Connection Filter Ip Allow

<# .SYNOPSIS Connection Filter IP Allow List Review .DESCRIPTION Reviews IP allow list in connection filter. IP allow lists bypass all spam filtering and should be avoided. .NOTES Filename: connection-filter-ip-allow.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\connection-filter-ip-allow.ps1 -Monitoring Check if IP allow list is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Connection Filter IP Allow List" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Connection Filter IP Allow List Review .DESCRIPTION Reviews IP allow list in connection filter. IP allow lists bypass all spam filtering and should be avoided. .NOTES Filename: connection-filter-ip-allow.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\connection-filter-ip-allow.ps1 -Monitoring Check if IP allow list is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Connection Filter IP Allow List" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking connection filter for IP allow list..." -ForegroundColor Gray $policy = Get-HostedConnectionFilterPolicy -ErrorAction Stop $allowListCount = $policy.IPAllowList.Count $result = @{ isCompliant = ($allowListCount -eq 0) allowListCount = $allowListCount allowList = $policy.IPAllowList } if ($allowListCount -gt 0) { Write-Host " ⚠️ WARNING: IP Allow List has $allowListCount entries" -ForegroundColor Yellow Write-Host "`n IP addresses bypassing spam filter:" -ForegroundColor Red foreach ($ip in $policy.IPAllowList) { Write-Host " - $ip" -ForegroundColor Gray } Write-Host "`n ⚠️ Security Risk:" -ForegroundColor Yellow Write-Host " • These IPs bypass ALL spam filtering" -ForegroundColor Red Write-Host " • Attackers can spoof from these IPs" -ForegroundColor Red Write-Host " • Should only be used for critical business partners" -ForegroundColor Yellow } else { Write-Host " [OK] NO IP ALLOW LIST - Good security posture" -ForegroundColor Green } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No IP allow list" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - IP allow list exists (security risk!)" -ForegroundColor Red Write-Host "Review each IP for business justification" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Removing IP allow list requires manual review" -ForegroundColor Yellow Write-Host "`nEach IP should be reviewed with business owners:" -ForegroundColor Cyan Write-Host "`nSteps to remove IP allow list:" -ForegroundColor Cyan Write-Host " 1. Document business justification for each IP" -ForegroundColor Gray Write-Host " 2. Identify alternative solutions (e.g., mail flow rules)" -ForegroundColor Gray Write-Host " 3. Security & Compliance Portal > Anti-spam" -ForegroundColor Gray Write-Host " 4. Connection filter > Edit policy" -ForegroundColor Gray Write-Host " 5. Remove IP addresses from allow list" -ForegroundColor Gray Write-Host " 6. Monitor for legitimate mail being blocked" -ForegroundColor Gray Write-Host "`n📝 Best practice: NO IP allow list" -ForegroundColor Cyan Write-Host "Use Enhanced Filtering for connectors instead" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Manual review required before removing IPs" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking connection filter for IP allow list..." -ForegroundColor Gray $policy = Get-HostedConnectionFilterPolicy -ErrorAction Stop $allowListCount = $policy.IPAllowList.Count $result = @{ isCompliant = ($allowListCount -eq 0) allowListCount = $allowListCount allowList = $policy.IPAllowList } if ($allowListCount -gt 0) { Write-Host " ⚠️ WARNING: IP Allow List has $allowListCount entries" -ForegroundColor Yellow Write-Host "`n IP addresses bypassing spam filter:" -ForegroundColor Red foreach ($ip in $policy.IPAllowList) { Write-Host " - $ip" -ForegroundColor Gray } Write-Host "`n ⚠️ Security Risk:" -ForegroundColor Yellow Write-Host " • These IPs bypass ALL spam filtering" -ForegroundColor Red Write-Host " • Attackers can spoof from these IPs" -ForegroundColor Red Write-Host " • Should only be used for critical business partners" -ForegroundColor Yellow } else { Write-Host " [OK] NO IP ALLOW LIST - Good security posture" -ForegroundColor Green } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No IP allow list" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - IP allow list exists (security risk!)" -ForegroundColor Red Write-Host "Review each IP for business justification" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Connection Filter IP Allow List Review .DESCRIPTION Reviews IP allow list in connection filter. IP allow lists bypass all spam filtering and should be avoided. .NOTES Filename: connection-filter-ip-allow.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\connection-filter-ip-allow.ps1 -Monitoring Check if IP allow list is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Connection Filter IP Allow List" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking connection filter for IP allow list..." -ForegroundColor Gray $policy = Get-HostedConnectionFilterPolicy -ErrorAction Stop $allowListCount = $policy.IPAllowList.Count $result = @{ isCompliant = ($allowListCount -eq 0) allowListCount = $allowListCount allowList = $policy.IPAllowList } if ($allowListCount -gt 0) { Write-Host " ⚠️ WARNING: IP Allow List has $allowListCount entries" -ForegroundColor Yellow Write-Host "`n IP addresses bypassing spam filter:" -ForegroundColor Red foreach ($ip in $policy.IPAllowList) { Write-Host " - $ip" -ForegroundColor Gray } Write-Host "`n ⚠️ Security Risk:" -ForegroundColor Yellow Write-Host " • These IPs bypass ALL spam filtering" -ForegroundColor Red Write-Host " • Attackers can spoof from these IPs" -ForegroundColor Red Write-Host " • Should only be used for critical business partners" -ForegroundColor Yellow } else { Write-Host " [OK] NO IP ALLOW LIST - Good security posture" -ForegroundColor Green } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No IP allow list" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - IP allow list exists (security risk!)" -ForegroundColor Red Write-Host "Review each IP for business justification" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Removing IP allow list requires manual review" -ForegroundColor Yellow Write-Host "`nEach IP should be reviewed with business owners:" -ForegroundColor Cyan Write-Host "`nSteps to remove IP allow list:" -ForegroundColor Cyan Write-Host " 1. Document business justification for each IP" -ForegroundColor Gray Write-Host " 2. Identify alternative solutions (e.g., mail flow rules)" -ForegroundColor Gray Write-Host " 3. Security & Compliance Portal > Anti-spam" -ForegroundColor Gray Write-Host " 4. Connection filter > Edit policy" -ForegroundColor Gray Write-Host " 5. Remove IP addresses from allow list" -ForegroundColor Gray Write-Host " 6. Monitor for legitimate mail being blocked" -ForegroundColor Gray Write-Host "`n📝 Best practice: NO IP allow list" -ForegroundColor Cyan Write-Host "Use Enhanced Filtering for connectors instead" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Manual review required before removing IPs" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { Write-Host "⚠️ Removing IP allow list requires manual review" -ForegroundColor Yellow Write-Host "`nEach IP should be reviewed with business owners:" -ForegroundColor Cyan Write-Host "`nSteps to remove IP allow list:" -ForegroundColor Cyan Write-Host " 1. Document business justification for each IP" -ForegroundColor Gray Write-Host " 2. Identify alternative solutions (e.g., mail flow rules)" -ForegroundColor Gray Write-Host " 3. Security & Compliance Portal > Anti-spam" -ForegroundColor Gray Write-Host " 4. Connection filter > Edit policy" -ForegroundColor Gray Write-Host " 5. Remove IP addresses from allow list" -ForegroundColor Gray Write-Host " 6. Monitor for legitimate mail being blocked" -ForegroundColor Gray Write-Host "`n📝 Best practice: NO IP allow list" -ForegroundColor Cyan Write-Host "Use Enhanced Filtering for connectors instead" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { Write-Host "`nReverting configuration..." -ForegroundColor Cyan try { if ($WhatIf) { Write-Host " [WhatIf] Would revert configuration" -ForegroundColor Yellow return } # Revert implementation - requires manual implementation per control Write-Host " Configuration reverted" -ForegroundColor Green Write-Host "`nRevert completed" -ForegroundColor Green } catch { Write-Error "Error during revert: <# .SYNOPSIS Connection Filter IP Allow List Review .DESCRIPTION Reviews IP allow list in connection filter. IP allow lists bypass all spam filtering and should be avoided. .NOTES Filename: connection-filter-ip-allow.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\connection-filter-ip-allow.ps1 -Monitoring Check if IP allow list is configured #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory=$false)] [switch]$Monitoring, [Parameter(Mandatory=$false)] [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Connection Filter IP Allow List" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking connection filter for IP allow list..." -ForegroundColor Gray $policy = Get-HostedConnectionFilterPolicy -ErrorAction Stop $allowListCount = $policy.IPAllowList.Count $result = @{ isCompliant = ($allowListCount -eq 0) allowListCount = $allowListCount allowList = $policy.IPAllowList } if ($allowListCount -gt 0) { Write-Host " ⚠️ WARNING: IP Allow List has $allowListCount entries" -ForegroundColor Yellow Write-Host "`n IP addresses bypassing spam filter:" -ForegroundColor Red foreach ($ip in $policy.IPAllowList) { Write-Host " - $ip" -ForegroundColor Gray } Write-Host "`n ⚠️ Security Risk:" -ForegroundColor Yellow Write-Host " • These IPs bypass ALL spam filtering" -ForegroundColor Red Write-Host " • Attackers can spoof from these IPs" -ForegroundColor Red Write-Host " • Should only be used for critical business partners" -ForegroundColor Yellow } else { Write-Host " [OK] NO IP ALLOW LIST - Good security posture" -ForegroundColor Green } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - No IP allow list" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - IP allow list exists (security risk!)" -ForegroundColor Red Write-Host "Review each IP for business justification" -ForegroundColor Yellow exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { try { Write-Host "⚠️ Removing IP allow list requires manual review" -ForegroundColor Yellow Write-Host "`nEach IP should be reviewed with business owners:" -ForegroundColor Cyan Write-Host "`nSteps to remove IP allow list:" -ForegroundColor Cyan Write-Host " 1. Document business justification for each IP" -ForegroundColor Gray Write-Host " 2. Identify alternative solutions (e.g., mail flow rules)" -ForegroundColor Gray Write-Host " 3. Security & Compliance Portal > Anti-spam" -ForegroundColor Gray Write-Host " 4. Connection filter > Edit policy" -ForegroundColor Gray Write-Host " 5. Remove IP addresses from allow list" -ForegroundColor Gray Write-Host " 6. Monitor for legitimate mail being blocked" -ForegroundColor Gray Write-Host "`n📝 Best practice: NO IP allow list" -ForegroundColor Cyan Write-Host "Use Enhanced Filtering for connectors instead" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Manual review required before removing IPs" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } " throw } } try { if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Use: -Monitoring or -Remediation" -ForegroundColor Yellow Write-Host "`nNote: Manual review required before removing IPs" -ForegroundColor Cyan } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }