center - Anti-spam policies
• CISA 12 IP Allow Lists - MS.EXO.12.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.12.1
Severity	Medium
Suite	CISA
Product	Exchange Online
Related products	Defender
Feature	Anti-spam
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1566 Phishing, T1684.002 Email Spoofing
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.12.1
Criticality	SHOULD
Upstream requirement	Moved to MS.SECURITYSUITE.8.1v1 (was MS.EXO.12.1v1)
Supports controls	cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4
PowerShell test	Test-MtCisaAntiSpamAllowList
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.12.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.12.1.md