ORCA.114 - No IP Allow Lists have been configured.
Overview
IP addresses contained in the IP allow list are able to bypass spam, phishing and spoofing checks, potentially resulting in more spam. Ensure that the IP list is kept to a minimum.
Remediation action
Remove IP addresses from IP allow list.
Related Links
Test Metadata
| Field | Value |
|---|---|
| Test ID | ORCA.114 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Anti-spam |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:AC-4 |
| PowerShell test | Test-ORCA114 |
| Services | ExchangeOnline |
Source
- Test:
tests/orca/Test.ORCA.114.ps1 - Documentation:
tests/orca/Test.ORCA.114.md