Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors
ORCA.233.1MediumDefenderMail flow
Part of ORCA · Defender · Mail flow · All checks
Invoke-Maester -TestId ORCA.233.1Overview
Section titled “Overview”Exchange Online Protection (EOP) and Microsoft Defender for Office 365 works best when the mail exchange (MX) record is pointed directly at the service. In the event another third-party service is being used, a very important signal (the senders IP address) is obfuscated and hidden from EOP & MDO, generating a larger quantity of false positives and false negatives. By configuring Enhanced Filtering with the IP addresses of these services the true senders IP address can be discovered, reducing the false-positive and false-negative impact.
Remediation action
Section titled “Remediation action”Configure enhanced filtering on connectors when email path is not direct to EOP.
Related Links
Section titled “Related Links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | ORCA.233.1 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Connector |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing |
| PowerShell test | Test-ORCA233_1 |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/orca/Test.ORCA.233.1.ps1 - Documentation:
tests/orca/Test.ORCA.233.1.md