diff --git a/.github/workflows/build_sign_release.yaml b/.github/workflows/build_sign_release.yaml index 163c9345e..0fbd231e0 100644 --- a/.github/workflows/build_sign_release.yaml +++ b/.github/workflows/build_sign_release.yaml @@ -5,6 +5,7 @@ name: Build and Draft Release on: workflow_dispatch: inputs: + # checkov:skip=CKV_GHA_7:Manual inputs are desired. releaseName: description: "Release Name" required: true @@ -19,6 +20,8 @@ on: type: boolean default: true +permissions: read-all + jobs: build-and-draft: name: Build and Draft Release diff --git a/.github/workflows/check_security.yaml b/.github/workflows/check_security.yaml new file mode 100644 index 000000000..08d8bf26a --- /dev/null +++ b/.github/workflows/check_security.yaml @@ -0,0 +1,27 @@ +# Purpose: Run a static analysis code checker against the repo. + +name: Check Security + +# This is a reusable workflow called by the pipeline. +on: + workflow_call: + workflow_dispatch: + +permissions: read-all + +jobs: + check-security: + name: MegaLint Checkov + runs-on: ubuntu-latest + # This condition prevents duplicate runs. + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name + defaults: + run: + shell: bash + steps: + - name: Checkout Repo + uses: actions/checkout@v4 + - name: Setup Config File + run: cp Testing/Linting/MegaLinter/.mega-linter-security.yml .mega-linter.yml + - name: Check Security + uses: oxsecurity/megalinter/flavors/security@latest diff --git a/.github/workflows/lint_powershell.yaml b/.github/workflows/lint_powershell.yaml index e59629ee3..040f2195d 100644 --- a/.github/workflows/lint_powershell.yaml +++ b/.github/workflows/lint_powershell.yaml @@ -7,21 +7,23 @@ on: workflow_call: workflow_dispatch: +permissions: read-all + jobs: powershell-lint-check: name: MegaLint PowerShell Check - runs-on: ubuntu-latest + # runs-on: ubuntu-latest + runs-on: windows-latest # This condition prevents duplicate runs. if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name defaults: run: - shell: bash + shell: pwsh steps: - name: Checkout Repo uses: actions/checkout@v4 - - name: Setup Config File - run: cp Testing/Linting/MegaLinter/.mega-linter-powershell.yml .mega-linter.yml - name: Setup PSScriptAnalyzer settings run: cp Testing/Linting/MegaLinter/.powershell-psscriptanalyzer.psd1 .powershell-psscriptanalyzer.psd1 - - name: Lint PowerShell - uses: oxsecurity/megalinter/flavors/dotnet@latest + - name: Run PSScriptAnalyzer on PowerShell Scripts + run: | + Invoke-ScriptAnalyzer -Path ./ -Recurse -Severity Warning -EnableExit -Profile .powershell-psscriptanalyzer.psd1 diff --git a/.github/workflows/lint_yaml.yaml b/.github/workflows/lint_yaml.yaml index 65a527f42..b7df39dcd 100644 --- a/.github/workflows/lint_yaml.yaml +++ b/.github/workflows/lint_yaml.yaml @@ -7,6 +7,8 @@ on: workflow_call: workflow_dispatch: +permissions: read-all + jobs: yaml-lint-check: name: MegaLint YAML Check diff --git a/.github/workflows/publish_private_package.yaml b/.github/workflows/publish_private_package.yaml index 1cd304fb6..1d236836b 100644 --- a/.github/workflows/publish_private_package.yaml +++ b/.github/workflows/publish_private_package.yaml @@ -14,6 +14,8 @@ on: # - ".github/workflows/publish_private_package.yaml" # - "utils/DeployUtils.ps1" +permissions: read-all + env: GalleryName: PrivateScubaGearGallery diff --git a/.github/workflows/publish_public_package.yaml b/.github/workflows/publish_public_package.yaml index 41d3805cc..c2f5c858a 100644 --- a/.github/workflows/publish_public_package.yaml +++ b/.github/workflows/publish_public_package.yaml @@ -5,6 +5,7 @@ name: Publish Public Package on: workflow_dispatch: inputs: + # checkov:skip=CKV_GHA_7:Manual inputs are desired. OverrideModuleVersion: description: "Override the version of the release. Restricted to SemVer 1.0 - 3 segments" required: false @@ -24,6 +25,8 @@ on: # - ".github/workflows/publish_public_package.yaml" # - "utils/DeployUtils.ps1" +permissions: read-all + jobs: publish: name: Publish to PSGallery diff --git a/.github/workflows/run_module_version_bump.yml b/.github/workflows/run_module_version_bump.yml index 33192cfa5..0ae38e23b 100644 --- a/.github/workflows/run_module_version_bump.yml +++ b/.github/workflows/run_module_version_bump.yml @@ -3,11 +3,14 @@ name: Module Version Bump on: workflow_dispatch: inputs: + # checkov:skip=CKV_GHA_7:Manual inputs are desired. newVersionNumber: description: "New Version number (e.g., 1.2.4)" required: true type: string +permissions: read-all + jobs: module-version-bump: runs-on: windows-latest diff --git a/.github/workflows/run_pipeline.yaml b/.github/workflows/run_pipeline.yaml index 4f73e9992..1e9473fc3 100644 --- a/.github/workflows/run_pipeline.yaml +++ b/.github/workflows/run_pipeline.yaml @@ -1,5 +1,5 @@ # Purpose: Run the CI/CD pipeline that tests, packages, and publishes ScubaGear. -# Note: This pipeline is a work in progress. At the moment, it is only doing linting, syntax checking, and unit testing. +# Note: This pipeline is a work in progress. At the moment, it is only doing linting, syntax checking, security scanning, and unit testing. name: Run the CI/CD Pipeline @@ -8,22 +8,44 @@ on: pull_request: workflow_dispatch: +permissions: read-all + jobs: + # Lint and Syntax Checks lint-yaml: name: Lint uses: ./.github/workflows/lint_yaml.yaml lint-powershell: name: Lint uses: ./.github/workflows/lint_powershell.yaml + syntax-markdown: + name: Syntax + uses: ./.github/workflows/syntax_check_markdown.yaml + # Security Checks scan-secret: name: Security + needs: + - lint-yaml + - lint-powershell + - syntax-markdown uses: ./.github/workflows/run_secret_scan.yaml - syntax: - name: Syntax - uses: ./.github/workflows/syntax_check_markdown.yaml + check-security: + name: Security + needs: + - lint-yaml + - lint-powershell + - syntax-markdown + uses: ./.github/workflows/check_security.yaml + # Unit Tests unit-powershell: name: Unit + needs: + - scan-secret + - check-security uses: ./.github/workflows/unit_test_powershell.yaml unit-opa: name: Unit + needs: + - scan-secret + - check-security uses: ./.github/workflows/unit_test_opa.yaml diff --git a/.github/workflows/run_secret_scan.yaml b/.github/workflows/run_secret_scan.yaml index ee4050dc2..12c8b29f2 100644 --- a/.github/workflows/run_secret_scan.yaml +++ b/.github/workflows/run_secret_scan.yaml @@ -6,6 +6,8 @@ on: workflow_call: workflow_dispatch: +permissions: read-all + jobs: secret-scan: name: MegaLint Gitleaks diff --git a/.github/workflows/run_smoke_test.yaml b/.github/workflows/run_smoke_test.yaml index f3929476a..f9b83bcad 100644 --- a/.github/workflows/run_smoke_test.yaml +++ b/.github/workflows/run_smoke_test.yaml @@ -18,6 +18,8 @@ on: - "main" - "*smoke*" +permissions: read-all + jobs: smoke-tests: name: Smoke Tests diff --git a/.github/workflows/run_update_opa.yaml b/.github/workflows/run_update_opa.yaml index 3aed3b29b..7de63785d 100644 --- a/.github/workflows/run_update_opa.yaml +++ b/.github/workflows/run_update_opa.yaml @@ -6,6 +6,8 @@ on: - cron: "11 2 * * 1-5" workflow_dispatch: +permissions: read-all + jobs: update-opa-dependency: runs-on: windows-latest diff --git a/.github/workflows/syntax_check_markdown.yaml b/.github/workflows/syntax_check_markdown.yaml index 2a98b73dc..0f8f8dee5 100644 --- a/.github/workflows/syntax_check_markdown.yaml +++ b/.github/workflows/syntax_check_markdown.yaml @@ -7,6 +7,8 @@ on: workflow_call: workflow_dispatch: +permissions: read-all + jobs: markdown-check: name: Markdown Syntax Checks diff --git a/.github/workflows/test_production_function.yaml b/.github/workflows/test_production_function.yaml index 381e09cd8..e11fa99fa 100644 --- a/.github/workflows/test_production_function.yaml +++ b/.github/workflows/test_production_function.yaml @@ -13,6 +13,8 @@ on: - cron: "15 4 * * 0-4" workflow_dispatch: +permissions: read-all + jobs: # Build a matrix of aliases for testing. build-matrix: diff --git a/.github/workflows/unit_test_opa.yaml b/.github/workflows/unit_test_opa.yaml index 9b5ff24e7..4ce486196 100644 --- a/.github/workflows/unit_test_opa.yaml +++ b/.github/workflows/unit_test_opa.yaml @@ -7,8 +7,11 @@ on: workflow_call: workflow_dispatch: +permissions: read-all + env: MODULE_ROOT: PowerShell/ScubaGear + jobs: opa-tests: name: OPA Unit Tests diff --git a/PowerShell/ScubaGear/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/ProviderSettingsExport.json b/PowerShell/ScubaGear/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/ProviderSettingsExport.json index caae1eea8..932273a69 100644 --- a/PowerShell/ScubaGear/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/ProviderSettingsExport.json +++ b/PowerShell/ScubaGear/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/ProviderSettingsExport.json @@ -1,19099 +1,15892 @@ - { - "baseline_version": "0.1", - "module_version": "0.3.0", - "date": "08/23/2023 12:23:24 Eastern Daylight Time", - "tenant_details": [ +{ + "baseline_version": "0.1", + "module_version": "0.3.0", + "date": "08/23/2023 12:23:24 Eastern Daylight Time", + "tenant_details": [ { - "AADAdditionalData": { - "AssignedPlans": [ - { - "AssignedDateTime": "/Date(1682823962000)/", - "CapabilityStatus": "Deleted", - "Service": "exchange", - "ServicePlanId": "113feb6c-3fe4-4440-bddc-54d774bf0318" - }, - { - "AssignedDateTime": "/Date(1676979479000)/", - "CapabilityStatus": "Deleted", - "Service": "RMSOnline", - "ServicePlanId": "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3" - }, - { - "AssignedDateTime": "/Date(1676979478000)/", - "CapabilityStatus": "Deleted", - "Service": "RMSOnline", - "ServicePlanId": "bea4c11e-220a-4e6d-8eb8-8ea15d019f90" - }, - { - "AssignedDateTime": "/Date(1676979478000)/", - "CapabilityStatus": "Deleted", - "Service": "exchange", - "ServicePlanId": "922ba911-5694-4e99-a794-73aed9bfeec8" - }, - { - "AssignedDateTime": "/Date(1676979478000)/", - "CapabilityStatus": "Deleted", - "Service": "RMSOnline", - "ServicePlanId": "5689bec4-755d-4753-8b61-40975025187c" - }, - { - "AssignedDateTime": "/Date(1676979170000)/", - "CapabilityStatus": "Deleted", - "Service": "Adallom", - "ServicePlanId": "8c098270-9dd4-4350-9b30-ba4703f3b36b" - }, - { - "AssignedDateTime": "/Date(1674387225000)/", - "CapabilityStatus": "Enabled", - "Service": "MIPExchangeSolutions", - "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6" - }, - { - "AssignedDateTime": "/Date(1666375096000)/", - "CapabilityStatus": "Enabled", - "Service": "RMSOnline", - "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce" - }, - { - "AssignedDateTime": "/Date(1666375094000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757" - }, - { - "AssignedDateTime": "/Date(1666375094000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftEndpointDLP", - "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e" - }, - { - "AssignedDateTime": "/Date(1666375096000)/", - "CapabilityStatus": "Enabled", - "Service": "RMSOnline", - "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98" - }, - { - "AssignedDateTime": "/Date(1666375093000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0" - }, - { - "AssignedDateTime": "/Date(1666375095000)/", - "CapabilityStatus": "Enabled", - "Service": "Office365InsiderRisk", - "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75" - }, - { - "AssignedDateTime": "/Date(1666375094000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7" - }, - { - "AssignedDateTime": "/Date(1666375094000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f" - }, - { - "AssignedDateTime": "/Date(1666300549000)/", - "CapabilityStatus": "Enabled", - "Service": "Bing", - "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftThreatProtection", - "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "SharePoint", - "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "CRM", - "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftCommunicationsOnline", - "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "SharePoint", - "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692" - }, - { - "AssignedDateTime": "/Date(1666300549000)/", - "CapabilityStatus": "Enabled", - "Service": "WhiteboardServices", - "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "OfficeForms", - "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "ProjectWorkManagement", - "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftOffice", - "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "M365CommunicationCompliance", - "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "M365LabelAnalytics", - "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "TeamspaceAPI", - "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftStream", - "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547" - }, - { - "AssignedDateTime": "/Date(1666300549000)/", - "CapabilityStatus": "Enabled", - "Service": "To-Do", - "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67" - }, - { - "AssignedDateTime": "/Date(1666300549000)/", - "CapabilityStatus": "Enabled", - "Service": "ProjectProgramsAndPortfolios", - "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "PowerAppsServiceGCC", - "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftCommunicationsOnline", - "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "MicrosoftCommunicationsOnline", - "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "Fairfax-MicrosoftPowerBI-WFE", - "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "M365LabelAnalytics", - "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "CRM", - "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10" - }, - { - "AssignedDateTime": "/Date(1666300551000)/", - "CapabilityStatus": "Enabled", - "Service": "RMSOnline", - "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "exchange", - "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b" - }, - { - "AssignedDateTime": "/Date(1666300550000)/", - "CapabilityStatus": "Enabled", - "Service": "ProcessSimpleGCC", - "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246" - }, - { - "AssignedDateTime": "/Date(1666300529000)/", - "CapabilityStatus": "Enabled", - "Service": "AzureAdvancedThreatAnalytics", - "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f" - }, - { - "AssignedDateTime": "/Date(1666300529000)/", - "CapabilityStatus": "Enabled", - "Service": "AADPremiumService", - "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998" - }, - { - "AssignedDateTime": "/Date(1666300530000)/", - "CapabilityStatus": "Enabled", - "Service": "AADPremiumService", - "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d" - }, - { - "AssignedDateTime": "/Date(1666300529000)/", - "CapabilityStatus": "Enabled", - "Service": "MultiFactorService", - "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0" - }, - { - "AssignedDateTime": "/Date(1666300529000)/", - "CapabilityStatus": "Enabled", - "Service": "Adallom", - "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2" - }, - { - "AssignedDateTime": "/Date(1666300529000)/", - "CapabilityStatus": "Enabled", - "Service": "SCO", - "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5" - }, - { - "AssignedDateTime": "/Date(1646945063000)/", - "CapabilityStatus": "Enabled", - "Service": "WindowsAzure", - "ServicePlanId": "fca3e605-0754-4279-8504-3f1229f29614" - }, - { - "AssignedDateTime": "/Date(1638885214000)/", - "CapabilityStatus": "Enabled", - "Service": "WindowsDefenderATP", - "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef" - }, - { - "AssignedDateTime": "/Date(1616437077000)/", - "CapabilityStatus": "Deleted", - "Service": "SCO", - "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" - }, - { - "AssignedDateTime": "/Date(1614604981000)/", - "CapabilityStatus": "Deleted", - "Service": "SCO", - "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" - } - ], - "Branding": { - "BackgroundColor": null, - "BackgroundImage": null, - "BackgroundImageRelativeUrl": null, - "BannerLogo": null, - "BannerLogoRelativeUrl": null, - "CdnList": null, - "CustomAccountResetCredentialsUrl": null, - "CustomCannotAccessYourAccountText": null, - "CustomCannotAccessYourAccountUrl": null, - "CustomCss": null, - "CustomCssRelativeUrl": null, - "CustomForgotMyPasswordText": null, - "CustomPrivacyAndCookiesText": null, - "CustomPrivacyAndCookiesUrl": null, - "CustomResetItNowText": null, - "CustomTermsOfUseText": null, - "CustomTermsOfUseUrl": null, - "Favicon": null, - "FaviconRelativeUrl": null, - "HeaderBackgroundColor": null, - "HeaderLogo": null, - "HeaderLogoRelativeUrl": null, - "Id": null, - "Localizations": null, - "LoginPageLayoutConfiguration": { - "IsFooterShown": null, - "IsHeaderShown": null, - "LayoutTemplateType": null - }, - "LoginPageTextVisibilitySettings": { - "HideAccountResetCredentials": null, - "HideCannotAccessYourAccount": null, - "HideForgotMyPassword": null, - "HidePrivacyAndCookies": null, - "HideResetItNow": null, - "HideTermsOfUse": null - }, - "SignInPageText": null, - "SquareLogo": null, - "SquareLogoDark": null, - "SquareLogoDarkRelativeUrl": null, - "SquareLogoRelativeUrl": null, - "UsernameHintText": null - }, - "BusinessPhones": [ - "2025782732" - ], - "CertificateBasedAuthConfiguration": null, - "CertificateConnectorSetting": { - "CertExpiryTime": null, - "ConnectorVersion": null, - "EnrollmentError": null, - "LastConnectorConnectionTime": null, - "LastUploadVersion": null, - "Status": null - }, - "City": "Washington", - "Country": null, - "CountryLetterCode": "US", - "CreatedDateTime": "/Date(1613679244000)/", - "DefaultUsageLocation": null, - "DeletedDateTime": null, - "DirectorySizeQuota": { - "Total": 300000, - "Used": 1041 - }, - "DisplayName": "Agency", - "Extensions": null, - "Id": "3c19c757-3b55-411f-b03f-2bcc514a598d", - "IsMultipleDataLocationsForServicesEnabled": null, - "MarketingNotificationEmails": [ - - ], - "MobileDeviceManagementAuthority": { - - }, - "OnPremisesLastSyncDateTime": "/Date(1661362185000)/", - "OnPremisesSyncEnabled": true, - "PartnerInformation": { - "CommerceUrl": null, - "CompanyName": null, - "CompanyType": null, - "HelpUrl": null, - "PartnerTenantId": null, - "SupportEmails": null, - "SupportTelephones": null, - "SupportUrl": null - }, - "PartnerTenantType": null, - "PostalCode": "20528-0380", - "PreferredLanguage": "en", - "PrivacyProfile": { - "ContactEmail": "", - "StatementUrl": "" - }, - "ProvisionedPlans": [ - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "Adallom" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "SCO" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "SharePoint" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "SharePoint" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "exchange" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "MicrosoftCommunicationsOnline" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "MicrosoftCommunicationsOnline" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "MicrosoftCommunicationsOnline" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "ProjectWorkManagement" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "Adallom" - }, - { - "CapabilityStatus": "Enabled", - "ProvisioningStatus": "Success", - "Service": "RMSOnline" - }, - { - "CapabilityStatus": "Deleted", - "ProvisioningStatus": "Success", - "Service": "SCO" - } - ], - "SecurityComplianceNotificationMails": [ - - ], - "SecurityComplianceNotificationPhones": [ - - ], - "Settings": { - "ContactInsights": { - "DisabledForGroup": null, - "Id": null, - "IsEnabledInOrganization": null - }, - "Id": null, - "ItemInsights": { - "DisabledForGroup": null, - "Id": null, - "IsEnabledInOrganization": null - }, - "MicrosoftApplicationDataAccess": { - "DisabledForGroup": null, - "Id": null, - "IsEnabledForAllMicrosoftApplications": null - }, - "PeopleInsights": { - "DisabledForGroup": null, - "Id": null, - "IsEnabledInOrganization": null - }, - "ProfileCardProperties": null, - "Pronouns": { - "Id": null, - "IsEnabledInOrganization": null - } - }, - "State": "DC", - "Street": "245 Murray Lane", - "TechnicalNotificationMails": [ - "someone@somewhere.org" - ], - "VerifiedDomains": [ - { - "Capabilities": "Email, OfficeCommunicationsOnline", - "IsDefault": true, - "IsInitial": true, - "Name": "someone.onmicrosoft.com", - "Type": "Managed" - }, - { - "Capabilities": "Email, Intune", - "IsDefault": false, - "IsInitial": false, - "Name": "dhs.agency.gov", - "Type": "Managed" - }, - { - "Capabilities": "None", - "IsDefault": false, - "IsInitial": false, - "Name": "mail.onmicrosoft.com", - "Type": "Managed" - }, - { - "Capabilities": "Email", - "IsDefault": false, - "IsInitial": false, - "Name": "test365.gov", - "Type": "Managed" - } - ], - "AdditionalProperties": { - "tenantType": "AAD", - "onPremisesSyncStatus": [ - "System.Collections.Generic.Dictionary`2[System.String,System.Object]" - ] - } - }, - "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", - "DisplayName": "Agency", - "DomainName": "onmicrosoft.com" + "AADAdditionalData": { + "AssignedPlans": [ + { + "AssignedDateTime": "/Date(1682823962000)/", + "CapabilityStatus": "Deleted", + "Service": "exchange", + "ServicePlanId": "113feb6c-3fe4-4440-bddc-54d774bf0318" + }, + { + "AssignedDateTime": "/Date(1676979479000)/", + "CapabilityStatus": "Deleted", + "Service": "RMSOnline", + "ServicePlanId": "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3" + }, + { + "AssignedDateTime": "/Date(1676979478000)/", + "CapabilityStatus": "Deleted", + "Service": "RMSOnline", + "ServicePlanId": "bea4c11e-220a-4e6d-8eb8-8ea15d019f90" + }, + { + "AssignedDateTime": "/Date(1676979478000)/", + "CapabilityStatus": "Deleted", + "Service": "exchange", + "ServicePlanId": "922ba911-5694-4e99-a794-73aed9bfeec8" + }, + { + "AssignedDateTime": "/Date(1676979478000)/", + "CapabilityStatus": "Deleted", + "Service": "RMSOnline", + "ServicePlanId": "5689bec4-755d-4753-8b61-40975025187c" + }, + { + "AssignedDateTime": "/Date(1676979170000)/", + "CapabilityStatus": "Deleted", + "Service": "Adallom", + "ServicePlanId": "8c098270-9dd4-4350-9b30-ba4703f3b36b" + }, + { + "AssignedDateTime": "/Date(1674387225000)/", + "CapabilityStatus": "Enabled", + "Service": "MIPExchangeSolutions", + "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6" + }, + { + "AssignedDateTime": "/Date(1666375096000)/", + "CapabilityStatus": "Enabled", + "Service": "RMSOnline", + "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce" + }, + { + "AssignedDateTime": "/Date(1666375094000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757" + }, + { + "AssignedDateTime": "/Date(1666375094000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftEndpointDLP", + "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e" + }, + { + "AssignedDateTime": "/Date(1666375096000)/", + "CapabilityStatus": "Enabled", + "Service": "RMSOnline", + "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98" + }, + { + "AssignedDateTime": "/Date(1666375093000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0" + }, + { + "AssignedDateTime": "/Date(1666375095000)/", + "CapabilityStatus": "Enabled", + "Service": "Office365InsiderRisk", + "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75" + }, + { + "AssignedDateTime": "/Date(1666375094000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7" + }, + { + "AssignedDateTime": "/Date(1666375094000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f" + }, + { + "AssignedDateTime": "/Date(1666300549000)/", + "CapabilityStatus": "Enabled", + "Service": "Bing", + "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftThreatProtection", + "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "SharePoint", + "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "CRM", + "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftCommunicationsOnline", + "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "SharePoint", + "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692" + }, + { + "AssignedDateTime": "/Date(1666300549000)/", + "CapabilityStatus": "Enabled", + "Service": "WhiteboardServices", + "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "OfficeForms", + "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "ProjectWorkManagement", + "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftOffice", + "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "M365CommunicationCompliance", + "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "M365LabelAnalytics", + "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "TeamspaceAPI", + "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftStream", + "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547" + }, + { + "AssignedDateTime": "/Date(1666300549000)/", + "CapabilityStatus": "Enabled", + "Service": "To-Do", + "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67" + }, + { + "AssignedDateTime": "/Date(1666300549000)/", + "CapabilityStatus": "Enabled", + "Service": "ProjectProgramsAndPortfolios", + "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "PowerAppsServiceGCC", + "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftCommunicationsOnline", + "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "MicrosoftCommunicationsOnline", + "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "Fairfax-MicrosoftPowerBI-WFE", + "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "M365LabelAnalytics", + "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "CRM", + "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10" + }, + { + "AssignedDateTime": "/Date(1666300551000)/", + "CapabilityStatus": "Enabled", + "Service": "RMSOnline", + "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "exchange", + "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b" + }, + { + "AssignedDateTime": "/Date(1666300550000)/", + "CapabilityStatus": "Enabled", + "Service": "ProcessSimpleGCC", + "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246" + }, + { + "AssignedDateTime": "/Date(1666300529000)/", + "CapabilityStatus": "Enabled", + "Service": "AzureAdvancedThreatAnalytics", + "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f" + }, + { + "AssignedDateTime": "/Date(1666300529000)/", + "CapabilityStatus": "Enabled", + "Service": "AADPremiumService", + "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998" + }, + { + "AssignedDateTime": "/Date(1666300530000)/", + "CapabilityStatus": "Enabled", + "Service": "AADPremiumService", + "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d" + }, + { + "AssignedDateTime": "/Date(1666300529000)/", + "CapabilityStatus": "Enabled", + "Service": "MultiFactorService", + "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0" + }, + { + "AssignedDateTime": "/Date(1666300529000)/", + "CapabilityStatus": "Enabled", + "Service": "Adallom", + "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2" + }, + { + "AssignedDateTime": "/Date(1666300529000)/", + "CapabilityStatus": "Enabled", + "Service": "SCO", + "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5" + }, + { + "AssignedDateTime": "/Date(1646945063000)/", + "CapabilityStatus": "Enabled", + "Service": "WindowsAzure", + "ServicePlanId": "fca3e605-0754-4279-8504-3f1229f29614" + }, + { + "AssignedDateTime": "/Date(1638885214000)/", + "CapabilityStatus": "Enabled", + "Service": "WindowsDefenderATP", + "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef" + }, + { + "AssignedDateTime": "/Date(1616437077000)/", + "CapabilityStatus": "Deleted", + "Service": "SCO", + "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" + }, + { + "AssignedDateTime": "/Date(1614604981000)/", + "CapabilityStatus": "Deleted", + "Service": "SCO", + "ServicePlanId": "882e1d05-acd1-4ccb-8708-6ee03664b117" + } + ], + "Branding": { + "BackgroundColor": null, + "BackgroundImage": null, + "BackgroundImageRelativeUrl": null, + "BannerLogo": null, + "BannerLogoRelativeUrl": null, + "CdnList": null, + "CustomAccountResetCredentialsUrl": null, + "CustomCannotAccessYourAccountText": null, + "CustomCannotAccessYourAccountUrl": null, + "CustomCss": null, + "CustomCssRelativeUrl": null, + "CustomForgotMyPasswordText": null, + "CustomPrivacyAndCookiesText": null, + "CustomPrivacyAndCookiesUrl": null, + "CustomResetItNowText": null, + "CustomTermsOfUseText": null, + "CustomTermsOfUseUrl": null, + "Favicon": null, + "FaviconRelativeUrl": null, + "HeaderBackgroundColor": null, + "HeaderLogo": null, + "HeaderLogoRelativeUrl": null, + "Id": null, + "Localizations": null, + "LoginPageLayoutConfiguration": { + "IsFooterShown": null, + "IsHeaderShown": null, + "LayoutTemplateType": null + }, + "LoginPageTextVisibilitySettings": { + "HideAccountResetCredentials": null, + "HideCannotAccessYourAccount": null, + "HideForgotMyPassword": null, + "HidePrivacyAndCookies": null, + "HideResetItNow": null, + "HideTermsOfUse": null + }, + "SignInPageText": null, + "SquareLogo": null, + "SquareLogoDark": null, + "SquareLogoDarkRelativeUrl": null, + "SquareLogoRelativeUrl": null, + "UsernameHintText": null + }, + "BusinessPhones": ["2025782732"], + "CertificateBasedAuthConfiguration": null, + "CertificateConnectorSetting": { + "CertExpiryTime": null, + "ConnectorVersion": null, + "EnrollmentError": null, + "LastConnectorConnectionTime": null, + "LastUploadVersion": null, + "Status": null + }, + "City": "Washington", + "Country": null, + "CountryLetterCode": "US", + "CreatedDateTime": "/Date(1613679244000)/", + "DefaultUsageLocation": null, + "DeletedDateTime": null, + "DirectorySizeQuota": { + "Total": 300000, + "Used": 1041 + }, + "DisplayName": "Agency", + "Extensions": null, + "Id": "3c19c757-3b55-411f-b03f-2bcc514a598d", + "IsMultipleDataLocationsForServicesEnabled": null, + "MarketingNotificationEmails": [], + "MobileDeviceManagementAuthority": {}, + "OnPremisesLastSyncDateTime": "/Date(1661362185000)/", + "OnPremisesSyncEnabled": true, + "PartnerInformation": { + "CommerceUrl": null, + "CompanyName": null, + "CompanyType": null, + "HelpUrl": null, + "PartnerTenantId": null, + "SupportEmails": null, + "SupportTelephones": null, + "SupportUrl": null + }, + "PartnerTenantType": null, + "PostalCode": "20528-0380", + "PreferredLanguage": "en", + "PrivacyProfile": { + "ContactEmail": "", + "StatementUrl": "" + }, + "ProvisionedPlans": [ + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "Adallom" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "SCO" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "SharePoint" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "SharePoint" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "exchange" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "MicrosoftCommunicationsOnline" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "MicrosoftCommunicationsOnline" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "MicrosoftCommunicationsOnline" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "ProjectWorkManagement" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "Adallom" + }, + { + "CapabilityStatus": "Enabled", + "ProvisioningStatus": "Success", + "Service": "RMSOnline" + }, + { + "CapabilityStatus": "Deleted", + "ProvisioningStatus": "Success", + "Service": "SCO" + } + ], + "SecurityComplianceNotificationMails": [], + "SecurityComplianceNotificationPhones": [], + "Settings": { + "ContactInsights": { + "DisabledForGroup": null, + "Id": null, + "IsEnabledInOrganization": null + }, + "Id": null, + "ItemInsights": { + "DisabledForGroup": null, + "Id": null, + "IsEnabledInOrganization": null + }, + "MicrosoftApplicationDataAccess": { + "DisabledForGroup": null, + "Id": null, + "IsEnabledForAllMicrosoftApplications": null + }, + "PeopleInsights": { + "DisabledForGroup": null, + "Id": null, + "IsEnabledInOrganization": null + }, + "ProfileCardProperties": null, + "Pronouns": { + "Id": null, + "IsEnabledInOrganization": null + } + }, + "State": "DC", + "Street": "245 Murray Lane", + "TechnicalNotificationMails": ["someone@somewhere.org"], + "VerifiedDomains": [ + { + "Capabilities": "Email, OfficeCommunicationsOnline", + "IsDefault": true, + "IsInitial": true, + "Name": "someone.onmicrosoft.com", + "Type": "Managed" + }, + { + "Capabilities": "Email, Intune", + "IsDefault": false, + "IsInitial": false, + "Name": "dhs.agency.gov", + "Type": "Managed" + }, + { + "Capabilities": "None", + "IsDefault": false, + "IsInitial": false, + "Name": "mail.onmicrosoft.com", + "Type": "Managed" + }, + { + "Capabilities": "Email", + "IsDefault": false, + "IsInitial": false, + "Name": "test365.gov", + "Type": "Managed" + } + ], + "AdditionalProperties": { + "tenantType": "AAD", + "onPremisesSyncStatus": [ + "System.Collections.Generic.Dictionary`2[System.String,System.Object]" + ] + } + }, + "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", + "DisplayName": "Agency", + "DomainName": "onmicrosoft.com" } -], - "scuba_config": {}, + ], + "scuba_config": {}, - "conditional_access_policies": [ + "conditional_access_policies": [ { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - "372140e0-b3b7-4226-8ef9-d57986796201" - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - "8454f405-3b29-4102-b888-315c4e3de2d0" - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1618315427741)/", - "Description": null, - "DisplayName": "Live - MFA SHALL be required for all users", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "mfa" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "34afb953-929e-4c6e-aaac-a73cbd4b9535", - "ModifiedDateTime": "/Date(1682375279586)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1618315427741)/", + "Description": null, + "DisplayName": "Live - MFA SHALL be required for all users", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["mfa"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "34afb953-929e-4c6e-aaac-a73cbd4b9535", + "ModifiedDateTime": "/Date(1682375279586)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "exchangeActiveSync", - "browser", - "mobileAppsAndDesktopClients", - "other" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": [ - - ], - "IncludeLocations": [ - "19da112d-49e5-4699-9c8c-728a47d3016c" - ] - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - "7859e6b7-98b3-4c24-89a6-7281cda28be9" - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1618315592170)/", - "Description": null, - "DisplayName": "Block Logins External to USA", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "31cb4ff8-b286-4153-8e6b-b22ca73d3598", - "ModifiedDateTime": "/Date(1660589089368)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": [ + "exchangeActiveSync", + "browser", + "mobileAppsAndDesktopClients", + "other" + ], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": [], + "IncludeLocations": ["19da112d-49e5-4699-9c8c-728a47d3016c"] + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": ["7859e6b7-98b3-4c24-89a6-7281cda28be9"], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1618315592170)/", + "Description": null, + "DisplayName": "Block Logins External to USA", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "31cb4ff8-b286-4153-8e6b-b22ca73d3598", + "ModifiedDateTime": "/Date(1660589089368)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - "372140e0-b3b7-4226-8ef9-d57986796201" - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "exchangeActiveSync", - "other" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - "8454f405-3b29-4102-b888-315c4e3de2d0" - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1647463691992)/", - "Description": null, - "DisplayName": "Live - Legacy Authentication SHALL be Blocked", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "99037715-8b47-43a1-9c71-79e52a704944", - "ModifiedDateTime": "/Date(1682375421043)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["exchangeActiveSync", "other"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1647463691992)/", + "Description": null, + "DisplayName": "Live - Legacy Authentication SHALL be Blocked", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "99037715-8b47-43a1-9c71-79e52a704944", + "ModifiedDateTime": "/Date(1682375421043)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - "high" - ], - "Users": { - "ExcludeGroups": [ - "8454f405-3b29-4102-b888-315c4e3de2d0" - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1647474757009)/", - "Description": null, - "DisplayName": "Live - High Risk Users SHALL be Blocked", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "74669b8e-fa83-4af6-9141-e01ddcde8ee5", - "ModifiedDateTime": "/Date(1690835401844)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": ["high"], + "Users": { + "ExcludeGroups": ["8454f405-3b29-4102-b888-315c4e3de2d0"], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1647474757009)/", + "Description": null, + "DisplayName": "Live - High Risk Users SHALL be Blocked", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "74669b8e-fa83-4af6-9141-e01ddcde8ee5", + "ModifiedDateTime": "/Date(1690835401844)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - "high" - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1647480847516)/", - "Description": null, - "DisplayName": "Live - High Risk Sign-ins SHALL be Blocked", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "b00d17ed-efc7-4aaa-975e-fa59ee7b0436", - "ModifiedDateTime": "/Date(1685720218048)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": ["high"], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1647480847516)/", + "Description": null, + "DisplayName": "Live - High Risk Sign-ins SHALL be Blocked", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "b00d17ed-efc7-4aaa-975e-fa59ee7b0436", + "ModifiedDateTime": "/Date(1685720218048)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1647536088205)/", - "Description": null, - "DisplayName": "Live - Session Length SHALL be Limited", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": null, - "CustomAuthenticationFactors": null, - "Operator": null, - "TermsOfUse": null - }, - "Id": "e430772e-f1c9-4618-9b68-4f125e80a288", - "ModifiedDateTime": "/Date(1683901574815)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": "primaryAndSecondaryAuthentication", - "FrequencyInterval": "timeBased", - "IsEnabled": true, - "Type": "days", - "Value": 2 - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1647536088205)/", + "Description": null, + "DisplayName": "Live - Session Length SHALL be Limited", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": null, + "CustomAuthenticationFactors": null, + "Operator": null, + "TermsOfUse": null + }, + "Id": "e430772e-f1c9-4618-9b68-4f125e80a288", + "ModifiedDateTime": "/Date(1683901574815)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": "primaryAndSecondaryAuthentication", + "FrequencyInterval": "timeBased", + "IsEnabled": true, + "Type": "days", + "Value": 2 + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "All" - ] - } - }, - "CreatedDateTime": "/Date(1647536401180)/", - "Description": null, - "DisplayName": "Live - Browser Sessions SHALL NOT be Persistent", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": null, - "CustomAuthenticationFactors": null, - "Operator": null, - "TermsOfUse": null - }, - "Id": "75fd3dde-7974-4bbf-8912-19f36b9f054d", - "ModifiedDateTime": "/Date(1671042607797)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": true, - "Mode": "never" - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["All"] + } + }, + "CreatedDateTime": "/Date(1647536401180)/", + "Description": null, + "DisplayName": "Live - Browser Sessions SHALL NOT be Persistent", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": null, + "CustomAuthenticationFactors": null, + "Operator": null, + "TermsOfUse": null + }, + "Id": "75fd3dde-7974-4bbf-8912-19f36b9f054d", + "ModifiedDateTime": "/Date(1671042607797)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": true, + "Mode": "never" + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - "372140e0-b3b7-4226-8ef9-d57986796201" - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - "158c047a-c907-4556-b7ef-446551a6b5f7", - "62e90394-69f5-4237-9190-012177145e10", - "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", - "e8611ab8-c189-46e8-94e1-60213ab1f814", - "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "fe930be7-5e62-47db-91af-98c3a49a38b1", - "29232cdf-9323-42fd-ade2-1d097af3e4de", - "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", - "b0f54661-2d74-4c50-afa3-1ec803f12efe" - ], - "IncludeUsers": [ - - ] - } - }, - "CreatedDateTime": "/Date(1648513145374)/", - "Description": null, - "DisplayName": "Live - MFA SHALL be required for Highly Privileged Roles", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "mfa" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "d62b3de8-455f-42c4-a7f0-31479a7aa572", - "ModifiedDateTime": "/Date(1689451663458)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": ["372140e0-b3b7-4226-8ef9-d57986796201"], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [ + "158c047a-c907-4556-b7ef-446551a6b5f7", + "62e90394-69f5-4237-9190-012177145e10", + "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", + "e8611ab8-c189-46e8-94e1-60213ab1f814", + "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "fe930be7-5e62-47db-91af-98c3a49a38b1", + "29232cdf-9323-42fd-ade2-1d097af3e4de", + "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", + "b0f54661-2d74-4c50-afa3-1ec803f12efe" + ], + "IncludeUsers": [] + } + }, + "CreatedDateTime": "/Date(1648513145374)/", + "Description": null, + "DisplayName": "Live - MFA SHALL be required for Highly Privileged Roles", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["mfa"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "d62b3de8-455f-42c4-a7f0-31479a7aa572", + "ModifiedDateTime": "/Date(1689451663458)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": "include", - "Rule": "device.trustType -ne 'AzureAD' -and device.trustType -ne 'ServerAD' -and device.trustType -ne 'Workplace'" - }, - "ExcludeDeviceStates": [ - - ], - "ExcludeDevices": [ - - ], - "IncludeDeviceStates": [ - - ], - "IncludeDevices": [ - - ] - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "de77846f-88c8-4047-bb35-6e7ab962f0b3" - ] - } - }, - "CreatedDateTime": "/Date(1650498176328)/", - "Description": null, - "DisplayName": "TEST - Require Device Signal using conditions (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "ca4de023-3093-45d5-8111-667010f82a2b", - "ModifiedDateTime": "/Date(1654553933475)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": "include", + "Rule": "device.trustType -ne 'AzureAD' -and device.trustType -ne 'ServerAD' -and device.trustType -ne 'Workplace'" + }, + "ExcludeDeviceStates": [], + "ExcludeDevices": [], + "IncludeDeviceStates": [], + "IncludeDevices": [] + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] + } + }, + "CreatedDateTime": "/Date(1650498176328)/", + "Description": null, + "DisplayName": "TEST - Require Device Signal using conditions (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "ca4de023-3093-45d5-8111-667010f82a2b", + "ModifiedDateTime": "/Date(1654553933475)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "Office365" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "8da76570-8b48-44af-975b-4c377221735b", - "ab7a3155-6b08-4580-87d1-54c6e1e57cd1" - ] - } - }, - "CreatedDateTime": "/Date(1651243713386)/", - "Description": null, - "DisplayName": "TEST - Short session length test (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": null, - "CustomAuthenticationFactors": null, - "Operator": null, - "TermsOfUse": null - }, - "Id": "4c8e5e6e-7803-453e-966b-eea3e33843ef", - "ModifiedDateTime": "/Date(1654553471085)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": "primaryAndSecondaryAuthentication", - "FrequencyInterval": "timeBased", - "IsEnabled": true, - "Type": "hours", - "Value": 5 - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["Office365"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": [ + "8da76570-8b48-44af-975b-4c377221735b", + "ab7a3155-6b08-4580-87d1-54c6e1e57cd1" + ] + } + }, + "CreatedDateTime": "/Date(1651243713386)/", + "Description": null, + "DisplayName": "TEST - Short session length test (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": null, + "CustomAuthenticationFactors": null, + "Operator": null, + "TermsOfUse": null + }, + "Id": "4c8e5e6e-7803-453e-966b-eea3e33843ef", + "ModifiedDateTime": "/Date(1654553471085)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": "primaryAndSecondaryAuthentication", + "FrequencyInterval": "timeBased", + "IsEnabled": true, + "Type": "hours", + "Value": 5 + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "de77846f-88c8-4047-bb35-6e7ab962f0b3" - ] - } - }, - "CreatedDateTime": "/Date(1651265768738)/", - "Description": null, - "DisplayName": "Live - Managed Devices SHOULD be Required (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "compliantDevice", - "domainJoinedDevice" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "ff6e5e8c-8811-41a7-8514-ba4967723500", - "ModifiedDateTime": "/Date(1683818479065)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] + } + }, + "CreatedDateTime": "/Date(1651265768738)/", + "Description": null, + "DisplayName": "Live - Managed Devices SHOULD be Required (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "ff6e5e8c-8811-41a7-8514-ba4967723500", + "ModifiedDateTime": "/Date(1683818479065)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "None" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - "64720f66-b5cc-41ae-aec7-562f90038952" - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "7a22bd70-341c-4903-a014-d8cfd5c1d75f" - ] - } - }, - "CreatedDateTime": "/Date(1662149889905)/", - "Description": null, - "DisplayName": "LIVE - Auth Strength (Limited Users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": [ - "fido2", - "x509CertificateMultiFactor", - "temporaryAccessPassOneTime" - ], - "CombinationConfigurations": [ - - ], - "CreatedDateTime": "/Date(1662146338176)/", - "Description": "", - "DisplayName": "Auth Strength", - "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", - "ModifiedDateTime": "/Date(1662146338176)/", - "PolicyType": "custom", - "RequirementsSatisfied": "mfa" - }, - "BuiltInControls": [ - - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "7769140e-ec01-425d-a7c9-f4c602cf4ecb", - "ModifiedDateTime": "/Date(1662152126085)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["None"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": ["64720f66-b5cc-41ae-aec7-562f90038952"], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["7a22bd70-341c-4903-a014-d8cfd5c1d75f"] + } + }, + "CreatedDateTime": "/Date(1662149889905)/", + "Description": null, + "DisplayName": "LIVE - Auth Strength (Limited Users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": [ + "fido2", + "x509CertificateMultiFactor", + "temporaryAccessPassOneTime" + ], + "CombinationConfigurations": [], + "CreatedDateTime": "/Date(1662146338176)/", + "Description": "", + "DisplayName": "Auth Strength", + "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", + "ModifiedDateTime": "/Date(1662146338176)/", + "PolicyType": "custom", + "RequirementsSatisfied": "mfa" + }, + "BuiltInControls": [], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "7769140e-ec01-425d-a7c9-f4c602cf4ecb", + "ModifiedDateTime": "/Date(1662152126085)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "None" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - "cfb614c8-1563-4001-83c1-93611fac731e" - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - - ] - } - }, - "CreatedDateTime": "/Date(1679494674903)/", - "Description": null, - "DisplayName": "Report - Block CAP Exclusion Test Accounts", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "4b89dfbe-cb48-49f2-90d7-03c46bc7c9be", - "ModifiedDateTime": null, - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["None"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": ["cfb614c8-1563-4001-83c1-93611fac731e"], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": [] + } + }, + "CreatedDateTime": "/Date(1679494674903)/", + "Description": null, + "DisplayName": "Report - Block CAP Exclusion Test Accounts", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "4b89dfbe-cb48-49f2-90d7-03c46bc7c9be", + "ModifiedDateTime": null, + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - "urn:user:registersecurityinfo" - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": [ - "AllTrusted" - ], - "IncludeLocations": [ - "All" - ] - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "8da76570-8b48-44af-975b-4c377221735b" - ] - } - }, - "CreatedDateTime": "/Date(1682299483531)/", - "Description": null, - "DisplayName": "Live - MFA registration with temporary access pass (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "mfa" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "3cec5953-bbc0-4fa6-877b-b3b1c84a0813", - "ModifiedDateTime": "/Date(1682473922692)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": [], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": ["urn:user:registersecurityinfo"] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": ["AllTrusted"], + "IncludeLocations": ["All"] + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] + } + }, + "CreatedDateTime": "/Date(1682299483531)/", + "Description": null, + "DisplayName": "Live - MFA registration with temporary access pass (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["mfa"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "3cec5953-bbc0-4fa6-877b-b3b1c84a0813", + "ModifiedDateTime": "/Date(1682473922692)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - "urn:user:registersecurityinfo" - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": [ - "AllTrusted" - ], - "IncludeLocations": [ - "All" - ] - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "8da76570-8b48-44af-975b-4c377221735b" - ] - } - }, - "CreatedDateTime": "/Date(1682474221172)/", - "Description": null, - "DisplayName": "Live - MFA registration from Trusted Location only (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "block" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "76a7344f-e67a-4469-9ece-8969b249df87", - "ModifiedDateTime": null, - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": [], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": ["urn:user:registersecurityinfo"] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": ["AllTrusted"], + "IncludeLocations": ["All"] + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] + } + }, + "CreatedDateTime": "/Date(1682474221172)/", + "Description": null, + "DisplayName": "Live - MFA registration from Trusted Location only (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["block"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "76a7344f-e67a-4469-9ece-8969b249df87", + "ModifiedDateTime": null, + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - "urn:user:registersecurityinfo" - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": [ - "AllTrusted" - ], - "IncludeLocations": [ - "All" - ] - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "8da76570-8b48-44af-975b-4c377221735b" - ] - } - }, - "CreatedDateTime": "/Date(1682474402202)/", - "Description": null, - "DisplayName": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "compliantDevice", - "domainJoinedDevice" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "3ec71c28-aa3f-44f6-af9d-e64dd55c4d82", - "ModifiedDateTime": "/Date(1683818519800)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": [], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": ["urn:user:registersecurityinfo"] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": ["AllTrusted"], + "IncludeLocations": ["All"] + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["8da76570-8b48-44af-975b-4c377221735b"] + } + }, + "CreatedDateTime": "/Date(1682474402202)/", + "Description": null, + "DisplayName": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "3ec71c28-aa3f-44f6-af9d-e64dd55c4d82", + "ModifiedDateTime": "/Date(1683818519800)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - "urn:user:registerdevice" - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "42dd60ea-57e9-47ea-8a43-a213d36a9cb0" - ] - } - }, - "CreatedDateTime": "/Date(1682538128295)/", - "Description": null, - "DisplayName": "Live - Device registration requires MFA (limited users)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "mfa" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "3ad1e26d-8950-4376-8dd5-fd293389e3fa", - "ModifiedDateTime": "/Date(1683818557600)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": [], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": ["urn:user:registerdevice"] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["42dd60ea-57e9-47ea-8a43-a213d36a9cb0"] + } + }, + "CreatedDateTime": "/Date(1682538128295)/", + "Description": null, + "DisplayName": "Live - Device registration requires MFA (limited users)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["mfa"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "3ad1e26d-8950-4376-8dd5-fd293389e3fa", + "ModifiedDateTime": "/Date(1683818557600)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "cafc4ec1-f9e8-4718-942b-69e5b4c896e0" - ] - } - }, - "CreatedDateTime": "/Date(1683145214503)/", - "Description": null, - "DisplayName": "Live - Phishing Resistant MFA required (specific guest user)", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": [ - "fido2", - "x509CertificateMultiFactor", - "temporaryAccessPassOneTime" - ], - "CombinationConfigurations": [ - - ], - "CreatedDateTime": "/Date(1662146338176)/", - "Description": "", - "DisplayName": "Auth Strength", - "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", - "ModifiedDateTime": "/Date(1662146338176)/", - "PolicyType": "custom", - "RequirementsSatisfied": "mfa" - }, - "BuiltInControls": [ - - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "1966019a-244f-4e73-b502-49ddd0d2b868", - "ModifiedDateTime": "/Date(1683655324029)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["cafc4ec1-f9e8-4718-942b-69e5b4c896e0"] + } + }, + "CreatedDateTime": "/Date(1683145214503)/", + "Description": null, + "DisplayName": "Live - Phishing Resistant MFA required (specific guest user)", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": [ + "fido2", + "x509CertificateMultiFactor", + "temporaryAccessPassOneTime" + ], + "CombinationConfigurations": [], + "CreatedDateTime": "/Date(1662146338176)/", + "Description": "", + "DisplayName": "Auth Strength", + "Id": "a7a09591-49c1-4f33-bb37-76f0b6abf067", + "ModifiedDateTime": "/Date(1662146338176)/", + "PolicyType": "custom", + "RequirementsSatisfied": "mfa" + }, + "BuiltInControls": [], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "1966019a-244f-4e73-b502-49ddd0d2b868", + "ModifiedDateTime": "/Date(1683655324029)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - - ], - "IncludeApplications": [ - - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - "urn:user:registersecurityinfo" - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "de77846f-88c8-4047-bb35-6e7ab962f0b3" - ] - } - }, - "CreatedDateTime": "/Date(1687281553466)/", - "Description": null, - "DisplayName": "Ted Test - new registration", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": null, - "CombinationConfigurations": null, - "CreatedDateTime": null, - "Description": null, - "DisplayName": null, - "Id": null, - "ModifiedDateTime": null, - "PolicyType": null, - "RequirementsSatisfied": null - }, - "BuiltInControls": [ - "compliantDevice", - "domainJoinedDevice" - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "4fffab6f-b403-4d0c-bd7b-eac25b5cb9f5", - "ModifiedDateTime": null, - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabledForReportingButNotEnforced", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": [], + "IncludeApplications": [], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": ["urn:user:registersecurityinfo"] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["de77846f-88c8-4047-bb35-6e7ab962f0b3"] + } + }, + "CreatedDateTime": "/Date(1687281553466)/", + "Description": null, + "DisplayName": "Ted Test - new registration", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": null, + "CombinationConfigurations": null, + "CreatedDateTime": null, + "Description": null, + "DisplayName": null, + "Id": null, + "ModifiedDateTime": null, + "PolicyType": null, + "RequirementsSatisfied": null + }, + "BuiltInControls": ["compliantDevice", "domainJoinedDevice"], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "4fffab6f-b403-4d0c-bd7b-eac25b5cb9f5", + "ModifiedDateTime": null, + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabledForReportingButNotEnforced", + "AdditionalProperties": {} }, { - "Conditions": { - "Applications": { - "ApplicationFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeApplications": [ - "f5c26e74-f226-4ae8-85f0-b4af0080ac9e" - ], - "IncludeApplications": [ - "All" - ], - "IncludeAuthenticationContextClassReferences": [ - - ], - "IncludeUserActions": [ - - ] - }, - "ClientAppTypes": [ - "all" - ], - "ClientApplications": { - "ExcludeServicePrincipals": null, - "IncludeServicePrincipals": null, - "ServicePrincipalFilter": { - "Mode": null, - "Rule": null - } - }, - "DeviceStates": { - "ExcludeStates": null, - "IncludeStates": null - }, - "Devices": { - "DeviceFilter": { - "Mode": null, - "Rule": null - }, - "ExcludeDeviceStates": null, - "ExcludeDevices": null, - "IncludeDeviceStates": null, - "IncludeDevices": null - }, - "Locations": { - "ExcludeLocations": null, - "IncludeLocations": null - }, - "Platforms": { - "ExcludePlatforms": null, - "IncludePlatforms": null - }, - "ServicePrincipalRiskLevels": null, - "SignInRiskLevels": [ - - ], - "UserRiskLevels": [ - - ], - "Users": { - "ExcludeGroups": [ - - ], - "ExcludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "ExcludeRoles": [ - - ], - "ExcludeUsers": [ - - ], - "IncludeGroups": [ - - ], - "IncludeGuestsOrExternalUsers": { - "ExternalTenants": { - "MembershipKind": null - }, - "GuestOrExternalUserTypes": null - }, - "IncludeRoles": [ - - ], - "IncludeUsers": [ - "d5dd1c3a-c7d2-4f3e-b1cc-333df6c75aa0" - ] - } - }, - "CreatedDateTime": "/Date(1689075728658)/", - "Description": null, - "DisplayName": "Phishing Resistant MFA Test Policy", - "GrantControls": { - "AuthenticationStrength": { - "AllowedCombinations": [ - "windowsHelloForBusiness", - "fido2", - "x509CertificateMultiFactor" - ], - "CombinationConfigurations": [ - - ], - "CreatedDateTime": "/Date(1638345600000)/", - "Description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key", - "DisplayName": "Phishing-resistant MFA", - "Id": "00000000-0000-0000-0000-000000000004", - "ModifiedDateTime": "/Date(1638345600000)/", - "PolicyType": "builtIn", - "RequirementsSatisfied": "mfa" - }, - "BuiltInControls": [ - - ], - "CustomAuthenticationFactors": [ - - ], - "Operator": "OR", - "TermsOfUse": [ - - ] - }, - "Id": "4b5931e7-8b8a-419f-bc2f-c50f2459d198", - "ModifiedDateTime": "/Date(1689077524047)/", - "SessionControls": { - "ApplicationEnforcedRestrictions": { - "IsEnabled": null - }, - "CloudAppSecurity": { - "CloudAppSecurityType": null, - "IsEnabled": null - }, - "ContinuousAccessEvaluation": { - "Mode": null - }, - "DisableResilienceDefaults": null, - "PersistentBrowser": { - "IsEnabled": null, - "Mode": null - }, - "SecureSignInSession": { - "IsEnabled": null - }, - "SignInFrequency": { - "AuthenticationType": null, - "FrequencyInterval": null, - "IsEnabled": null, - "Type": null, - "Value": null - } - }, - "State": "enabled", - "AdditionalProperties": { - - } + "Conditions": { + "Applications": { + "ApplicationFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeApplications": ["f5c26e74-f226-4ae8-85f0-b4af0080ac9e"], + "IncludeApplications": ["All"], + "IncludeAuthenticationContextClassReferences": [], + "IncludeUserActions": [] + }, + "ClientAppTypes": ["all"], + "ClientApplications": { + "ExcludeServicePrincipals": null, + "IncludeServicePrincipals": null, + "ServicePrincipalFilter": { + "Mode": null, + "Rule": null + } + }, + "DeviceStates": { + "ExcludeStates": null, + "IncludeStates": null + }, + "Devices": { + "DeviceFilter": { + "Mode": null, + "Rule": null + }, + "ExcludeDeviceStates": null, + "ExcludeDevices": null, + "IncludeDeviceStates": null, + "IncludeDevices": null + }, + "Locations": { + "ExcludeLocations": null, + "IncludeLocations": null + }, + "Platforms": { + "ExcludePlatforms": null, + "IncludePlatforms": null + }, + "ServicePrincipalRiskLevels": null, + "SignInRiskLevels": [], + "UserRiskLevels": [], + "Users": { + "ExcludeGroups": [], + "ExcludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "ExcludeRoles": [], + "ExcludeUsers": [], + "IncludeGroups": [], + "IncludeGuestsOrExternalUsers": { + "ExternalTenants": { + "MembershipKind": null + }, + "GuestOrExternalUserTypes": null + }, + "IncludeRoles": [], + "IncludeUsers": ["d5dd1c3a-c7d2-4f3e-b1cc-333df6c75aa0"] + } + }, + "CreatedDateTime": "/Date(1689075728658)/", + "Description": null, + "DisplayName": "Phishing Resistant MFA Test Policy", + "GrantControls": { + "AuthenticationStrength": { + "AllowedCombinations": [ + "windowsHelloForBusiness", + "fido2", + "x509CertificateMultiFactor" + ], + "CombinationConfigurations": [], + "CreatedDateTime": "/Date(1638345600000)/", + "Description": "Phishing-resistant, Passwordless methods for the strongest authentication, such as a FIDO2 security key", + "DisplayName": "Phishing-resistant MFA", + "Id": "00000000-0000-0000-0000-000000000004", + "ModifiedDateTime": "/Date(1638345600000)/", + "PolicyType": "builtIn", + "RequirementsSatisfied": "mfa" + }, + "BuiltInControls": [], + "CustomAuthenticationFactors": [], + "Operator": "OR", + "TermsOfUse": [] + }, + "Id": "4b5931e7-8b8a-419f-bc2f-c50f2459d198", + "ModifiedDateTime": "/Date(1689077524047)/", + "SessionControls": { + "ApplicationEnforcedRestrictions": { + "IsEnabled": null + }, + "CloudAppSecurity": { + "CloudAppSecurityType": null, + "IsEnabled": null + }, + "ContinuousAccessEvaluation": { + "Mode": null + }, + "DisableResilienceDefaults": null, + "PersistentBrowser": { + "IsEnabled": null, + "Mode": null + }, + "SecureSignInSession": { + "IsEnabled": null + }, + "SignInFrequency": { + "AuthenticationType": null, + "FrequencyInterval": null, + "IsEnabled": null, + "Type": null, + "Value": null + } + }, + "State": "enabled", + "AdditionalProperties": {} } -], - "cap_table_data": [ + ], + "cap_table_data": [ { - "Name": "Live - MFA SHALL be required for all users", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: 1 specific group" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: 1 specific app" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require multifactor authentication", - "Session Controls": [ - "None" - ] + "Name": "Live - MFA SHALL be required for all users", + "State": "On", + "Users": ["Users included: All", "Users excluded: 1 specific group"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: 1 specific app" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require multifactor authentication", + "Session Controls": ["None"] }, { - "Name": "Block Logins External to USA", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: 1 specific group" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Locations included: 1 specific location", - "Locations excluded: none", - "Client apps included: Exchange ActiveSync Clients, Browser, Mobile apps and desktop clients, Other clients" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Block Logins External to USA", + "State": "On", + "Users": ["Users included: All", "Users excluded: 1 specific group"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": [ + "Locations included: 1 specific location", + "Locations excluded: none", + "Client apps included: Exchange ActiveSync Clients, Browser, Mobile apps and desktop clients, Other clients" + ], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - Legacy Authentication SHALL be Blocked", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: 1 specific group" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: 1 specific app" - ], - "Conditions": [ - "Client apps included: Exchange ActiveSync Clients, Other clients" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Live - Legacy Authentication SHALL be Blocked", + "State": "On", + "Users": ["Users included: All", "Users excluded: 1 specific group"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: 1 specific app" + ], + "Conditions": [ + "Client apps included: Exchange ActiveSync Clients, Other clients" + ], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - High Risk Users SHALL be Blocked", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: 1 specific group" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "User risk levels: high", - "Client apps included: all" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Live - High Risk Users SHALL be Blocked", + "State": "On", + "Users": ["Users included: All", "Users excluded: 1 specific group"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["User risk levels: high", "Client apps included: all"], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - High Risk Sign-ins SHALL be Blocked", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Sign-in risk levels: high", - "Client apps included: all" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Live - High Risk Sign-ins SHALL be Blocked", + "State": "On", + "Users": ["Users included: All", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["Sign-in risk levels: high", "Client apps included: all"], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - Session Length SHALL be Limited", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "None", - "Session Controls": [ - "Sign-in frequency (every 2 days)" - ] + "Name": "Live - Session Length SHALL be Limited", + "State": "On", + "Users": ["Users included: All", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "None", + "Session Controls": ["Sign-in frequency (every 2 days)"] }, { - "Name": "Live - Browser Sessions SHALL NOT be Persistent", - "State": "On", - "Users": [ - "Users included: All", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "None", - "Session Controls": [ - "Persistent browser session (never persistent)" - ] + "Name": "Live - Browser Sessions SHALL NOT be Persistent", + "State": "On", + "Users": ["Users included: All", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "None", + "Session Controls": ["Persistent browser session (never persistent)"] }, { - "Name": "Live - MFA SHALL be required for Highly Privileged Roles", - "State": "On", - "Users": [ - "Users included: 9 specific roles", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: 1 specific app" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require multifactor authentication", - "Session Controls": [ - "None" - ] + "Name": "Live - MFA SHALL be required for Highly Privileged Roles", + "State": "On", + "Users": ["Users included: 9 specific roles", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: 1 specific app" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require multifactor authentication", + "Session Controls": ["None"] }, { - "Name": "TEST - Require Device Signal using conditions (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all", - "Custom device filter in include mode active" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "TEST - Require Device Signal using conditions (limited users)", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": [ + "Client apps included: all", + "Custom device filter in include mode active" + ], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "TEST - Short session length test (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 2 specific users", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: 1 specific app", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "None", - "Session Controls": [ - "Sign-in frequency (every 5 hours)" - ] + "Name": "TEST - Short session length test (limited users)", + "State": "Report-only", + "Users": ["Users included: 2 specific users", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: 1 specific app", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "None", + "Session Controls": ["Sign-in frequency (every 5 hours)"] }, { - "Name": "Live - Managed Devices SHOULD be Required (limited users)", - "State": "On", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", - "Session Controls": [ - "None" - ] + "Name": "Live - Managed Devices SHOULD be Required (limited users)", + "State": "On", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", + "Session Controls": ["None"] }, { - "Name": "LIVE - Auth Strength (Limited Users)", - "State": "On", - "Users": [ - "Users included: 1 specific user, 1 specific group", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: None", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", - "Session Controls": [ - "None" - ] + "Name": "LIVE - Auth Strength (Limited Users)", + "State": "On", + "Users": [ + "Users included: 1 specific user, 1 specific group", + "Users excluded: None" + ], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: None", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", + "Session Controls": ["None"] }, { - "Name": "Report - Block CAP Exclusion Test Accounts", - "State": "Report-only", - "Users": [ - "Users included: 1 specific group", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: None", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Report - Block CAP Exclusion Test Accounts", + "State": "Report-only", + "Users": ["Users included: 1 specific group", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: None", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - MFA registration with temporary access pass (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: actions", - "User action: Register security info" - ], - "Conditions": [ - "Locations included: all locations", - "Locations excluded: all trusted locations", - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require multifactor authentication", - "Session Controls": [ - "None" - ] + "Name": "Live - MFA registration with temporary access pass (limited users)", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: actions", + "User action: Register security info" + ], + "Conditions": [ + "Locations included: all locations", + "Locations excluded: all trusted locations", + "Client apps included: all" + ], + "Block/Grant Access": "Allow access but require multifactor authentication", + "Session Controls": ["None"] }, { - "Name": "Live - MFA registration from Trusted Location only (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: actions", - "User action: Register security info" - ], - "Conditions": [ - "Locations included: all locations", - "Locations excluded: all trusted locations", - "Client apps included: all" - ], - "Block/Grant Access": "Block access", - "Session Controls": [ - "None" - ] + "Name": "Live - MFA registration from Trusted Location only (limited users)", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: actions", + "User action: Register security info" + ], + "Conditions": [ + "Locations included: all locations", + "Locations excluded: all trusted locations", + "Client apps included: all" + ], + "Block/Grant Access": "Block access", + "Session Controls": ["None"] }, { - "Name": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: actions", - "User action: Register security info" - ], - "Conditions": [ - "Locations included: all locations", - "Locations excluded: all trusted locations", - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", - "Session Controls": [ - "None" - ] + "Name": "Live - MFA registration from Managed Device or Trusted Location only (limited users)", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: actions", + "User action: Register security info" + ], + "Conditions": [ + "Locations included: all locations", + "Locations excluded: all trusted locations", + "Client apps included: all" + ], + "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", + "Session Controls": ["None"] }, { - "Name": "Live - Device registration requires MFA (limited users)", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: actions", - "User action: Register or join devices" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require multifactor authentication", - "Session Controls": [ - "None" - ] + "Name": "Live - Device registration requires MFA (limited users)", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: actions", + "User action: Register or join devices" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require multifactor authentication", + "Session Controls": ["None"] }, { - "Name": "Live - Phishing Resistant MFA required (specific guest user)", - "State": "On", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: None" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", - "Session Controls": [ - "None" - ] + "Name": "Live - Phishing Resistant MFA required (specific guest user)", + "State": "On", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: None" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require authentication strength (Auth Strength)", + "Session Controls": ["None"] }, { - "Name": "Ted Test - new registration", - "State": "Report-only", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: actions", - "User action: Register security info" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", - "Session Controls": [ - "None" - ] + "Name": "Ted Test - new registration", + "State": "Report-only", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: actions", + "User action: Register security info" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require device to be marked compliant, OR Hybrid Azure AD joined device", + "Session Controls": ["None"] }, { - "Name": "Phishing Resistant MFA Test Policy", - "State": "On", - "Users": [ - "Users included: 1 specific user", - "Users excluded: None" - ], - "Apps/Actions": [ - "Policy applies to: apps", - "Apps included: All", - "Apps excluded: 1 specific app" - ], - "Conditions": [ - "Client apps included: all" - ], - "Block/Grant Access": "Allow access but require authentication strength (Phishing-resistant MFA)", - "Session Controls": [ - "None" - ] + "Name": "Phishing Resistant MFA Test Policy", + "State": "On", + "Users": ["Users included: 1 specific user", "Users excluded: None"], + "Apps/Actions": [ + "Policy applies to: apps", + "Apps included: All", + "Apps excluded: 1 specific app" + ], + "Conditions": ["Client apps included: all"], + "Block/Grant Access": "Allow access but require authentication strength (Phishing-resistant MFA)", + "Session Controls": ["None"] } -], - "authorization_policies": [ + ], + "authorization_policies": [ { - "AllowEmailVerifiedUsersToJoinOrganization": true, - "AllowInvitesFrom": "adminsAndGuestInviters", - "AllowUserConsentForRiskyApps": false, - "AllowedToSignUpEmailBasedSubscriptions": true, - "AllowedToUseSspr": true, - "BlockMsolPowerShell": false, - "DefaultUserRoleOverrides": null, - "DefaultUserRolePermissions": { - "AllowedToCreateApps": false, - "AllowedToCreateSecurityGroups": true, - "AllowedToCreateTenants": true, - "AllowedToReadBitlockerKeysForOwnedDevice": true, - "AllowedToReadOtherUsers": true - }, - "DeletedDateTime": null, - "Description": "Used to manage authorization related settings across the company.", - "DisplayName": "Authorization Policy", - "EnabledPreviewFeatures": [ - - ], - "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", - "Id": "authorizationPolicy", - "PermissionGrantPolicyIdsAssignedToDefaultUserRole": [ - - ] + "AllowEmailVerifiedUsersToJoinOrganization": true, + "AllowInvitesFrom": "adminsAndGuestInviters", + "AllowUserConsentForRiskyApps": false, + "AllowedToSignUpEmailBasedSubscriptions": true, + "AllowedToUseSspr": true, + "BlockMsolPowerShell": false, + "DefaultUserRoleOverrides": null, + "DefaultUserRolePermissions": { + "AllowedToCreateApps": false, + "AllowedToCreateSecurityGroups": true, + "AllowedToCreateTenants": true, + "AllowedToReadBitlockerKeysForOwnedDevice": true, + "AllowedToReadOtherUsers": true + }, + "DeletedDateTime": null, + "Description": "Used to manage authorization related settings across the company.", + "DisplayName": "Authorization Policy", + "EnabledPreviewFeatures": [], + "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", + "Id": "authorizationPolicy", + "PermissionGrantPolicyIdsAssignedToDefaultUserRole": [] } -], - "secure_score": [ + ], + "secure_score": [ { - "ControlCategory": "Identity", - "ControlName": "RoleOverlap", - "Description": "Ensure that your administrators can accomplish their work with the least amount of privilege assigned to their account. Assigning users roles like Password Administrator or Exchange Online Administrator, instead of Global Administrator, reduces the likelihood of a global administrative privileged account being breached.", - "Score": 1, - "AdditionalProperties": { - "lastSynced": "2023-08-20T09:14:13Z", - "IsApplicable": "true", - "source": "ingestion", - "scoreInPercentage": 100, - "count": "138", - "implementationStatus": "You have 138 users with least privileged administrative roles." - } + "ControlCategory": "Identity", + "ControlName": "RoleOverlap", + "Description": "Ensure that your administrators can accomplish their work with the least amount of privilege assigned to their account. Assigning users roles like Password Administrator or Exchange Online Administrator, instead of Global Administrator, reduces the likelihood of a global administrative privileged account being breached.", + "Score": 1, + "AdditionalProperties": { + "lastSynced": "2023-08-20T09:14:13Z", + "IsApplicable": "true", + "source": "ingestion", + "scoreInPercentage": 100, + "count": "138", + "implementationStatus": "You have 138 users with least privileged administrative roles." + } } -], - "admin_consent_policies": [ + ], + "admin_consent_policies": [ { - "Id": null, - "IsEnabled": true, - "NotifyReviewers": true, - "RemindersEnabled": true, - "RequestDurationInDays": 30, - "Reviewers": [ - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAccessReviewReviewerScope1" - ], - "Version": 0 + "Id": null, + "IsEnabled": true, + "NotifyReviewers": true, + "RemindersEnabled": true, + "RequestDurationInDays": 30, + "Reviewers": [ + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAccessReviewReviewerScope1" + ], + "Version": 0 + } + ], + "privileged_users": { + "8877d3ff-2f13-46d4-9458-4cdd497befd1": { + "DisplayName": "Dylan Gao - CTR", + "roles": [ + "Exchange Administrator", + "Exchange Administrator", + "SharePoint Administrator", + "Exchange Administrator" + ], + "OnPremisesImmutableId": null + }, + "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5": { + "DisplayName": "Isabella Magallanez", + "roles": ["SharePoint Administrator"], + "OnPremisesImmutableId": null + }, + "d2a550c7-f329-466b-8dfa-c388b65f1a49": { + "DisplayName": "Roger Mamika", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": "Rogeronpremuser" + }, + "cef8eedb-64d5-48b2-a3e4-b7bda6b7b129": { + "DisplayName": "Victor Echeverria - CTR", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "bc6696a2-e821-4d35-80ad-90b981a35f1b": { + "DisplayName": "Luke Skywalker 2", + "roles": ["Privileged Role Administrator", "User Administrator"], + "OnPremisesImmutableId": null + }, + "21cc87be-6f7b-4bc3-885f-7371e61f4df2": { + "DisplayName": "testScubaUser", + "roles": ["SharePoint Administrator"], + "OnPremisesImmutableId": null + }, + "38035edd-63a1-4c08-8bd2-ad78d0624057": { + "DisplayName": "Shanti Satyapal", + "roles": [ + "Exchange Administrator", + "SharePoint Administrator", + "Global Administrator" + ], + "OnPremisesImmutableId": null + }, + "2ed0157c-eeb6-456d-a1b1-9e11e403b39b": { + "DisplayName": "David Bui - CTR", + "roles": [ + "Exchange Administrator", + "SharePoint Administrator", + "Global Administrator", + "User Administrator" + ], + "OnPremisesImmutableId": null + }, + "d569d130-9206-4c7c-9534-65a8afdc7fac": { + "DisplayName": "Julian Burgos", + "roles": ["SharePoint Administrator"], + "OnPremisesImmutableId": null + }, + "6066af10-d921-4de6-9ae4-7f01057ec372": { + "DisplayName": "Grant Dasher - GOV - AZ", + "roles": [ + "Exchange Administrator", + "Cloud Application Administrator", + "Application Administrator", + "Privileged Role Administrator", + "Privileged Role Administrator", + "Exchange Administrator", + "Cloud Application Administrator", + "SharePoint Administrator", + "Global Administrator" + ], + "OnPremisesImmutableId": "GrantDasherAZonpremuser" + }, + "f2ac2257-956e-4892-8ced-ec29a4198321": { + "DisplayName": "Troy Stevens - CTR - AZ", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "42dd60ea-57e9-47ea-8a43-a213d36a9cb0": { + "DisplayName": "Theodore Kolovos - CTR - AZ", + "roles": [ + "Privileged Role Administrator", + "Exchange Administrator", + "Global Administrator", + "Exchange Administrator", + "User Administrator" + ], + "OnPremisesImmutableId": "Kolovosonpremuser" + }, + "b07f5e5b-1f08-43ce-a501-c6da20248cc0": { + "DisplayName": "Luke Skywalker", + "roles": ["Privileged Role Administrator", "User Administrator"], + "OnPremisesImmutableId": null + }, + "0bdffa70-6120-4c17-9ed8-fc6f2332a149": { + "DisplayName": "Obi Kenobi", + "roles": ["Privileged Role Administrator"], + "OnPremisesImmutableId": null + }, + "6b416798-87b2-4d8b-9d27-543e9608ccb6": { + "DisplayName": "Jacob Davis - CTR", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "da9423ea-16dc-4139-a58a-1cc8564191e0": { + "DisplayName": "Darth Vader", + "roles": ["Exchange Administrator", "Exchange Administrator"], + "OnPremisesImmutableId": null + }, + "c8975770-8c3d-43ef-8466-678584a32de5": { + "DisplayName": "Nanda Katikaneni - CTR", + "roles": [ + "Exchange Administrator", + "Global Administrator", + "Global Administrator" + ], + "OnPremisesImmutableId": null + }, + "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1": { + "DisplayName": "Jonathon Evangelista - CTR", + "roles": [ + "Exchange Administrator", + "SharePoint Administrator", + "User Administrator" + ], + "OnPremisesImmutableId": null + }, + "947f8599-ed00-4cff-b8ea-a925c47a2fdf": { + "DisplayName": "Addam Schroll", + "roles": [ + "Exchange Administrator", + "Global Administrator", + "Exchange Administrator" + ], + "OnPremisesImmutableId": null + }, + "ae71e61c-f465-4db6-8d26-5f3e52bdd800": { + "DisplayName": "Alden Hilton - CTR", + "roles": [ + "Exchange Administrator", + "SharePoint Administrator", + "Global Administrator", + "User Administrator", + "Global Administrator" + ], + "OnPremisesImmutableId": null + }, + "7b36d094-0211-400b-aabd-3793e9a30fc6": { + "DisplayName": "Elijah Agbayani - CTR", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "40c0354d-f1c4-4dc8-8b58-f8aeaa8ebeb0": { + "DisplayName": "Prashanth Narayanan - CTR -AZ", + "roles": ["SharePoint Administrator"], + "OnPremisesImmutableId": null + }, + "cc7a31ab-d2b5-446a-baf9-84f97c706403": { + "DisplayName": "Grant Brown - CTR", + "roles": [ + "Exchange Administrator", + "User Administrator", + "SharePoint Administrator", + "Global Administrator" + ], + "OnPremisesImmutableId": "Grantbrownonpremuser" + }, + "2a8adc58-b7c5-4086-a5cc-244b8df40ce8": { + "DisplayName": "Alex Marti - CTR", + "roles": [ + "Exchange Administrator", + "User Administrator", + "SharePoint Administrator" + ], + "OnPremisesImmutableId": "Alexonpremuser" + }, + "33694aa1-17fe-456d-aa56-0a0bfa1285f1": { + "DisplayName": "Richard Crutchfield", + "roles": [ + "Exchange Administrator", + "SharePoint Administrator", + "Cloud Application Administrator" + ], + "OnPremisesImmutableId": null + }, + "1d2f3021-e930-4b2e-ac3a-ee42f14ec4a4": { + "DisplayName": "Richard Mangual", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "54be13e7-3e6b-4e7f-ab1a-e2fce369d7af": { + "DisplayName": "David Evensky - CTR", + "roles": ["Global Administrator"], + "OnPremisesImmutableId": null + }, + "2fd16b6b-d91f-45e6-b56c-47a222c43386": { + "DisplayName": "Thomas Comeau - CTR - AZ", + "roles": [ + "Cloud Application Administrator", + "Application Administrator", + "Hybrid Identity Administrator" + ], + "OnPremisesImmutableId": null + }, + "d7706382-362d-44ff-b056-7a1d908882c3": { + "DisplayName": "Padme Amidala", + "roles": [ + "Exchange Administrator", + "Exchange Administrator", + "SharePoint Administrator" + ], + "OnPremisesImmutableId": null + }, + "e54ac846-1f5a-4afe-aa69-273b42c3b0c1": { + "DisplayName": "Jake Hamzawi - CTR", + "roles": ["Application Administrator"], + "OnPremisesImmutableId": null } -], - "privileged_users": { - "8877d3ff-2f13-46d4-9458-4cdd497befd1": { - "DisplayName": "Dylan Gao - CTR", - "roles": [ - "Exchange Administrator", - "Exchange Administrator", - "SharePoint Administrator", - "Exchange Administrator" - ], - "OnPremisesImmutableId": null - }, - "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5": { - "DisplayName": "Isabella Magallanez", - "roles": [ - "SharePoint Administrator" - ], - "OnPremisesImmutableId": null - }, - "d2a550c7-f329-466b-8dfa-c388b65f1a49": { - "DisplayName": "Roger Mamika", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": "Rogeronpremuser" - }, - "cef8eedb-64d5-48b2-a3e4-b7bda6b7b129": { - "DisplayName": "Victor Echeverria - CTR", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "bc6696a2-e821-4d35-80ad-90b981a35f1b": { - "DisplayName": "Luke Skywalker 2", - "roles": [ - "Privileged Role Administrator", - "User Administrator" - ], - "OnPremisesImmutableId": null - }, - "21cc87be-6f7b-4bc3-885f-7371e61f4df2": { - "DisplayName": "testScubaUser", - "roles": [ - "SharePoint Administrator" - ], - "OnPremisesImmutableId": null - }, - "38035edd-63a1-4c08-8bd2-ad78d0624057": { - "DisplayName": "Shanti Satyapal", - "roles": [ - "Exchange Administrator", - "SharePoint Administrator", - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "2ed0157c-eeb6-456d-a1b1-9e11e403b39b": { - "DisplayName": "David Bui - CTR", - "roles": [ - "Exchange Administrator", - "SharePoint Administrator", - "Global Administrator", - "User Administrator" - ], - "OnPremisesImmutableId": null - }, - "d569d130-9206-4c7c-9534-65a8afdc7fac": { - "DisplayName": "Julian Burgos", - "roles": [ - "SharePoint Administrator" - ], - "OnPremisesImmutableId": null - }, - "6066af10-d921-4de6-9ae4-7f01057ec372": { - "DisplayName": "Grant Dasher - GOV - AZ", - "roles": [ - "Exchange Administrator", - "Cloud Application Administrator", - "Application Administrator", - "Privileged Role Administrator", - "Privileged Role Administrator", - "Exchange Administrator", - "Cloud Application Administrator", - "SharePoint Administrator", - "Global Administrator" - ], - "OnPremisesImmutableId": "GrantDasherAZonpremuser" - }, - "f2ac2257-956e-4892-8ced-ec29a4198321": { - "DisplayName": "Troy Stevens - CTR - AZ", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "42dd60ea-57e9-47ea-8a43-a213d36a9cb0": { - "DisplayName": "Theodore Kolovos - CTR - AZ", - "roles": [ - "Privileged Role Administrator", - "Exchange Administrator", - "Global Administrator", - "Exchange Administrator", - "User Administrator" - ], - "OnPremisesImmutableId": "Kolovosonpremuser" - }, - "b07f5e5b-1f08-43ce-a501-c6da20248cc0": { - "DisplayName": "Luke Skywalker", - "roles": [ - "Privileged Role Administrator", - "User Administrator" - ], - "OnPremisesImmutableId": null - }, - "0bdffa70-6120-4c17-9ed8-fc6f2332a149": { - "DisplayName": "Obi Kenobi", - "roles": [ - "Privileged Role Administrator" - ], - "OnPremisesImmutableId": null - }, - "6b416798-87b2-4d8b-9d27-543e9608ccb6": { - "DisplayName": "Jacob Davis - CTR", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "da9423ea-16dc-4139-a58a-1cc8564191e0": { - "DisplayName": "Darth Vader", - "roles": [ - "Exchange Administrator", - "Exchange Administrator" - ], - "OnPremisesImmutableId": null - }, - "c8975770-8c3d-43ef-8466-678584a32de5": { - "DisplayName": "Nanda Katikaneni - CTR", - "roles": [ - "Exchange Administrator", - "Global Administrator", - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1": { - "DisplayName": "Jonathon Evangelista - CTR", - "roles": [ - "Exchange Administrator", - "SharePoint Administrator", - "User Administrator" - ], - "OnPremisesImmutableId": null - }, - "947f8599-ed00-4cff-b8ea-a925c47a2fdf": { - "DisplayName": "Addam Schroll", - "roles": [ - "Exchange Administrator", - "Global Administrator", - "Exchange Administrator" - ], - "OnPremisesImmutableId": null - }, - "ae71e61c-f465-4db6-8d26-5f3e52bdd800": { - "DisplayName": "Alden Hilton - CTR", - "roles": [ - "Exchange Administrator", - "SharePoint Administrator", - "Global Administrator", - "User Administrator", - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "7b36d094-0211-400b-aabd-3793e9a30fc6": { - "DisplayName": "Elijah Agbayani - CTR", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "40c0354d-f1c4-4dc8-8b58-f8aeaa8ebeb0": { - "DisplayName": "Prashanth Narayanan - CTR -AZ", - "roles": [ - "SharePoint Administrator" - ], - "OnPremisesImmutableId": null - }, - "cc7a31ab-d2b5-446a-baf9-84f97c706403": { - "DisplayName": "Grant Brown - CTR", - "roles": [ - "Exchange Administrator", - "User Administrator", - "SharePoint Administrator", - "Global Administrator" - ], - "OnPremisesImmutableId": "Grantbrownonpremuser" - }, - "2a8adc58-b7c5-4086-a5cc-244b8df40ce8": { - "DisplayName": "Alex Marti - CTR", - "roles": [ - "Exchange Administrator", - "User Administrator", - "SharePoint Administrator" - ], - "OnPremisesImmutableId": "Alexonpremuser" - }, - "33694aa1-17fe-456d-aa56-0a0bfa1285f1": { - "DisplayName": "Richard Crutchfield", - "roles": [ - "Exchange Administrator", - "SharePoint Administrator", - "Cloud Application Administrator" - ], - "OnPremisesImmutableId": null - }, - "1d2f3021-e930-4b2e-ac3a-ee42f14ec4a4": { - "DisplayName": "Richard Mangual", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "54be13e7-3e6b-4e7f-ab1a-e2fce369d7af": { - "DisplayName": "David Evensky - CTR", - "roles": [ - "Global Administrator" - ], - "OnPremisesImmutableId": null - }, - "2fd16b6b-d91f-45e6-b56c-47a222c43386": { - "DisplayName": "Thomas Comeau - CTR - AZ", - "roles": [ - "Cloud Application Administrator", - "Application Administrator", - "Hybrid Identity Administrator" - ], - "OnPremisesImmutableId": null - }, - "d7706382-362d-44ff-b056-7a1d908882c3": { - "DisplayName": "Padme Amidala", - "roles": [ - "Exchange Administrator", - "Exchange Administrator", - "SharePoint Administrator" - ], - "OnPremisesImmutableId": null - }, - "e54ac846-1f5a-4afe-aa69-273b42c3b0c1": { - "DisplayName": "Jake Hamzawi - CTR", - "roles": [ - "Application Administrator" - ], - "OnPremisesImmutableId": null - } -}, - "privileged_roles": [ + }, + "privileged_roles": [ { - "DisplayName": "Global Administrator", - "RoleTemplateId": "62e90394-69f5-4237-9190-012177145e10", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P15D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P1D" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": true, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - { - "@odata.type": "#microsoft.graph.singleUser", - "isBackup": false, - "id": "6066af10-d921-4de6-9ae4-7f01057ec372", - "description": "grant dasher - gov - az" - }, - { - "@odata.type": "#microsoft.graph.singleUser", - "isBackup": false, - "id": "f2ac2257-956e-4892-8ced-ec29a4198321", - "description": "troy stevens - ctr - az" - } - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } + "DisplayName": "Global Administrator", + "RoleTemplateId": "62e90394-69f5-4237-9190-012177145e10", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P15D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P1D" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": true, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [ + { + "@odata.type": "#microsoft.graph.singleUser", + "isBackup": false, + "id": "6066af10-d921-4de6-9ae4-7f01057ec372", + "description": "grant dasher - gov - az" + }, + { + "@odata.type": "#microsoft.graph.singleUser", + "isBackup": false, + "id": "f2ac2257-956e-4892-8ced-ec29a4198321", + "description": "troy stevens - ctr - az" + } ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "6b416798-87b2-4d8b-9d27-543e9608ccb6", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "947f8599-ed00-4cff-b8ea-a925c47a2fdf", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", - "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", - "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", - "RoleAssignmentScheduleId": "4616f5af-97e5-4849-b8a0-aa1111cee134", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", - "StartDateTime": "/Date(1647533824543)/", - "AdditionalProperties": { - - } - } - ] + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEBzmca5l9LZNjSZfPlK92AA-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHBXl8g9jO9DhGZnhYSjLeU-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEHwV0C627m1FobGeEeQDs5s-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "6b416798-87b2-4d8b-9d27-543e9608ccb6", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJhnQWuyh4tNnSdUPpYIzLY-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "947f8599-ed00-4cff-b8ea-a925c47a2fdf", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEJmFf5QA7f9MuOqpJcR6L98-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", + "RoleAssignmentScheduleId": "lAPpYvVpN0KRkAEhdxReEN1eAzihYwhMi9KteNBiQFc-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", + "RoleAssignmentOriginId": "lAPpYvVpN0KRkAEhdxReEOpg3ULpV-pHikOiE9NqnLA-1", + "RoleAssignmentScheduleId": "4616f5af-97e5-4849-b8a0-aa1111cee134", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", + "StartDateTime": "/Date(1647533824543)/", + "AdditionalProperties": {} + } + ] }, { - "DisplayName": "User Administrator", - "RoleTemplateId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P1D" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": false, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - { - "@odata.type": "#microsoft.graph.groupMembers", - "isBackup": false, - "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", - "description": "privileged escalation approvers" - } - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } + "DisplayName": "User Administrator", + "RoleTemplateId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P1D" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": false, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [ + { + "@odata.type": "#microsoft.graph.groupMembers", + "isBackup": false, + "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", + "description": "privileged escalation approvers" + } ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", - "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", - "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", - "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", - "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", - "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", - "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", - "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", - "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", - "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", - "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", - "StartDateTime": null, - "AdditionalProperties": { - - } - } - ] + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", + "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", + "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sasxesy10mpEuvmE-XxwZAM-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", + "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", + "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sRzmca5l9LZNjSZfPlK92AA-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", + "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", + "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sVjciirFt4ZApcwkS430DOg-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", + "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", + "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sXwV0C627m1FobGeEeQDs5s-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", + "RoleAssignmentOriginId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", + "RoleAssignmentScheduleId": "5wuT_mJe20eRr5jDpJo4sYa1MXm09ixOnpjMjs6kt-E-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "fe930be7-5e62-47db-91af-98c3a49a38b1", + "StartDateTime": null, + "AdditionalProperties": {} + } + ] }, { - "DisplayName": "Exchange Administrator", - "RoleTemplateId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P1D" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": true, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - { - "@odata.type": "#microsoft.graph.groupMembers", - "isBackup": false, - "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", - "description": "privileged escalation approvers" - } - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } + "DisplayName": "Exchange Administrator", + "RoleTemplateId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P1D" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": true, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [ + { + "@odata.type": "#microsoft.graph.groupMembers", + "isBackup": false, + "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", + "description": "privileged escalation approvers" + } ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "d2ed49d6-17b5-475e-b98d-44446308875f", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", - "RoleAssignmentScheduleId": "a7621401-7a86-4529-afa1-e8cf6c0b3803", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": "/Date(1648659568260)/", - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", - "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", - "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", - "StartDateTime": null, - "AdditionalProperties": { - - } - } - ] - }, - { - "DisplayName": "SharePoint Administrator", - "RoleTemplateId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P180D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P1D" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": true, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - { - "@odata.type": "#microsoft.graph.groupMembers", - "isBackup": false, - "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", - "description": "privileged escalation approvers" - } - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } - ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "d569d130-9206-4c7c-9534-65a8afdc7fac", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "b608333c-67b0-428a-b804-c03e3dd8615a", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", - "RoleAssignmentScheduleId": "e501042d-e4d3-4c9b-ae7b-e11e80bfeec1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": "/Date(1691509286140)/", - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "21cc87be-6f7b-4bc3-885f-7371e61f4df2", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", - "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", - "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", - "StartDateTime": null, - "AdditionalProperties": { - - } - } - ] - }, - { - "DisplayName": "Application Administrator", - "RoleTemplateId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "PT2H" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": false, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - "testme@gmail.com" - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } - ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "e54ac846-1f5a-4afe-aa69-273b42c3b0c1", - "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", - "RoleAssignmentScheduleId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "010295b0-f059-46de-a183-8e1e1c8ece30", - "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", - "RoleAssignmentScheduleId": "69f5b475-3595-4447-83ff-85b6d7132a0c", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", - "StartDateTime": "/Date(1648587304797)/", - "AdditionalProperties": { - - } - } - ] - }, - { - "DisplayName": "Privileged Role Administrator", - "RoleTemplateId": "e8611ab8-c189-46e8-94e1-60213ab1f814", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P1D" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": false, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - { - "@odata.type": "#microsoft.graph.groupMembers", - "isBackup": false, - "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", - "description": "privileged escalation approvers" - } - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } - ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "0bdffa70-6120-4c17-9ed8-fc6f2332a149", - "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", - "RoleAssignmentScheduleId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", - "StartDateTime": null, - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", - "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", - "RoleAssignmentScheduleId": "b6624013-0364-471b-a861-00aad19e7415", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", - "StartDateTime": "/Date(1647482863980)/", - "AdditionalProperties": { - - } - } - ] - }, - { - "DisplayName": "Cloud Application Administrator", - "RoleTemplateId": "158c047a-c907-4556-b7ef-446551a6b5f7", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "PT8H" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "MultiFactorAuthentication", - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": false, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } - ], - "Assignments": [ - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "2fd16b6b-d91f-45e6-b56c-47a222c43386", - "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", - "RoleAssignmentScheduleId": "1d4b4273-5903-490b-b9cf-4658aa1e7019", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", - "StartDateTime": "/Date(1648660034457)/", - "AdditionalProperties": { - - } - }, - { - "ActivatedUsing": { - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": null, - "EndDateTime": null, - "Id": null, - "MemberType": null, - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": null, - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": null, - "RoleEligibilityScheduleId": null, - "StartDateTime": null - }, - "AppScope": { - "DisplayName": null, - "Id": null, - "Type": null - }, - "AppScopeId": null, - "AssignmentType": "Assigned", - "DirectoryScope": { - "DeletedDateTime": null, - "Id": null - }, - "DirectoryScopeId": "/", - "EndDateTime": null, - "Id": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", - "MemberType": "Direct", - "Principal": { - "DeletedDateTime": null, - "Id": null - }, - "PrincipalId": "6066af10-d921-4de6-9ae4-7f01057ec372", - "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", - "RoleAssignmentScheduleId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", - "RoleDefinition": { - "AllowedPrincipalTypes": null, - "Description": null, - "DisplayName": null, - "Id": null, - "InheritsPermissionsFrom": null, - "IsBuiltIn": null, - "IsEnabled": null, - "ResourceScopes": null, - "RolePermissions": null, - "TemplateId": null, - "Version": null - }, - "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", - "StartDateTime": null, - "AdditionalProperties": { - - } - } - ] + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3hzmca5l9LZNjSZfPlK92AA-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2a8adc58-b7c5-4086-a5cc-244b8df40ce8", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3ljciirFt4ZApcwkS430DOg-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "c8975770-8c3d-43ef-8466-678584a32de5", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nBXl8g9jO9DhGZnhYSjLeU-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3nwV0C627m1FobGeEeQDs5s-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3oa1MXm09ixOnpjMjs6kt-E-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qFKaTP-F21FqlYKC_oShfE-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "cc7a31ab-d2b5-446a-baf9-84f97c706403", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3qsxesy10mpEuvmE-XxwZAM-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3t1eAzihYwhMi9KteNBiQFc-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "d2ed49d6-17b5-475e-b98d-44446308875f", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3tZJ7dK1F15HuY1ERGMIh18-1", + "RoleAssignmentScheduleId": "a7621401-7a86-4529-afa1-e8cf6c0b3803", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": "/Date(1648659568260)/", + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", + "RoleAssignmentOriginId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", + "RoleAssignmentScheduleId": "3ywjKSOT_UKt4h0JevPk3v_Td4gTL9RGlFhM3Ul779E-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "29232cdf-9323-42fd-ade2-1d097af3e4de", + "StartDateTime": null, + "AdditionalProperties": {} + } + ] }, { - "DisplayName": "Hybrid Identity Administrator", - "RoleTemplateId": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", - "Rules": [ - { - "Id": "Expiration_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "P365D" - } - }, - { - "Id": "Notification_Admin_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Enablement_Admin_Eligibility", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Eligibility", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - - ] - } - }, - { - "Id": "Expiration_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": true, - "maximumDuration": "P30D" - } - }, - { - "Id": "Enablement_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Notification_Admin_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_Admin_Assignment", - "Target": { - "Caller": "Admin", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Expiration_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", - "isExpirationRequired": false, - "maximumDuration": "PT8H" - } - }, - { - "Id": "Enablement_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", - "enabledRules": [ - "Justification" - ] - } - }, - { - "Id": "Approval_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", - "setting": { - "isApprovalRequired": false, - "isApprovalRequiredForExtension": false, - "isRequestorJustificationRequired": true, - "approvalMode": "SingleStage", - "approvalStages": [ - { - "approvalStageTimeOutInDays": 1, - "isApproverJustificationRequired": true, - "escalationTimeInMinutes": 0, - "isEscalationEnabled": false, - "primaryApprovers": [ - - ], - "escalationApprovers": [ - - ] - } - ] - } - } - }, - { - "Id": "AuthenticationContext_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", - "isEnabled": false, - "claimValue": "" - } - }, - { - "Id": "Notification_Admin_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Admin", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Requestor_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Requestor", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - }, - { - "Id": "Notification_Approver_EndUser_Assignment", - "Target": { - "Caller": "EndUser", - "EnforcedSettings": [ - - ], - "InheritableSettings": [ - - ], - "Level": "Assignment", - "Operations": [ - "All" - ], - "TargetObjects": null - }, - "AdditionalProperties": { - "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", - "notificationType": "Email", - "recipientType": "Approver", - "notificationLevel": "All", - "isDefaultRecipientsEnabled": true, - "notificationRecipients": [ - - ] - } - } + "DisplayName": "SharePoint Administrator", + "RoleTemplateId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P180D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P1D" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": true, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [ + { + "@odata.type": "#microsoft.graph.groupMembers", + "isBackup": false, + "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", + "description": "privileged escalation approvers" + } ], - "Assignments": [ - - ] - } -], - "service_plans": [ - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6", - "ServicePlanName": "MIP_S_Exchange", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0", - "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX_TOPICEXP", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757", - "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7", - "ServicePlanName": "SAFEDOCS", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717", - "ServicePlanName": "PROJECT_O365_P3_GOV", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67", - "ServicePlanName": "BPOS_S_TODO_3", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af", - "ServicePlanName": "WHITEBOARD_PLAN3", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "Company", - "ProvisioningStatus": "Success", - "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff", - "ServicePlanName": "MICROSOFT_SEARCH", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "Company", - "ProvisioningStatus": "Success", - "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560", - "ServicePlanName": "ContentExplorer_Standard", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287", - "ServicePlanName": "INFORMATION_BARRIERS", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10", - "ServicePlanName": "CDS_O365_P3_GCC", - "AdditionalProperties": { - - } - }, - { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39", - "ServicePlanName": "DYN365_CDS_O365_P3_GCC", - "AdditionalProperties": { - - } + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "ae71e61c-f465-4db6-8d26-5f3e52bdd800", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbBzmca5l9LZNjSZfPlK92AA-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "d569d130-9206-4c7c-9534-65a8afdc7fac", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbDDRadUGknxMlTRlqK_cf6w-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "b608333c-67b0-428a-b804-c03e3dd8615a", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbDwzCLawZ4pCuATAPj3YYVo-1", + "RoleAssignmentScheduleId": "e501042d-e4d3-4c9b-ae7b-e11e80bfeec1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": "/Date(1691509286140)/", + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2ed0157c-eeb6-456d-a1b1-9e11e403b39b", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbHwV0C627m1FobGeEeQDs5s-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "7931b586-f6b4-4e2c-9e98-cc8ecea4b7e1", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbIa1MXm09ixOnpjMjs6kt-E-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "33694aa1-17fe-456d-aa56-0a0bfa1285f1", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbKFKaTP-F21FqlYKC_oShfE-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "21cc87be-6f7b-4bc3-885f-7371e61f4df2", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbL6HzCF7b8NLiF9zceYfTfI-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "38035edd-63a1-4c08-8bd2-ad78d0624057", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbN1eAzihYwhMi9KteNBiQFc-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "9e60e3d1-4269-4a80-9f88-fa9c8b78ffe5", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbNHjYJ5pQoBKn4j6nIt4_-U-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "8877d3ff-2f13-46d4-9458-4cdd497befd1", + "RoleAssignmentOriginId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", + "RoleAssignmentScheduleId": "UB-K8uf2cUWBi2oS8q9rbP_Td4gTL9RGlFhM3Ul779E-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", + "StartDateTime": null, + "AdditionalProperties": {} + } + ] }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f", - "ServicePlanName": "ML_CLASSIFICATION", - "AdditionalProperties": { - - } + "DisplayName": "Application Administrator", + "RoleTemplateId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "PT2H" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": false, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [], + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": ["testme@gmail.com"] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "e54ac846-1f5a-4afe-aa69-273b42c3b0c1", + "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", + "RoleAssignmentScheduleId": "kl2Jm9Msx0SdAqasLV6lw0bISuVaH_5KqmknO0LDsME-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "010295b0-f059-46de-a183-8e1e1c8ece30", + "RoleAssignmentOriginId": "kl2Jm9Msx0SdAqasLV6lw7CVAgFZ8N5GoYOOHhyOzjA-1", + "RoleAssignmentScheduleId": "69f5b475-3595-4447-83ff-85b6d7132a0c", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3", + "StartDateTime": "/Date(1648587304797)/", + "AdditionalProperties": {} + } + ] }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e", - "ServicePlanName": "MICROSOFTENDPOINTDLP", - "AdditionalProperties": { - - } + "DisplayName": "Privileged Role Administrator", + "RoleTemplateId": "e8611ab8-c189-46e8-94e1-60213ab1f814", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P1D" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": false, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [ + { + "@odata.type": "#microsoft.graph.groupMembers", + "isBackup": false, + "id": "54e56ffb-a568-4c65-b04a-7a6feabab17c", + "description": "privileged escalation approvers" + } + ], + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "0bdffa70-6120-4c17-9ed8-fc6f2332a149", + "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", + "RoleAssignmentScheduleId": "uBph6InB6EaU4WAhOrH4FHD63wsgYRdMntj8byMyoUk-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", + "StartDateTime": null, + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "42dd60ea-57e9-47ea-8a43-a213d36a9cb0", + "RoleAssignmentOriginId": "uBph6InB6EaU4WAhOrH4FOpg3ULpV-pHikOiE9NqnLA-1", + "RoleAssignmentScheduleId": "b6624013-0364-471b-a861-00aad19e7415", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "e8611ab8-c189-46e8-94e1-60213ab1f814", + "StartDateTime": "/Date(1647482863980)/", + "AdditionalProperties": {} + } + ] }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94", - "ServicePlanName": "MCOSTANDARD_GOV", - "AdditionalProperties": { - - } + "DisplayName": "Cloud Application Administrator", + "RoleTemplateId": "158c047a-c907-4556-b7ef-446551a6b5f7", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "PT8H" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["MultiFactorAuthentication", "Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": false, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [], + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [ + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "2fd16b6b-d91f-45e6-b56c-47a222c43386", + "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa192tr0S8f2eZFtWxHoiLEM4Y-1", + "RoleAssignmentScheduleId": "1d4b4273-5903-490b-b9cf-4658aa1e7019", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", + "StartDateTime": "/Date(1648660034457)/", + "AdditionalProperties": {} + }, + { + "ActivatedUsing": { + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": null, + "EndDateTime": null, + "Id": null, + "MemberType": null, + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": null, + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": null, + "RoleEligibilityScheduleId": null, + "StartDateTime": null + }, + "AppScope": { + "DisplayName": null, + "Id": null, + "Type": null + }, + "AppScopeId": null, + "AssignmentType": "Assigned", + "DirectoryScope": { + "DeletedDateTime": null, + "Id": null + }, + "DirectoryScopeId": "/", + "EndDateTime": null, + "Id": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", + "MemberType": "Direct", + "Principal": { + "DeletedDateTime": null, + "Id": null + }, + "PrincipalId": "6066af10-d921-4de6-9ae4-7f01057ec372", + "RoleAssignmentOriginId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", + "RoleAssignmentScheduleId": "egSMFQfJVkW370RlUaa19xCvZmAh2eZNmuR_AQV-w3I-1", + "RoleDefinition": { + "AllowedPrincipalTypes": null, + "Description": null, + "DisplayName": null, + "Id": null, + "InheritsPermissionsFrom": null, + "IsBuiltIn": null, + "IsEnabled": null, + "ResourceScopes": null, + "RolePermissions": null, + "TemplateId": null, + "Version": null + }, + "RoleDefinitionId": "158c047a-c907-4556-b7ef-446551a6b5f7", + "StartDateTime": null, + "AdditionalProperties": {} + } + ] }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692", - "ServicePlanName": "SHAREPOINTENTERPRISE_GOV", - "AdditionalProperties": { - - } - }, + "DisplayName": "Hybrid Identity Administrator", + "RoleTemplateId": "8ac3fc64-6eca-42ea-9e69-59f4c7b60eb2", + "Rules": [ + { + "Id": "Expiration_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "P365D" + } + }, + { + "Id": "Notification_Admin_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Enablement_Admin_Eligibility", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Eligibility", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": [] + } + }, + { + "Id": "Expiration_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": true, + "maximumDuration": "P30D" + } + }, + { + "Id": "Enablement_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Notification_Admin_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_Admin_Assignment", + "Target": { + "Caller": "Admin", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Expiration_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyExpirationRule", + "isExpirationRequired": false, + "maximumDuration": "PT8H" + } + }, + { + "Id": "Enablement_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyEnablementRule", + "enabledRules": ["Justification"] + } + }, + { + "Id": "Approval_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyApprovalRule", + "setting": { + "isApprovalRequired": false, + "isApprovalRequiredForExtension": false, + "isRequestorJustificationRequired": true, + "approvalMode": "SingleStage", + "approvalStages": [ + { + "approvalStageTimeOutInDays": 1, + "isApproverJustificationRequired": true, + "escalationTimeInMinutes": 0, + "isEscalationEnabled": false, + "primaryApprovers": [], + "escalationApprovers": [] + } + ] + } + } + }, + { + "Id": "AuthenticationContext_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyAuthenticationContextRule", + "isEnabled": false, + "claimValue": "" + } + }, + { + "Id": "Notification_Admin_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Admin", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Requestor_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Requestor", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + }, + { + "Id": "Notification_Approver_EndUser_Assignment", + "Target": { + "Caller": "EndUser", + "EnforcedSettings": [], + "InheritableSettings": [], + "Level": "Assignment", + "Operations": ["All"], + "TargetObjects": null + }, + "AdditionalProperties": { + "@odata.type": "#microsoft.graph.unifiedRoleManagementPolicyNotificationRule", + "notificationType": "Email", + "recipientType": "Approver", + "notificationLevel": "All", + "isDefaultRecipientsEnabled": true, + "notificationRecipients": [] + } + } + ], + "Assignments": [] + } + ], + "service_plans": [ { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f", - "ServicePlanName": "PREMIUM_ENCRYPTION", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "cd31b152-6326-4d1b-ae1b-997b625182e6", + "ServicePlanName": "MIP_S_Exchange", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76", - "ServicePlanName": "BI_AZURE_P_2_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "b74d57b2-58e9-484a-9731-aeccbba954f0", + "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX_TOPICEXP", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246", - "ServicePlanName": "FLOW_O365_P3_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "a6520331-d7d4-4276-95f5-15c0933bc757", + "ServicePlanName": "GRAPH_CONNECTORS_SEARCH_INDEX", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e", - "ServicePlanName": "POWERAPPS_O365_P3_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "bf6f5520-59e3-4f82-974b-7dbbc4fd27c7", + "ServicePlanName": "SAFEDOCS", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec", - "ServicePlanName": "SHAREPOINTWAC_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "9b7c50ec-cd50-44f2-bf48-d72de6f90717", + "ServicePlanName": "PROJECT_O365_P3_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51", - "ServicePlanName": "PROJECTWORKMANAGEMENT_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "3fb82609-8c27-4f7b-bd51-30634711ee67", + "ServicePlanName": "BPOS_S_TODO_3", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1", - "ServicePlanName": "EQUIVIO_ANALYTICS_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "4a51bca5-1eff-43f5-878c-177680f191af", + "ServicePlanName": "WHITEBOARD_PLAN3", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28", - "ServicePlanName": "TEAMS_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "Company", + "ProvisioningStatus": "Success", + "ServicePlanId": "94065c59-bc8e-4e8b-89e5-5138d471eaff", + "ServicePlanName": "MICROSOFT_SEARCH", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547", - "ServicePlanName": "STREAM_O365_E5_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "Company", + "ProvisioningStatus": "Success", + "ServicePlanId": "2b815d45-56e4-4e3a-b65c-66cb9175b560", + "ServicePlanName": "ContentExplorer_Standard", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541", - "ServicePlanName": "RECORDS_MANAGEMENT", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "c4801e8a-cb58-4c35-aca6-f2dcc106f287", + "ServicePlanName": "INFORMATION_BARRIERS", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7", - "ServicePlanName": "EXCHANGE_ANALYTICS_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "bce5e5ca-c2fd-4d53-8ee2-58dfffed4c10", + "ServicePlanName": "CDS_O365_P3_GCC", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5", - "ServicePlanName": "INTUNE_A", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "a7d3fb37-b6df-4085-b509-50810d991a39", + "ServicePlanName": "DYN365_CDS_O365_P3_GCC", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75", - "ServicePlanName": "INSIDER_RISK", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "d2d51368-76c9-4317-ada2-a12c004c432f", + "ServicePlanName": "ML_CLASSIFICATION", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6", - "ServicePlanName": "THREAT_INTELLIGENCE_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "64bfac92-2b17-4482-b5e5-a0304429de3e", + "ServicePlanName": "MICROSOFTENDPOINTDLP", + "AdditionalProperties": {} }, { - "AppliesTo": "Company", - "ProvisioningStatus": "Success", - "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516", - "ServicePlanName": "ATP_ENTERPRISE_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "a31ef4a2-f787-435e-8335-e47eb0cafc94", + "ServicePlanName": "MCOSTANDARD_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f", - "ServicePlanName": "ATA", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "153f85dd-d912-4762-af6c-d6e0fb4f6692", + "ServicePlanName": "SHAREPOINTENTERPRISE_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb", - "ServicePlanName": "CUSTOMER_KEY", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "617b097b-4b93-4ede-83de-5f075bb5fb2f", + "ServicePlanName": "PREMIUM_ENCRYPTION", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b", - "ServicePlanName": "COMMUNICATIONS_DLP", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "944e9726-f011-4353-b654-5f7d2663db76", + "ServicePlanName": "BI_AZURE_P_2_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2", - "ServicePlanName": "ADALLOM_S_STANDALONE", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "8055d84a-c172-42eb-b997-6c2ae4628246", + "ServicePlanName": "FLOW_O365_P3_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2", - "ServicePlanName": "MICROSOFTBOOKINGS", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "0eacfc38-458a-40d3-9eab-9671258f1a3e", + "ServicePlanName": "POWERAPPS_O365_P3_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0", - "ServicePlanName": "MFA_PREMIUM", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "8f9f0f3b-ca90-406c-a842-95579171f8ec", + "ServicePlanName": "SHAREPOINTWAC_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22", - "ServicePlanName": "MCOEV_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "5b4ef465-7ea1-459a-9f91-033317755a51", + "ServicePlanName": "PROJECTWORKMANAGEMENT_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192", - "ServicePlanName": "MTP", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "d1cbfb67-18a8-4792-b643-630b7f19aad1", + "ServicePlanName": "EQUIVIO_ANALYTICS_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1", - "ServicePlanName": "MCOMEETADV_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "304767db-7d23-49e8-a945-4a7eb65f9f28", + "ServicePlanName": "TEAMS_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af", - "ServicePlanName": "OFFICESUBSCRIPTION_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "92c2089d-9a53-49fe-b1a6-9e6bdf959547", + "ServicePlanName": "STREAM_O365_E5_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849", - "ServicePlanName": "M365_ADVANCED_AUDITING", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "65cc641f-cccd-4643-97e0-a17e3045e541", + "ServicePlanName": "RECORDS_MANAGEMENT", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c", - "ServicePlanName": "MICROSOFT_COMMUNICATION_COMPLIANCE", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "208120d1-9adb-4daf-8c22-816bd5d237e7", + "ServicePlanName": "EXCHANGE_ANALYTICS_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5", - "ServicePlanName": "MIP_S_CLP1", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5", + "ServicePlanName": "INTUNE_A", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3", - "ServicePlanName": "MIP_S_CLP2", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "d587c7a3-bda9-4f99-8776-9bcf59c84f75", + "ServicePlanName": "INSIDER_RISK", + "AdditionalProperties": {} }, { - "AppliesTo": "Company", - "ProvisioningStatus": "Success", - "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d", - "ServicePlanName": "Content_Explorer", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "900018f1-0cdb-4ecb-94d4-90281760fdc6", + "ServicePlanName": "THREAT_INTELLIGENCE_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c", - "ServicePlanName": "FORMS_GOV_E5", - "AdditionalProperties": { - - } + "AppliesTo": "Company", + "ProvisioningStatus": "Success", + "ServicePlanId": "493ff600-6a2b-4db6-ad37-a7d4eb214516", + "ServicePlanName": "ATP_ENTERPRISE_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2", - "ServicePlanName": "EXCHANGE_S_ENTERPRISE_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "14ab5db5-e6c4-4b20-b4bc-13e36fd2227f", + "ServicePlanName": "ATA", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526", - "ServicePlanName": "LOCKBOX_ENTERPRISE_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "6db1f1db-2b46-403f-be40-e39395f08dbb", + "ServicePlanName": "CUSTOMER_KEY", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98", - "ServicePlanName": "RMS_S_PREMIUM_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "6dc145d6-95dd-4191-b9c3-185575ee6f6b", + "ServicePlanName": "COMMUNICATIONS_DLP", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce", - "ServicePlanName": "RMS_S_PREMIUM2_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2", + "ServicePlanName": "ADALLOM_S_STANDALONE", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597", - "ServicePlanName": "RMS_S_ENTERPRISE_GOV", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "199a5c09-e0ca-4e37-8f7c-b05d533e1ea2", + "ServicePlanName": "MICROSOFTBOOKINGS", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998", - "ServicePlanName": "AAD_PREMIUM_P2", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "8a256a2b-b617-496d-b51b-e76466e88db0", + "ServicePlanName": "MFA_PREMIUM", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d", - "ServicePlanName": "AAD_PREMIUM", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "db23fce2-a974-42ef-9002-d78dd42a0f22", + "ServicePlanName": "MCOEV_GOV", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66", - "ServicePlanName": "INFO_GOVERNANCE", - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "bf28f719-7844-4079-9c78-c1307898e192", + "ServicePlanName": "MTP", + "AdditionalProperties": {} }, { - "AppliesTo": "User", - "ProvisioningStatus": "Success", - "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef", - "ServicePlanName": "WINDEFATP", - "AdditionalProperties": { - - } - } -], - "directory_settings": [ - { - "DisplayName": "Group.Unified", - "Id": "5ce54204-ef8d-44c5-af88-dc8bd4c16069", - "TemplateId": "62375ab9-6b52-47ed-826b-58e47e0e304b", - "Values": [ - { - "Name": "NewUnifiedGroupWritebackDefault", - "Value": "true" - }, - { - "Name": "EnableMIPLabels", - "Value": "False" - }, - { - "Name": "CustomBlockedWordsList", - "Value": "" - }, - { - "Name": "EnableMSStandardBlockedWords", - "Value": "False" - }, - { - "Name": "ClassificationDescriptions", - "Value": "" - }, - { - "Name": "DefaultClassification", - "Value": "" - }, - { - "Name": "PrefixSuffixNamingRequirement", - "Value": "" - }, - { - "Name": "AllowGuestsToBeGroupOwner", - "Value": "False" - }, - { - "Name": "AllowGuestsToAccessGroups", - "Value": "True" - }, - { - "Name": "GuestUsageGuidelinesUrl", - "Value": "" - }, - { - "Name": "GroupCreationAllowedGroupId", - "Value": "67f62883-f97a-4192-a300-8a1576af8056" - }, - { - "Name": "AllowToAddGuests", - "Value": "True" - }, - { - "Name": "UsageGuidelinesUrl", - "Value": "" - }, - { - "Name": "ClassificationList", - "Value": "" - }, - { - "Name": "EnableGroupCreation", - "Value": "False" - } - ], - "AdditionalProperties": { - - } + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "f544b08d-1645-4287-82de-8d91f37c02a1", + "ServicePlanName": "MCOMEETADV_GOV", + "AdditionalProperties": {} }, { - "DisplayName": "Consent Policy Settings", - "Id": "62c1305f-60f0-4096-8d72-e1f74e8627f5", - "TemplateId": "dffd5d46-495d-40a9-8e21-954ff55e198a", - "Values": [ - { - "Name": "EnableGroupSpecificConsent", - "Value": "false" - }, - { - "Name": "BlockUserConsentForRiskyApps", - "Value": "true" - }, - { - "Name": "EnableAdminConsentRequests", - "Value": "true" - }, - { - "Name": "ConstrainGroupSpecificConsentToMembersOfGroupId", - "Value": "" - } - ], - "AdditionalProperties": { - - } - } -], - "authentication_method": [ - { - "AuthenticationMethodConfigurations": [ - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", - "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration" - ], - "Description": "The tenant-wide policy that controls which authentication methods are allowed in the tenant, authentication method registration requirements, and self-service password reset settings", - "DisplayName": "Authentication Methods Policy", - "Id": "authenticationMethodsPolicy", - "LastModifiedDateTime": "/Date(1684278552414)/", - "PolicyMigrationState": "preMigration", - "PolicyVersion": "1.5", - "ReconfirmationInDays": null, - "RegistrationEnforcement": { - "AuthenticationMethodsRegistrationCampaign": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodsRegistrationCampaign" - }, - "SystemCredentialPreferences": { - "ExcludeTargets": "", - "IncludeTargets": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphIncludeTarget", - "State": "default" - } - } -], - "aad_successful_commands": [ - "Get-MgBetaIdentityConditionalAccessPolicy", - "Get-MgBetaSubscribedSku", - "Get-PrivilegedUser", - "Get-PrivilegedRole", - "Get-MgBetaPolicyAuthorizationPolicy", - "Get-MgBetaSecuritySecureScore", - "Get-MgBetaDirectorySetting", - "Get-MgBetaPolicyAuthenticationMethodPolicy" -], - "aad_unsuccessful_commands": [ - -], "protection_policy_rules": [ - { - "HostedContentFilterPolicy": "Strict Preset Security Policy1681329956650", - "AntiPhishPolicy": "Strict Preset Security Policy1681329955447", - "MalwareFilterPolicy": "Strict Preset Security Policy1681329957931", - "State": "Enabled", - "Priority": 0, - "Comments": null, - "Description": "Take the following actions:rntApply hosted content filter policy 'Strict Preset Security Policy1681329956650'., Apply AntiPhish policy 'Strict Preset Security Policy1681329955447'., Apply malware filter policy 'Strict Preset Security Policy1681329957931'.rn", - "RuleVersion": { - "Major": 14, - "Minor": 0, - "Build": 0, - "Revision": 0, - "MajorRevision": 0, - "MinorRevision": 0 - }, - "SentTo": null, - "SentToMemberOf": null, - "RecipientDomainIs": null, - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": null, - "Exceptions": null, - "Identity": "Strict Preset Security Policy", - "DistinguishedName": "CN=Strict Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", - "ImmutableId": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "Strict Preset Security Policy", - "IsValid": true, - "WhenChanged": "/Date(1689096663000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "de9234ff-6483-44d9-b15e-dca72fdd27af", + "ServicePlanName": "OFFICESUBSCRIPTION_GOV", + "AdditionalProperties": {} }, { - "HostedContentFilterPolicy": "Standard Preset Security Policy1659535432883", - "AntiPhishPolicy": "Standard Preset Security Policy1659535429826", - "MalwareFilterPolicy": "Standard Preset Security Policy1659535435292", - "State": "Enabled", - "Priority": 1, - "Comments": null, - "Description": "Take the following actions:rntApply hosted content filter policy 'Standard Preset Security Policy1659535432883'., Apply AntiPhish policy 'Standard Preset Security Policy1659535429826'., Apply malware filter policy 'Standard Preset Security Policy1659535435292'.rn", - "RuleVersion": { - "Major": 14, - "Minor": 0, - "Build": 0, - "Revision": 0, - "MajorRevision": 0, - "MinorRevision": 0 - }, - "SentTo": null, - "SentToMemberOf": null, - "RecipientDomainIs": null, - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": null, - "Exceptions": null, - "Identity": "Standard Preset Security Policy", - "DistinguishedName": "CN=Standard Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "83318c49-93e8-497b-8fd3-614b090e6103", - "ImmutableId": "83318c49-93e8-497b-8fd3-614b090e6103", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "Standard Preset Security Policy", - "IsValid": true, - "WhenChanged": "/Date(1690471889000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" - } -], - "dlp_compliance_policies": [ - { - "Mode": "Enable", - "DisplayName": "Default Office 365 DLP policy", - "Type": "Dlp", - "ExchangeLocation": [ - "All" - ], - "SharePointLocation": [ - "All" - ], - "SharePointLocationException": [ - - ], - "OneDriveLocation": [ - "All" - ], - "OneDriveLocationException": [ - - ], - "ExchangeOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocationException": [ - - ], - "TeamsLocation": [ - "All" - ], - "TeamsLocationException": [ - - ], - "EndpointDlpLocation": [ - "All" - ], - "EndpointDlpLocationException": [ - - ], - "ThirdPartyAppDlpLocation": [ - - ], - "ThirdPartyAppDlpLocationException": [ - - ], - "OnPremisesScannerDlpLocation": [ - "All" - ], - "OnPremisesScannerDlpLocationException": [ - - ], - "PowerBIDlpLocation": [ - - ], - "PowerBIDlpLocationException": [ - - ], - "ExchangeSender": [ - - ], - "ExchangeSenderException": [ - - ], - "PolicyTemplateInfo": { - - }, - "MatchedItemsCount": null, - "TotalItemsCount": null, - "TopNLocationStatistics": null, - "WorkloadStatistics": null, - "IsSimulationPolicy": false, - "SimulationStatus": null, - "AutoEnableAfter": null, - "ExtendedProperties": null, - "Summary": false, - "OneDriveSharedBy": [ - - ], - "ExceptIfOneDriveSharedBy": [ - - ], - "OneDriveSharedByMemberOf": [ - - ], - "ExceptIfOneDriveSharedByMemberOf": [ - - ], - "ExchangeSenderMemberOf": [ - - ], - "ExchangeSenderMemberOfException": [ - - ], - "ExpectedLocations": 0, - "CompletedLocations": 0, - "FailedLocations": 0, - "ItemStatistics": null, - "RuleMatchBlob": null, - "ErrorMetadata": null, - "UserAdministrativeUnitMembershipMap": null, - "ForceValidate": false, - "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-04-25T18:43:47.10409Z'}", - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", - "Priority": 0, - "ObjectVersion": "ed2f16ae-251f-4a91-2908-08db45bd0101", - "CreatedBy": "", - "LastModifiedBy": "Addam Schroll", - "ReadOnly": false, - "ExternalIdentity": "", - "Comment": "This policy detects the presence of credit card numbers in externally shared documents and emails. End users are notified of the detection with the suggestion to consider either removing the sensitive data or restricting the sharing.", - "Enabled": true, - "DistributionStatus": "Pending", - "DistributionResults": null, - "LastStatusUpdateTime": null, - "ModificationTimeUtc": "/Date(1682462627107)/", - "CreationTimeUtc": "/Date(1614652120970)/", - "PolicyRBACScopes": [ - - ], - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Default Office 365 DLP policy", - "DistinguishedName": "CN=Default Office 365 DLP policy,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedPolicy" - ], - "WhenChanged": "/Date(1682448226000)/", - "WhenCreated": "/Date(1617646100000)/", - "WhenChangedUTC": "/Date(1682448226000)/", - "WhenCreatedUTC": "/Date(1617646100000)/", - "ExchangeObjectId": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "Guid": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", - "OriginatingServer": "", - "ObjectState": "Changed" + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "2f442157-a11c-46b9-ae5b-6e39ff4e5849", + "ServicePlanName": "M365_ADVANCED_AUDITING", + "AdditionalProperties": {} }, { - "Mode": "Enable", - "DisplayName": "agency DLP Policy for PII", - "Type": "Dlp", - "ExchangeLocation": [ - "All" - ], - "SharePointLocation": [ - "All" - ], - "SharePointLocationException": [ - - ], - "OneDriveLocation": [ - "All" - ], - "OneDriveLocationException": [ - - ], - "ExchangeOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocationException": [ - - ], - "TeamsLocation": [ - "All" - ], - "TeamsLocationException": [ - - ], - "EndpointDlpLocation": [ - - ], - "EndpointDlpLocationException": [ - - ], - "ThirdPartyAppDlpLocation": [ - - ], - "ThirdPartyAppDlpLocationException": [ - - ], - "OnPremisesScannerDlpLocation": [ - - ], - "OnPremisesScannerDlpLocationException": [ - - ], - "PowerBIDlpLocation": [ - - ], - "PowerBIDlpLocationException": [ - - ], - "ExchangeSender": [ - - ], - "ExchangeSenderException": [ - - ], - "PolicyTemplateInfo": { - - }, - "MatchedItemsCount": null, - "TotalItemsCount": null, - "TopNLocationStatistics": null, - "WorkloadStatistics": null, - "IsSimulationPolicy": false, - "SimulationStatus": null, - "AutoEnableAfter": null, - "ExtendedProperties": null, - "Summary": false, - "OneDriveSharedBy": [ - - ], - "ExceptIfOneDriveSharedBy": [ - - ], - "OneDriveSharedByMemberOf": [ - - ], - "ExceptIfOneDriveSharedByMemberOf": [ - - ], - "ExchangeSenderMemberOf": [ - - ], - "ExchangeSenderMemberOfException": [ - - ], - "ExpectedLocations": 0, - "CompletedLocations": 0, - "FailedLocations": 0, - "ItemStatistics": null, - "RuleMatchBlob": null, - "ErrorMetadata": null, - "UserAdministrativeUnitMembershipMap": null, - "ForceValidate": false, - "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-06-14T14:36:08.0311995Z'}", - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", - "Priority": 1, - "ObjectVersion": "9acc0ace-bf62-43ad-0710-08db6ce4b417", - "CreatedBy": "d459e626-e311-4242-bb40-263313097103", - "LastModifiedBy": "Addam Schroll", - "ReadOnly": false, - "ExternalIdentity": "", - "Comment": "", - "Enabled": true, - "DistributionStatus": "Pending", - "DistributionResults": null, - "LastStatusUpdateTime": null, - "ModificationTimeUtc": "/Date(1686767773280)/", - "CreationTimeUtc": "/Date(1618332438880)/", - "PolicyRBACScopes": [ - - ], - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency DLP Policy for PII", - "DistinguishedName": "CN=agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedPolicy" - ], - "WhenChanged": "/Date(1686753373000)/", - "WhenCreated": "/Date(1618318038000)/", - "WhenChangedUTC": "/Date(1686753373000)/", - "WhenCreatedUTC": "/Date(1618318038000)/", - "ExchangeObjectId": "b800d92f-a479-47a9-bcfa-306db665aaa1", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "Guid": "b800d92f-a479-47a9-bcfa-306db665aaa1", - "OriginatingServer": "", - "ObjectState": "Changed" + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "a413a9ff-720c-4822-98ef-2f37c2a21f4c", + "ServicePlanName": "MICROSOFT_COMMUNICATION_COMPLIANCE", + "AdditionalProperties": {} }, { - "Mode": "Enable", - "DisplayName": "MS.DEFENDER.4.1v1 Test", - "Type": "Dlp", - "ExchangeLocation": [ - "All" - ], - "SharePointLocation": [ - "All" - ], - "SharePointLocationException": [ - - ], - "OneDriveLocation": [ - "All" - ], - "OneDriveLocationException": [ - - ], - "ExchangeOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocation": [ - - ], - "SharePointOnPremisesLocationException": [ - - ], - "TeamsLocation": [ - "All" - ], - "TeamsLocationException": [ - - ], - "EndpointDlpLocation": [ - "All" - ], - "EndpointDlpLocationException": [ - - ], - "ThirdPartyAppDlpLocation": [ - - ], - "ThirdPartyAppDlpLocationException": [ - - ], - "OnPremisesScannerDlpLocation": [ - "All" - ], - "OnPremisesScannerDlpLocationException": [ - - ], - "PowerBIDlpLocation": [ - - ], - "PowerBIDlpLocationException": [ - - ], - "ExchangeSender": [ - - ], - "ExchangeSenderException": [ - - ], - "PolicyTemplateInfo": null, - "MatchedItemsCount": null, - "TotalItemsCount": null, - "TopNLocationStatistics": null, - "WorkloadStatistics": null, - "IsSimulationPolicy": false, - "SimulationStatus": null, - "AutoEnableAfter": null, - "ExtendedProperties": null, - "Summary": false, - "OneDriveSharedBy": [ - - ], - "ExceptIfOneDriveSharedBy": [ - - ], - "OneDriveSharedByMemberOf": [ - - ], - "ExceptIfOneDriveSharedByMemberOf": [ - - ], - "ExchangeSenderMemberOf": [ - - ], - "ExchangeSenderMemberOfException": [ - - ], - "ExpectedLocations": 0, - "CompletedLocations": 0, - "FailedLocations": 0, - "ItemStatistics": null, - "RuleMatchBlob": null, - "ErrorMetadata": null, - "UserAdministrativeUnitMembershipMap": null, - "ForceValidate": false, - "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-08-14T19:00:01.3768698Z'}", - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", - "Priority": 2, - "ObjectVersion": "f7210a5b-91bb-4470-8ffa-08db9cf8a991", - "CreatedBy": "Addam Schroll", - "LastModifiedBy": "Addam Schroll", - "ReadOnly": false, - "ExternalIdentity": "", - "Comment": "Create a custom policy from scratch. You will choose the type of content to protect and how you want to protect it.", - "Enabled": true, - "DistributionStatus": "Pending", - "DistributionResults": null, - "LastStatusUpdateTime": null, - "ModificationTimeUtc": "/Date(1692054001377)/", - "CreationTimeUtc": "/Date(1692053995207)/", - "PolicyRBACScopes": [ - - ], - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "MS.DEFENDER.4.1v1 Test", - "DistinguishedName": "CN=MS.DEFENDER.4.1v1 Test,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedPolicy" - ], - "WhenChanged": "/Date(1692039601000)/", - "WhenCreated": "/Date(1692039595000)/", - "WhenChangedUTC": "/Date(1692039601000)/", - "WhenCreatedUTC": "/Date(1692039595000)/", - "ExchangeObjectId": "cfe272a6-564c-4c7b-96c7-8d187487a755", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "Guid": "cfe272a6-564c-4c7b-96c7-8d187487a755", - "OriginatingServer": "", - "ObjectState": "Changed" - } -], - "dlp_compliance_rules": [ - { - "SubjectContainsWords": [ - - ], - "ExceptIfSubjectContainsWords": [ - - ], - "SubjectOrBodyMatchesPatterns": [ - - ], - "ExceptIfSubjectOrBodyMatchesPatterns": [ - - ], - "SubjectOrBodyContainsWords": [ - - ], - "ExceptIfSubjectOrBodyContainsWords": [ - - ], - "DocumentMatchesPatterns": [ - - ], - "ExceptIfDocumentMatchesPatterns": [ - - ], - "DocumentContainsWords": [ - - ], - "ExceptIfDocumentContainsWords": [ - - ], - "SenderADAttributeMatchesPatterns": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "SenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ContentCharacterSetContainsWords": [ - - ], - "ExceptIfContentCharacterSetContainsWords": [ - - ], - "DocumentNameMatchesPatterns": [ - - ], - "ExceptIfDocumentNameMatchesPatterns": [ - - ], - "MessageSizeOver": "", - "ExceptIfMessageSizeOver": "", - "MessageTypeMatches": null, - "ExceptIfMessageTypeMatches": null, - "UnscannableDocumentExtensionIs": [ - - ], - "ExceptIfUnscannableDocumentExtensionIs": [ - - ], - "HeaderContainsWords": null, - "ExceptIfHeaderContainsWords": null, - "DeviceManagementType": null, - "ExceptIfDeviceManagementType": null, - "AccessedBy": [ - - ], - "ExceptIfAccessedBy": [ - - ], - "AccessedByMemberOf": [ - - ], - "ExceptIfAccessedByMemberOf": [ - - ], - "BlockAccess": true, - "BlockAccessScope": "All", - "EncryptRMSTemplate": null, - "EnforcePortalAccess": true, - "ApplyBrandingTemplate": "", - "RemoveRMSTemplate": false, - "EndpointDlpRestrictions": [ - { - "setting": "CloudEgress", - "defaultmessage": "none", - "value": "Audit", - "appgroup": "none" - }, - { - "setting": "UnallowedApps", - "defaultmessage": "none", - "value": "Block", - "appgroup": "none" - } - ], - "EndpointDlpBrowserRestrictions": null, - "ThirdPartyAppDlpRestrictions": null, - "OnPremisesScannerDlpRestrictions": null, - "PowerBIDlpRestrictions": null, - "AlertProperties": { - "AggregationType": "None" - }, - "GenerateAlert": [ - "true" - ], - "GenerateIncidentReport": [ - - ], - "IncidentReportContent": null, - "NotifyUser": [ - "LastModifier" - ], - "NotifyAllowOverride": null, - "NotifyEmailCustomText": "", - "NotifyEmailCustomSubject": "", - "NotifyEmailCustomSenderDisplayName": "", - "NotifyEmailExchangeIncludeAttachment": true, - "NotifyEmailOnedriveRemediationActions": "NotSet", - "NotifyJustificationCustomText": "", - "NotifyJustificationCustomTextTranslations": [ - - ], - "NotifyPolicyTipCustomText": "", - "NotifyUserType": "NotSet", - "NotifyPolicyTipCustomTextTranslations": [ - - ], - "NotifyOverrideRequirements": "None", - "NotifyPolicyTipDisplayOption": "Tip", - "NotifyPolicyTipUrl": "", - "NotifyEndpointUser": null, - "RemoveHeader": [ - - ], - "AccessTimeControl": null, - "StopPolicyProcessing": false, - "SetHeader": null, - "AddRecipients": null, - "Moderate": null, - "ModifySubject": null, - "MapRecipients": null, - "RedirectMessageTo": null, - "PrependSubject": "", - "ApplyHtmlDisclaimer": null, - "Quarantine": false, - "TriggerPowerAutomateFlow": "", - "RestrictAccess": null, - "Guid": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", - "AdvancedRuleBuilderContext": null, - "ParentPolicyName": "Default Office 365 DLP policy", - "ReportSeverityLevel": "Low", - "ActivationDate": null, - "ExpiryDate": null, - "SenderType": null, - "SenderAddressLocation": null, - "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", - "ExecutionRuleGuids": null, - "DisplayName": "Baseline Rule", - "StorageBindings": null, - "EvaluateRulePerComponent": false, - "IsAdvancedRule": false, - "ContentContainsSensitiveInformation": [ - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Individual Taxpayer Identification Number (ITIN)", - "mincount": "1", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "High", - "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", - "minconfidence": "85", - "classifiertype": "Content", - "name": "Credit Card Number", - "mincount": "1", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Social Security Number (SSN)", - "mincount": "1", - "maxcount": "-1" - } - ], - "ExceptIfContentContainsSensitiveInformation": null, - "ContentMissingSensitivityLabel": null, - "ContentIsNotLabeled": false, - "DocumentCreatedBy": [ - - ], - "ExceptIfDocumentCreatedBy": [ - - ], - "DocumentSizeOver": "", - "ExceptIfDocumentSizeOver": "", - "DocumentNameMatchesWords": [ - - ], - "ExceptIfDocumentNameMatchesWords": [ - - ], - "AccessScope": null, - "NonBifurcatingAccessScope": null, - "ExceptIfAccessScope": null, - "FromScope": null, - "ExceptIfFromScope": null, - "WithImportance": null, - "ExceptIfWithImportance": null, - "ExternalScenarioDependancies": { - "ProtectionAlertId": "b314399f-5d64-4c49-98c3-06deb1be2b6f" - }, - "ContentPropertyContainsWords": [ - - ], - "ExceptIfContentPropertyContainsWords": [ - - ], - "From": null, - "ExceptIfFrom": null, - "FromMemberOf": null, - "ExceptIfFromMemberOf": null, - "DocumentIsUnsupported": false, - "ExceptIfDocumentIsUnsupported": false, - "HasSenderOverride": false, - "ExceptIfHasSenderOverride": false, - "RestrictBrowserAccess": false, - "ProcessingLimitExceeded": false, - "ExceptIfProcessingLimitExceeded": false, - "SentTo": [ - - ], - "ExceptIfSentTo": [ - - ], - "RecipientDomainIs": [ - - ], - "ExceptIfRecipientDomainIs": [ - - ], - "DocumentIsPasswordProtected": false, - "ExceptIfDocumentIsPasswordProtected": false, - "SenderIPRanges": [ - - ], - "ExceptIfSenderIPRanges": [ - - ], - "ContentExtensionMatchesWords": [ - - ], - "ExceptIfContentExtensionMatchesWords": [ - - ], - "ContentFileTypeMatches": [ - - ], - "ExceptIfContentFileTypeMatches": [ - - ], - "HeaderMatchesPatterns": null, - "ExceptIfHeaderMatchesPatterns": null, - "SubjectMatchesPatterns": [ - - ], - "ExceptIfSubjectMatchesPatterns": [ - - ], - "AnyOfRecipientAddressContainsWords": [ - - ], - "ExceptIfAnyOfRecipientAddressContainsWords": [ - - ], - "AnyOfRecipientAddressMatchesPatterns": [ - - ], - "ExceptIfAnyOfRecipientAddressMatchesPatterns": [ - - ], - "FromAddressMatchesPatterns": [ - - ], - "ExceptIfFromAddressMatchesPatterns": [ - - ], - "FromAddressContainsWords": [ - - ], - "ExceptIfFromAddressContainsWords": [ - - ], - "SenderDomainIs": [ - - ], - "ExceptIfSenderDomainIs": [ - - ], - "SentToMemberOf": null, - "ExceptIfSentToMemberOf": null, - "DocumentCreatedByMemberOf": null, - "ExceptIfDocumentCreatedByMemberOf": null, - "HasLabelDowngradedFrom": [ - - ], - "ContentIsShared": false, - "ExceptIfContentIsShared": false, - "SharedByIRMUserRisk": [ - - ], - "RuleErrorAction": null, - "RuleXml": "", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", - "Priority": 0, - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", - "Policy": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", - "Comment": "Blocks the minimum items prescribed in the baseline: credit card numbers, TIN numbers, and SSN numbers.", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "c54e50b4-fb46-494d-9ad3-08db45bd017e", - "MaximumBlobRuleLength": 0, - "CreatedBy": "Alden Hilton - CTR", - "LastModifiedBy": "Addam Schroll", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Baseline Rule", - "DistinguishedName": "CN=Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1682448227000)/", - "WhenCreated": "/Date(1651250001000)/", - "WhenChangedUTC": "/Date(1682448227000)/", - "WhenCreatedUTC": "/Date(1651250001000)/", - "ExchangeObjectId": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "Changed", - "IsObjectUnderSystemOperation": false + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "5136a095-5cf0-4aff-bec3-e84448b38ea5", + "ServicePlanName": "MIP_S_CLP1", + "AdditionalProperties": {} }, { - "SubjectContainsWords": [ - - ], - "ExceptIfSubjectContainsWords": [ - - ], - "SubjectOrBodyMatchesPatterns": [ - - ], - "ExceptIfSubjectOrBodyMatchesPatterns": [ - - ], - "SubjectOrBodyContainsWords": [ - - ], - "ExceptIfSubjectOrBodyContainsWords": [ - - ], - "DocumentMatchesPatterns": [ - - ], - "ExceptIfDocumentMatchesPatterns": [ - - ], - "DocumentContainsWords": [ - - ], - "ExceptIfDocumentContainsWords": [ - - ], - "SenderADAttributeMatchesPatterns": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "SenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ContentCharacterSetContainsWords": [ - - ], - "ExceptIfContentCharacterSetContainsWords": [ - - ], - "DocumentNameMatchesPatterns": [ - - ], - "ExceptIfDocumentNameMatchesPatterns": [ - - ], - "MessageSizeOver": "", - "ExceptIfMessageSizeOver": "", - "MessageTypeMatches": null, - "ExceptIfMessageTypeMatches": null, - "UnscannableDocumentExtensionIs": [ - - ], - "ExceptIfUnscannableDocumentExtensionIs": [ - - ], - "HeaderContainsWords": null, - "ExceptIfHeaderContainsWords": null, - "DeviceManagementType": null, - "ExceptIfDeviceManagementType": null, - "AccessedBy": [ - - ], - "ExceptIfAccessedBy": [ - - ], - "AccessedByMemberOf": [ - - ], - "ExceptIfAccessedByMemberOf": [ - - ], - "BlockAccess": false, - "BlockAccessScope": null, - "EncryptRMSTemplate": null, - "EnforcePortalAccess": true, - "ApplyBrandingTemplate": "", - "RemoveRMSTemplate": false, - "EndpointDlpRestrictions": null, - "EndpointDlpBrowserRestrictions": null, - "ThirdPartyAppDlpRestrictions": null, - "OnPremisesScannerDlpRestrictions": null, - "PowerBIDlpRestrictions": null, - "AlertProperties": null, - "GenerateAlert": [ - - ], - "GenerateIncidentReport": [ - - ], - "IncidentReportContent": null, - "NotifyUser": [ - "SiteAdmin", - "LastModifier", - "Owner" - ], - "NotifyAllowOverride": null, - "NotifyEmailCustomText": "", - "NotifyEmailCustomSubject": "", - "NotifyEmailCustomSenderDisplayName": "", - "NotifyEmailExchangeIncludeAttachment": true, - "NotifyEmailOnedriveRemediationActions": "NotSet", - "NotifyJustificationCustomText": "", - "NotifyJustificationCustomTextTranslations": [ - - ], - "NotifyPolicyTipCustomText": "", - "NotifyUserType": "NotSet", - "NotifyPolicyTipCustomTextTranslations": [ - - ], - "NotifyOverrideRequirements": "None", - "NotifyPolicyTipDisplayOption": "Tip", - "NotifyPolicyTipUrl": "", - "NotifyEndpointUser": null, - "RemoveHeader": [ - - ], - "AccessTimeControl": null, - "StopPolicyProcessing": false, - "SetHeader": null, - "AddRecipients": null, - "Moderate": null, - "ModifySubject": null, - "MapRecipients": null, - "RedirectMessageTo": null, - "PrependSubject": "", - "ApplyHtmlDisclaimer": null, - "Quarantine": false, - "TriggerPowerAutomateFlow": "", - "RestrictAccess": null, - "Guid": "f2e78982-66b6-488a-a43a-e921800f6304", - "AdvancedRuleBuilderContext": null, - "ParentPolicyName": "agency DLP Policy for PII", - "ReportSeverityLevel": "Low", - "ActivationDate": null, - "ExpiryDate": null, - "SenderType": null, - "SenderAddressLocation": null, - "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '9',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", - "ExecutionRuleGuids": null, - "DisplayName": "Low volume of content detected agency DLP Policy for PII", - "StorageBindings": null, - "EvaluateRulePerComponent": false, - "IsAdvancedRule": false, - "ContentContainsSensitiveInformation": [ - { - "maxconfidence": "100", - "confidencelevel": "High", - "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", - "minconfidence": "85", - "classifiertype": "Content", - "name": "Credit Card Number", - "mincount": "1", - "maxcount": "9" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Bank Account Number", - "mincount": "1", - "maxcount": "9" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", - "minconfidence": "75", - "classifiertype": "Content", - "name": "ABA Routing Number", - "mincount": "1", - "maxcount": "9" - } - ], - "ExceptIfContentContainsSensitiveInformation": null, - "ContentMissingSensitivityLabel": null, - "ContentIsNotLabeled": false, - "DocumentCreatedBy": [ - - ], - "ExceptIfDocumentCreatedBy": [ - - ], - "DocumentSizeOver": "", - "ExceptIfDocumentSizeOver": "", - "DocumentNameMatchesWords": [ - - ], - "ExceptIfDocumentNameMatchesWords": [ - - ], - "AccessScope": "NotInOrganization", - "NonBifurcatingAccessScope": null, - "ExceptIfAccessScope": null, - "FromScope": null, - "ExceptIfFromScope": null, - "WithImportance": null, - "ExceptIfWithImportance": null, - "ExternalScenarioDependancies": { - - }, - "ContentPropertyContainsWords": [ - - ], - "ExceptIfContentPropertyContainsWords": [ - - ], - "From": null, - "ExceptIfFrom": null, - "FromMemberOf": null, - "ExceptIfFromMemberOf": null, - "DocumentIsUnsupported": false, - "ExceptIfDocumentIsUnsupported": false, - "HasSenderOverride": false, - "ExceptIfHasSenderOverride": false, - "RestrictBrowserAccess": false, - "ProcessingLimitExceeded": false, - "ExceptIfProcessingLimitExceeded": false, - "SentTo": [ - - ], - "ExceptIfSentTo": [ - - ], - "RecipientDomainIs": [ - - ], - "ExceptIfRecipientDomainIs": [ - - ], - "DocumentIsPasswordProtected": false, - "ExceptIfDocumentIsPasswordProtected": false, - "SenderIPRanges": [ - - ], - "ExceptIfSenderIPRanges": [ - - ], - "ContentExtensionMatchesWords": [ - - ], - "ExceptIfContentExtensionMatchesWords": [ - - ], - "ContentFileTypeMatches": [ - - ], - "ExceptIfContentFileTypeMatches": [ - - ], - "HeaderMatchesPatterns": null, - "ExceptIfHeaderMatchesPatterns": null, - "SubjectMatchesPatterns": [ - - ], - "ExceptIfSubjectMatchesPatterns": [ - - ], - "AnyOfRecipientAddressContainsWords": [ - - ], - "ExceptIfAnyOfRecipientAddressContainsWords": [ - - ], - "AnyOfRecipientAddressMatchesPatterns": [ - - ], - "ExceptIfAnyOfRecipientAddressMatchesPatterns": [ - - ], - "FromAddressMatchesPatterns": [ - - ], - "ExceptIfFromAddressMatchesPatterns": [ - - ], - "FromAddressContainsWords": [ - - ], - "ExceptIfFromAddressContainsWords": [ - - ], - "SenderDomainIs": [ - - ], - "ExceptIfSenderDomainIs": [ - - ], - "SentToMemberOf": null, - "ExceptIfSentToMemberOf": null, - "DocumentCreatedByMemberOf": null, - "ExceptIfDocumentCreatedByMemberOf": null, - "HasLabelDowngradedFrom": [ - - ], - "ContentIsShared": false, - "ExceptIfContentIsShared": false, - "SharedByIRMUserRisk": [ - - ], - "RuleErrorAction": null, - "RuleXml": "", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "3dc18322-891b-436e-8240-755f95fef33c", - "Priority": 0, - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", - "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", - "Comment": "", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "f6f7ec90-c0aa-4ae4-e784-08dafa37f4cf", - "MaximumBlobRuleLength": 0, - "CreatedBy": "d459e626-e311-4242-bb40-263313097103", - "LastModifiedBy": "Addam Schroll", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Low volume of content detected agency DLP Policy for PII", - "DistinguishedName": "CN=Low volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1674144746000)/", - "WhenCreated": "/Date(1618318043000)/", - "WhenChangedUTC": "/Date(1674144746000)/", - "WhenCreatedUTC": "/Date(1618318043000)/", - "ExchangeObjectId": "f2e78982-66b6-488a-a43a-e921800f6304", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "Changed", - "IsObjectUnderSystemOperation": false + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "efb0351d-3b08-4503-993d-383af8de41e3", + "ServicePlanName": "MIP_S_CLP2", + "AdditionalProperties": {} }, { - "SubjectContainsWords": [ - - ], - "ExceptIfSubjectContainsWords": [ - - ], - "SubjectOrBodyMatchesPatterns": [ - - ], - "ExceptIfSubjectOrBodyMatchesPatterns": [ - - ], - "SubjectOrBodyContainsWords": [ - - ], - "ExceptIfSubjectOrBodyContainsWords": [ - - ], - "DocumentMatchesPatterns": [ - - ], - "ExceptIfDocumentMatchesPatterns": [ - - ], - "DocumentContainsWords": [ - - ], - "ExceptIfDocumentContainsWords": [ - - ], - "SenderADAttributeMatchesPatterns": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "SenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ContentCharacterSetContainsWords": [ - - ], - "ExceptIfContentCharacterSetContainsWords": [ - - ], - "DocumentNameMatchesPatterns": [ - - ], - "ExceptIfDocumentNameMatchesPatterns": [ - - ], - "MessageSizeOver": "", - "ExceptIfMessageSizeOver": "", - "MessageTypeMatches": null, - "ExceptIfMessageTypeMatches": null, - "UnscannableDocumentExtensionIs": [ - - ], - "ExceptIfUnscannableDocumentExtensionIs": [ - - ], - "HeaderContainsWords": null, - "ExceptIfHeaderContainsWords": null, - "DeviceManagementType": null, - "ExceptIfDeviceManagementType": null, - "AccessedBy": [ - - ], - "ExceptIfAccessedBy": [ - - ], - "AccessedByMemberOf": [ - - ], - "ExceptIfAccessedByMemberOf": [ - - ], - "BlockAccess": false, - "BlockAccessScope": null, - "EncryptRMSTemplate": null, - "EnforcePortalAccess": true, - "ApplyBrandingTemplate": "", - "RemoveRMSTemplate": false, - "EndpointDlpRestrictions": null, - "EndpointDlpBrowserRestrictions": null, - "ThirdPartyAppDlpRestrictions": null, - "OnPremisesScannerDlpRestrictions": null, - "PowerBIDlpRestrictions": null, - "AlertProperties": null, - "GenerateAlert": [ - - ], - "GenerateIncidentReport": [ - - ], - "IncidentReportContent": null, - "NotifyUser": [ - "LastModifier", - "SiteAdmin", - "Owner" - ], - "NotifyAllowOverride": null, - "NotifyEmailCustomText": "", - "NotifyEmailCustomSubject": "", - "NotifyEmailCustomSenderDisplayName": "", - "NotifyEmailExchangeIncludeAttachment": true, - "NotifyEmailOnedriveRemediationActions": "NotSet", - "NotifyJustificationCustomText": "", - "NotifyJustificationCustomTextTranslations": [ - - ], - "NotifyPolicyTipCustomText": "", - "NotifyUserType": "NotSet", - "NotifyPolicyTipCustomTextTranslations": [ - - ], - "NotifyOverrideRequirements": "None", - "NotifyPolicyTipDisplayOption": "Tip", - "NotifyPolicyTipUrl": "", - "NotifyEndpointUser": null, - "RemoveHeader": [ - - ], - "AccessTimeControl": null, - "StopPolicyProcessing": false, - "SetHeader": null, - "AddRecipients": null, - "Moderate": null, - "ModifySubject": null, - "MapRecipients": null, - "RedirectMessageTo": null, - "PrependSubject": "", - "ApplyHtmlDisclaimer": null, - "Quarantine": false, - "TriggerPowerAutomateFlow": "", - "RestrictAccess": null, - "Guid": "8c40d462-f7c0-434d-bd37-d35c083c297a", - "AdvancedRuleBuilderContext": null, - "ParentPolicyName": "agency DLP Policy for PII", - "ReportSeverityLevel": "High", - "ActivationDate": null, - "ExpiryDate": null, - "SenderType": null, - "SenderAddressLocation": null, - "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", - "ExecutionRuleGuids": null, - "DisplayName": "High volume of content detected agency DLP Policy for PII", - "StorageBindings": null, - "EvaluateRulePerComponent": false, - "IsAdvancedRule": false, - "ContentContainsSensitiveInformation": [ - { - "maxconfidence": "100", - "confidencelevel": "High", - "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", - "minconfidence": "85", - "classifiertype": "Content", - "name": "Credit Card Number", - "mincount": "10", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Bank Account Number", - "mincount": "10", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", - "minconfidence": "75", - "classifiertype": "Content", - "name": "ABA Routing Number", - "mincount": "10", - "maxcount": "-1" - } - ], - "ExceptIfContentContainsSensitiveInformation": null, - "ContentMissingSensitivityLabel": null, - "ContentIsNotLabeled": false, - "DocumentCreatedBy": [ - - ], - "ExceptIfDocumentCreatedBy": [ - - ], - "DocumentSizeOver": "", - "ExceptIfDocumentSizeOver": "", - "DocumentNameMatchesWords": [ - - ], - "ExceptIfDocumentNameMatchesWords": [ - - ], - "AccessScope": "NotInOrganization", - "NonBifurcatingAccessScope": null, - "ExceptIfAccessScope": null, - "FromScope": null, - "ExceptIfFromScope": null, - "WithImportance": null, - "ExceptIfWithImportance": null, - "ExternalScenarioDependancies": { - - }, - "ContentPropertyContainsWords": [ - - ], - "ExceptIfContentPropertyContainsWords": [ - - ], - "From": null, - "ExceptIfFrom": null, - "FromMemberOf": null, - "ExceptIfFromMemberOf": null, - "DocumentIsUnsupported": false, - "ExceptIfDocumentIsUnsupported": false, - "HasSenderOverride": false, - "ExceptIfHasSenderOverride": false, - "RestrictBrowserAccess": false, - "ProcessingLimitExceeded": false, - "ExceptIfProcessingLimitExceeded": false, - "SentTo": [ - - ], - "ExceptIfSentTo": [ - - ], - "RecipientDomainIs": [ - - ], - "ExceptIfRecipientDomainIs": [ - - ], - "DocumentIsPasswordProtected": false, - "ExceptIfDocumentIsPasswordProtected": false, - "SenderIPRanges": [ - - ], - "ExceptIfSenderIPRanges": [ - - ], - "ContentExtensionMatchesWords": [ - - ], - "ExceptIfContentExtensionMatchesWords": [ - - ], - "ContentFileTypeMatches": [ - - ], - "ExceptIfContentFileTypeMatches": [ - - ], - "HeaderMatchesPatterns": null, - "ExceptIfHeaderMatchesPatterns": null, - "SubjectMatchesPatterns": [ - - ], - "ExceptIfSubjectMatchesPatterns": [ - - ], - "AnyOfRecipientAddressContainsWords": [ - - ], - "ExceptIfAnyOfRecipientAddressContainsWords": [ - - ], - "AnyOfRecipientAddressMatchesPatterns": [ - - ], - "ExceptIfAnyOfRecipientAddressMatchesPatterns": [ - - ], - "FromAddressMatchesPatterns": [ - - ], - "ExceptIfFromAddressMatchesPatterns": [ - - ], - "FromAddressContainsWords": [ - - ], - "ExceptIfFromAddressContainsWords": [ - - ], - "SenderDomainIs": [ - - ], - "ExceptIfSenderDomainIs": [ - - ], - "SentToMemberOf": null, - "ExceptIfSentToMemberOf": null, - "DocumentCreatedByMemberOf": null, - "ExceptIfDocumentCreatedByMemberOf": null, - "HasLabelDowngradedFrom": [ - - ], - "ContentIsShared": false, - "ExceptIfContentIsShared": false, - "SharedByIRMUserRisk": [ - - ], - "RuleErrorAction": null, - "RuleXml": "", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "b933b4dd-4152-4d9a-b4b5-0376f8b57d6d", - "Priority": 1, - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", - "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", - "Comment": "", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "daf9a24d-19dd-4978-51b9-08dafa37f6c9", - "MaximumBlobRuleLength": 0, - "CreatedBy": "d459e626-e311-4242-bb40-263313097103", - "LastModifiedBy": "Addam Schroll", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "High volume of content detected agency DLP Policy for PII", - "DistinguishedName": "CN=High volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1674144749000)/", - "WhenCreated": "/Date(1618318041000)/", - "WhenChangedUTC": "/Date(1674144749000)/", - "WhenCreatedUTC": "/Date(1618318041000)/", - "ExchangeObjectId": "8c40d462-f7c0-434d-bd37-d35c083c297a", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "Changed", - "IsObjectUnderSystemOperation": false + "AppliesTo": "Company", + "ProvisioningStatus": "Success", + "ServicePlanId": "d9fa6af4-e046-4c89-9226-729a0786685d", + "ServicePlanName": "Content_Explorer", + "AdditionalProperties": {} }, { - "SubjectContainsWords": [ - - ], - "ExceptIfSubjectContainsWords": [ - - ], - "SubjectOrBodyMatchesPatterns": [ - - ], - "ExceptIfSubjectOrBodyMatchesPatterns": [ - - ], - "SubjectOrBodyContainsWords": [ - - ], - "ExceptIfSubjectOrBodyContainsWords": [ - - ], - "DocumentMatchesPatterns": [ - - ], - "ExceptIfDocumentMatchesPatterns": [ - - ], - "DocumentContainsWords": [ - - ], - "ExceptIfDocumentContainsWords": [ - - ], - "SenderADAttributeMatchesPatterns": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "SenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ContentCharacterSetContainsWords": [ - - ], - "ExceptIfContentCharacterSetContainsWords": [ - - ], - "DocumentNameMatchesPatterns": [ - - ], - "ExceptIfDocumentNameMatchesPatterns": [ - - ], - "MessageSizeOver": "", - "ExceptIfMessageSizeOver": "", - "MessageTypeMatches": null, - "ExceptIfMessageTypeMatches": null, - "UnscannableDocumentExtensionIs": [ - - ], - "ExceptIfUnscannableDocumentExtensionIs": [ - - ], - "HeaderContainsWords": null, - "ExceptIfHeaderContainsWords": null, - "DeviceManagementType": null, - "ExceptIfDeviceManagementType": null, - "AccessedBy": [ - - ], - "ExceptIfAccessedBy": [ - - ], - "AccessedByMemberOf": [ - - ], - "ExceptIfAccessedByMemberOf": [ - - ], - "BlockAccess": true, - "BlockAccessScope": "All", - "EncryptRMSTemplate": null, - "EnforcePortalAccess": true, - "ApplyBrandingTemplate": "", - "RemoveRMSTemplate": false, - "EndpointDlpRestrictions": null, - "EndpointDlpBrowserRestrictions": null, - "ThirdPartyAppDlpRestrictions": null, - "OnPremisesScannerDlpRestrictions": null, - "PowerBIDlpRestrictions": null, - "AlertProperties": { - "AggregationType": "None" - }, - "GenerateAlert": [ - "true" - ], - "GenerateIncidentReport": [ - - ], - "IncidentReportContent": null, - "NotifyUser": [ - - ], - "NotifyAllowOverride": null, - "NotifyEmailCustomText": "", - "NotifyEmailCustomSubject": "", - "NotifyEmailCustomSenderDisplayName": "", - "NotifyEmailExchangeIncludeAttachment": true, - "NotifyEmailOnedriveRemediationActions": null, - "NotifyJustificationCustomText": "", - "NotifyJustificationCustomTextTranslations": [ - - ], - "NotifyPolicyTipCustomText": "", - "NotifyUserType": null, - "NotifyPolicyTipCustomTextTranslations": [ - - ], - "NotifyOverrideRequirements": null, - "NotifyPolicyTipDisplayOption": null, - "NotifyPolicyTipUrl": "", - "NotifyEndpointUser": null, - "RemoveHeader": [ - - ], - "AccessTimeControl": null, - "StopPolicyProcessing": false, - "SetHeader": null, - "AddRecipients": null, - "Moderate": null, - "ModifySubject": null, - "MapRecipients": null, - "RedirectMessageTo": null, - "PrependSubject": "", - "ApplyHtmlDisclaimer": null, - "Quarantine": false, - "TriggerPowerAutomateFlow": "", - "RestrictAccess": null, - "Guid": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", - "AdvancedRuleBuilderContext": null, - "ParentPolicyName": "MS.DEFENDER.4.1v1 Test", - "ReportSeverityLevel": "Low", - "ActivationDate": null, - "ExpiryDate": null, - "SenderType": null, - "SenderAddressLocation": null, - "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", - "ExecutionRuleGuids": null, - "DisplayName": "PII Check", - "StorageBindings": null, - "EvaluateRulePerComponent": false, - "IsAdvancedRule": false, - "ContentContainsSensitiveInformation": [ - { - "maxconfidence": "100", - "confidencelevel": "High", - "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", - "minconfidence": "85", - "classifiertype": "Content", - "name": "Credit Card Number", - "mincount": "1", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Individual Taxpayer Identification Number (ITIN)", - "mincount": "1", - "maxcount": "-1" - }, - { - "maxconfidence": "100", - "confidencelevel": "Medium", - "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", - "minconfidence": "75", - "classifiertype": "Content", - "name": "U.S. Social Security Number (SSN)", - "mincount": "1", - "maxcount": "-1" - } - ], - "ExceptIfContentContainsSensitiveInformation": null, - "ContentMissingSensitivityLabel": null, - "ContentIsNotLabeled": false, - "DocumentCreatedBy": [ - - ], - "ExceptIfDocumentCreatedBy": [ - - ], - "DocumentSizeOver": "", - "ExceptIfDocumentSizeOver": "", - "DocumentNameMatchesWords": [ - - ], - "ExceptIfDocumentNameMatchesWords": [ - - ], - "AccessScope": null, - "NonBifurcatingAccessScope": null, - "ExceptIfAccessScope": null, - "FromScope": null, - "ExceptIfFromScope": null, - "WithImportance": null, - "ExceptIfWithImportance": null, - "ExternalScenarioDependancies": { - "ProtectionAlertId": "37a2473a-9a91-4790-a96f-a93db6da9d55" - }, - "ContentPropertyContainsWords": [ - - ], - "ExceptIfContentPropertyContainsWords": [ - - ], - "From": null, - "ExceptIfFrom": null, - "FromMemberOf": null, - "ExceptIfFromMemberOf": null, - "DocumentIsUnsupported": false, - "ExceptIfDocumentIsUnsupported": false, - "HasSenderOverride": false, - "ExceptIfHasSenderOverride": false, - "RestrictBrowserAccess": false, - "ProcessingLimitExceeded": false, - "ExceptIfProcessingLimitExceeded": false, - "SentTo": [ - - ], - "ExceptIfSentTo": [ - - ], - "RecipientDomainIs": [ - - ], - "ExceptIfRecipientDomainIs": [ - - ], - "DocumentIsPasswordProtected": false, - "ExceptIfDocumentIsPasswordProtected": false, - "SenderIPRanges": [ - - ], - "ExceptIfSenderIPRanges": [ - - ], - "ContentExtensionMatchesWords": [ - - ], - "ExceptIfContentExtensionMatchesWords": [ - - ], - "ContentFileTypeMatches": [ - - ], - "ExceptIfContentFileTypeMatches": [ - - ], - "HeaderMatchesPatterns": null, - "ExceptIfHeaderMatchesPatterns": null, - "SubjectMatchesPatterns": [ - - ], - "ExceptIfSubjectMatchesPatterns": [ - - ], - "AnyOfRecipientAddressContainsWords": [ - - ], - "ExceptIfAnyOfRecipientAddressContainsWords": [ - - ], - "AnyOfRecipientAddressMatchesPatterns": [ - - ], - "ExceptIfAnyOfRecipientAddressMatchesPatterns": [ - - ], - "FromAddressMatchesPatterns": [ - - ], - "ExceptIfFromAddressMatchesPatterns": [ - - ], - "FromAddressContainsWords": [ - - ], - "ExceptIfFromAddressContainsWords": [ - - ], - "SenderDomainIs": [ - - ], - "ExceptIfSenderDomainIs": [ - - ], - "SentToMemberOf": null, - "ExceptIfSentToMemberOf": null, - "DocumentCreatedByMemberOf": null, - "ExceptIfDocumentCreatedByMemberOf": null, - "HasLabelDowngradedFrom": [ - - ], - "ContentIsShared": false, - "ExceptIfContentIsShared": false, - "SharedByIRMUserRisk": [ - - ], - "RuleErrorAction": null, - "RuleXml": "", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "9a7b93f6-6c70-474c-854a-82116ce288ef", - "Priority": 0, - "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", - "Policy": "cfe272a6-564c-4c7b-96c7-8d187487a755", - "Comment": "", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "825da2a8-5b6d-499b-6b2a-08db9cf8a96b", - "MaximumBlobRuleLength": 0, - "CreatedBy": "Addam Schroll", - "LastModifiedBy": "Addam Schroll", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "PII Check", - "DistinguishedName": "CN=PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1692039601000)/", - "WhenCreated": "/Date(1692039601000)/", - "WhenChangedUTC": "/Date(1692039601000)/", - "WhenCreatedUTC": "/Date(1692039601000)/", - "ExchangeObjectId": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "New", - "IsObjectUnderSystemOperation": false + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "843da3a8-d2cc-4e7a-9e90-dc46019f964c", + "ServicePlanName": "FORMS_GOV_E5", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "8c3069c0-ccdb-44be-ab77-986203a67df2", + "ServicePlanName": "EXCHANGE_S_ENTERPRISE_GOV", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "89b5d3b1-3855-49fe-b46c-87c66dbc1526", + "ServicePlanName": "LOCKBOX_ENTERPRISE_GOV", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "1b66aedf-8ca1-4f73-af76-ec76c6180f98", + "ServicePlanName": "RMS_S_PREMIUM_GOV", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "5400a66d-eaa5-427d-80f2-0f26d59d8fce", + "ServicePlanName": "RMS_S_PREMIUM2_GOV", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "6a76346d-5d6e-4051-9fe3-ed3f312b5597", + "ServicePlanName": "RMS_S_ENTERPRISE_GOV", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "eec0eb4f-6444-4f95-aba0-50c24d67f998", + "ServicePlanName": "AAD_PREMIUM_P2", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "41781fb2-bc02-4b7c-bd55-b576c07bb09d", + "ServicePlanName": "AAD_PREMIUM", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "e26c2fcc-ab91-4a61-b35c-03cdc8dddf66", + "ServicePlanName": "INFO_GOVERNANCE", + "AdditionalProperties": {} + }, + { + "AppliesTo": "User", + "ProvisioningStatus": "Success", + "ServicePlanId": "871d91ec-ec1a-452b-a83f-bd76c7d770ef", + "ServicePlanName": "WINDEFATP", + "AdditionalProperties": {} } -], - "malware_filter_policies": [ + ], + "directory_settings": [ { - "AdminDisplayName": "", - "CustomExternalBody": "", - "CustomExternalSubject": "", - "CustomInternalBody": "", - "CustomInternalSubject": "", - "CustomFromAddress": "", - "CustomFromName": "", - "CustomNotifications": false, - "EnableExternalSenderAdminNotifications": false, - "EnableFileFilter": true, - "EnableInternalSenderAdminNotifications": false, - "ExternalSenderAdminAddress": "", - "FileTypeAction": "Reject", - "FileTypes": null, - "InternalSenderAdminAddress": "", - "IsDefault": false, - "IsPolicyOverrideApplied": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Strict", - "ZapEnabled": true, - "Identity": "Strict Preset Security Policy1681329957931", - "Id": "Strict Preset Security Policy1681329957931", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Strict Preset Security Policy1681329957931", - "DistinguishedName": "CN=Strict Preset Security Policy1681329957931,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", - "ObjectClass": [ - "top", - "msExchMalwareFilterConfig" - ], - "WhenChanged": "/Date(1681329967000)/", - "WhenCreated": "/Date(1681329958000)/", - "WhenChangedUTC": "/Date(1681329967000)/", - "WhenCreatedUTC": "/Date(1681329958000)/", - "ExchangeObjectId": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "DisplayName": "Group.Unified", + "Id": "5ce54204-ef8d-44c5-af88-dc8bd4c16069", + "TemplateId": "62375ab9-6b52-47ed-826b-58e47e0e304b", + "Values": [ + { + "Name": "NewUnifiedGroupWritebackDefault", + "Value": "true" + }, + { + "Name": "EnableMIPLabels", + "Value": "False" + }, + { + "Name": "CustomBlockedWordsList", + "Value": "" + }, + { + "Name": "EnableMSStandardBlockedWords", + "Value": "False" + }, + { + "Name": "ClassificationDescriptions", + "Value": "" + }, + { + "Name": "DefaultClassification", + "Value": "" + }, + { + "Name": "PrefixSuffixNamingRequirement", + "Value": "" + }, + { + "Name": "AllowGuestsToBeGroupOwner", + "Value": "False" + }, + { + "Name": "AllowGuestsToAccessGroups", + "Value": "True" + }, + { + "Name": "GuestUsageGuidelinesUrl", + "Value": "" + }, + { + "Name": "GroupCreationAllowedGroupId", + "Value": "67f62883-f97a-4192-a300-8a1576af8056" + }, + { + "Name": "AllowToAddGuests", + "Value": "True" + }, + { + "Name": "UsageGuidelinesUrl", + "Value": "" + }, + { + "Name": "ClassificationList", + "Value": "" + }, + { + "Name": "EnableGroupCreation", + "Value": "False" + } + ], + "AdditionalProperties": {} }, { - "AdminDisplayName": "", - "CustomExternalBody": "", - "CustomExternalSubject": "", - "CustomInternalBody": "", - "CustomInternalSubject": "", - "CustomFromAddress": "", - "CustomFromName": "", - "CustomNotifications": false, - "EnableExternalSenderAdminNotifications": false, - "EnableFileFilter": true, - "EnableInternalSenderAdminNotifications": false, - "ExternalSenderAdminAddress": "", - "FileTypeAction": "Reject", - "FileTypes": [ - "ace", - "ani", - "apk", - "app", - "appx", - "arj", - "bat", - "cab", - "cmd", - "com", - "deb", - "dex", - "dll", - "docm", - "elf", - "exe", - "hta", - "img", - "iso", - "jar", - "jnlp", - "kext", - "lha", - "lib", - "library", - "lnk", - "lzh", - "macho", - "msc", - "msi", - "msix", - "msp", - "mst", - "pif", - "ppa", - "ppam", - "ps1", - "ps2", - "reg", - "rev", - "scf", - "scr", - "sct", - "sys", - "uif", - "vb", - "vbe", - "vbs", - "vxd", - "wsc", - "wsf", - "wsh", - "xll", - "xz", - "z" - ], - "InternalSenderAdminAddress": "", - "IsDefault": true, - "IsPolicyOverrideApplied": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Custom", - "ZapEnabled": true, - "Identity": "Default", - "Id": "Default", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Default", - "DistinguishedName": "CN=Default,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", - "ObjectClass": [ - "top", - "msExchMalwareFilterConfig" - ], - "WhenChanged": "/Date(1691001178000)/", - "WhenCreated": "/Date(1619484590000)/", - "WhenChangedUTC": "/Date(1691001178000)/", - "WhenCreatedUTC": "/Date(1619484590000)/", - "ExchangeObjectId": "537d5d48-4157-4f2c-a840-f11be9a5ad50", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "5614934b-8055-41dd-93a4-4f8618ee50ca", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "DisplayName": "Consent Policy Settings", + "Id": "62c1305f-60f0-4096-8d72-e1f74e8627f5", + "TemplateId": "dffd5d46-495d-40a9-8e21-954ff55e198a", + "Values": [ + { + "Name": "EnableGroupSpecificConsent", + "Value": "false" + }, + { + "Name": "BlockUserConsentForRiskyApps", + "Value": "true" + }, + { + "Name": "EnableAdminConsentRequests", + "Value": "true" + }, + { + "Name": "ConstrainGroupSpecificConsentToMembersOfGroupId", + "Value": "" + } + ], + "AdditionalProperties": {} + } + ], + "authentication_method": [ + { + "AuthenticationMethodConfigurations": [ + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration", + "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodConfiguration" + ], + "Description": "The tenant-wide policy that controls which authentication methods are allowed in the tenant, authentication method registration requirements, and self-service password reset settings", + "DisplayName": "Authentication Methods Policy", + "Id": "authenticationMethodsPolicy", + "LastModifiedDateTime": "/Date(1684278552414)/", + "PolicyMigrationState": "preMigration", + "PolicyVersion": "1.5", + "ReconfirmationInDays": null, + "RegistrationEnforcement": { + "AuthenticationMethodsRegistrationCampaign": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphAuthenticationMethodsRegistrationCampaign" + }, + "SystemCredentialPreferences": { + "ExcludeTargets": "", + "IncludeTargets": "Microsoft.Graph.PowerShell.Models.MicrosoftGraphIncludeTarget", + "State": "default" + } + } + ], + "aad_successful_commands": [ + "Get-MgBetaIdentityConditionalAccessPolicy", + "Get-MgBetaSubscribedSku", + "Get-PrivilegedUser", + "Get-PrivilegedRole", + "Get-MgBetaPolicyAuthorizationPolicy", + "Get-MgBetaSecuritySecureScore", + "Get-MgBetaDirectorySetting", + "Get-MgBetaPolicyAuthenticationMethodPolicy" + ], + "aad_unsuccessful_commands": [], + "protection_policy_rules": [ + { + "HostedContentFilterPolicy": "Strict Preset Security Policy1681329956650", + "AntiPhishPolicy": "Strict Preset Security Policy1681329955447", + "MalwareFilterPolicy": "Strict Preset Security Policy1681329957931", + "State": "Enabled", + "Priority": 0, + "Comments": null, + "Description": "Take the following actions:rntApply hosted content filter policy 'Strict Preset Security Policy1681329956650'., Apply AntiPhish policy 'Strict Preset Security Policy1681329955447'., Apply malware filter policy 'Strict Preset Security Policy1681329957931'.rn", + "RuleVersion": { + "Major": 14, + "Minor": 0, + "Build": 0, + "Revision": 0, + "MajorRevision": 0, + "MinorRevision": 0 + }, + "SentTo": null, + "SentToMemberOf": null, + "RecipientDomainIs": null, + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": null, + "Exceptions": null, + "Identity": "Strict Preset Security Policy", + "DistinguishedName": "CN=Strict Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", + "ImmutableId": "78a48310-3db9-46dc-8232-fa0bd0b4e94e", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "Strict Preset Security Policy", + "IsValid": true, + "WhenChanged": "/Date(1689096663000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" }, { - "AdminDisplayName": "", - "CustomExternalBody": "", - "CustomExternalSubject": "", - "CustomInternalBody": "", - "CustomInternalSubject": "", - "CustomFromAddress": "", - "CustomFromName": "", - "CustomNotifications": false, - "EnableExternalSenderAdminNotifications": false, - "EnableFileFilter": true, - "EnableInternalSenderAdminNotifications": false, - "ExternalSenderAdminAddress": "", - "FileTypeAction": "Reject", - "FileTypes": [ - "ace", - "apk", - "app", - "appx", - "ani", - "arj", - "bat", - "cab", - "cmd", - "com", - "deb", - "dex", - "dll", - "docm", - "elf", - "exe", - "hta", - "img", - "iso", - "jar", - "jnlp", - "kext", - "lha", - "lib", - "library", - "lnk", - "lzh", - "macho", - "msc", - "msi", - "msix", - "msp", - "mst", - "pif", - "ppa", - "ppam", - "reg", - "rev", - "scf", - "scr", - "sct", - "sys", - "uif", - "vb", - "vbe", - "vbs", - "vxd", - "wsc", - "wsf", - "wsh", - "xll", - "xz", - "z" - ], - "InternalSenderAdminAddress": "", - "IsDefault": false, - "IsPolicyOverrideApplied": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Standard", - "ZapEnabled": true, - "Identity": "Standard Preset Security Policy1659535435292", - "Id": "Standard Preset Security Policy1659535435292", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Standard Preset Security Policy1659535435292", - "DistinguishedName": "CN=Standard Preset Security Policy1659535435292,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", - "ObjectClass": [ - "top", - "msExchMalwareFilterConfig" - ], - "WhenChanged": "/Date(1688679108000)/", - "WhenCreated": "/Date(1659535435000)/", - "WhenChangedUTC": "/Date(1688679108000)/", - "WhenCreatedUTC": "/Date(1659535435000)/", - "ExchangeObjectId": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "HostedContentFilterPolicy": "Standard Preset Security Policy1659535432883", + "AntiPhishPolicy": "Standard Preset Security Policy1659535429826", + "MalwareFilterPolicy": "Standard Preset Security Policy1659535435292", + "State": "Enabled", + "Priority": 1, + "Comments": null, + "Description": "Take the following actions:rntApply hosted content filter policy 'Standard Preset Security Policy1659535432883'., Apply AntiPhish policy 'Standard Preset Security Policy1659535429826'., Apply malware filter policy 'Standard Preset Security Policy1659535435292'.rn", + "RuleVersion": { + "Major": 14, + "Minor": 0, + "Build": 0, + "Revision": 0, + "MajorRevision": 0, + "MinorRevision": 0 + }, + "SentTo": null, + "SentToMemberOf": null, + "RecipientDomainIs": null, + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": null, + "Exceptions": null, + "Identity": "Standard Preset Security Policy", + "DistinguishedName": "CN=Standard Preset Security Policy,CN=EOPProtectionPolicyRuleVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "83318c49-93e8-497b-8fd3-614b090e6103", + "ImmutableId": "83318c49-93e8-497b-8fd3-614b090e6103", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "Standard Preset Security Policy", + "IsValid": true, + "WhenChanged": "/Date(1690471889000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" } -], - "anti_phish_policies": [ + ], + "dlp_compliance_policies": [ { - "Enabled": true, - "ImpersonationProtectionState": "Automatic", - "EnableTargetedUserProtection": true, - "EnableMailboxIntelligenceProtection": true, - "EnableTargetedDomainsProtection": true, - "EnableOrganizationDomainsProtection": true, - "EnableMailboxIntelligence": true, - "EnableFirstContactSafetyTips": false, - "EnableSimilarUsersSafetyTips": true, - "EnableSimilarDomainsSafetyTips": true, - "EnableUnusualCharactersSafetyTips": true, - "TargetedUserProtectionAction": "Quarantine", - "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "MailboxIntelligenceProtectionAction": "Quarantine", - "MailboxIntelligenceQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "TargetedDomainProtectionAction": "Quarantine", - "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "AuthenticationFailAction": "Quarantine", - "SpoofQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "EnableSpoofIntelligence": true, - "EnableViaTag": true, - "EnableUnauthenticatedSender": true, - "EnableSuspiciousSafetyTip": true, - "HonorDmarcPolicy": true, - "DmarcRejectAction": "Reject", - "DmarcQuarantineAction": "Quarantine", - "PhishThresholdLevel": 4, - "TargetedUsersToProtect": [ - - ], - "TargetedUserActionRecipients": [ - - ], - "MailboxIntelligenceProtectionActionRecipients": [ - - ], - "TargetedDomainsToProtect": [ - - ], - "TargetedDomainActionRecipients": [ - - ], - "ExcludedDomains": [ - - ], - "ExcludedSenders": [ - - ], - "IsDefault": false, - "AdminDisplayName": "", - "PolicyTag": "", - "RecommendedPolicyType": "Strict", - "Identity": "Strict Preset Security Policy1681329955447", - "Id": "Strict Preset Security Policy1681329955447", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Strict Preset Security Policy1681329955447", - "DistinguishedName": "CN=Strict Preset Security Policy1681329955447,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1681329967000)/", - "WhenCreated": "/Date(1681329956000)/", - "WhenChangedUTC": "/Date(1681329967000)/", - "WhenCreatedUTC": "/Date(1681329956000)/", - "ExchangeObjectId": "dd855979-da0e-4109-b218-cebf593d1771", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "dd855979-da0e-4109-b218-cebf593d1771", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Mode": "Enable", + "DisplayName": "Default Office 365 DLP policy", + "Type": "Dlp", + "ExchangeLocation": ["All"], + "SharePointLocation": ["All"], + "SharePointLocationException": [], + "OneDriveLocation": ["All"], + "OneDriveLocationException": [], + "ExchangeOnPremisesLocation": [], + "SharePointOnPremisesLocation": [], + "SharePointOnPremisesLocationException": [], + "TeamsLocation": ["All"], + "TeamsLocationException": [], + "EndpointDlpLocation": ["All"], + "EndpointDlpLocationException": [], + "ThirdPartyAppDlpLocation": [], + "ThirdPartyAppDlpLocationException": [], + "OnPremisesScannerDlpLocation": ["All"], + "OnPremisesScannerDlpLocationException": [], + "PowerBIDlpLocation": [], + "PowerBIDlpLocationException": [], + "ExchangeSender": [], + "ExchangeSenderException": [], + "PolicyTemplateInfo": {}, + "MatchedItemsCount": null, + "TotalItemsCount": null, + "TopNLocationStatistics": null, + "WorkloadStatistics": null, + "IsSimulationPolicy": false, + "SimulationStatus": null, + "AutoEnableAfter": null, + "ExtendedProperties": null, + "Summary": false, + "OneDriveSharedBy": [], + "ExceptIfOneDriveSharedBy": [], + "OneDriveSharedByMemberOf": [], + "ExceptIfOneDriveSharedByMemberOf": [], + "ExchangeSenderMemberOf": [], + "ExchangeSenderMemberOfException": [], + "ExpectedLocations": 0, + "CompletedLocations": 0, + "FailedLocations": 0, + "ItemStatistics": null, + "RuleMatchBlob": null, + "ErrorMetadata": null, + "UserAdministrativeUnitMembershipMap": null, + "ForceValidate": false, + "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-04-25T18:43:47.10409Z'}", + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", + "Priority": 0, + "ObjectVersion": "ed2f16ae-251f-4a91-2908-08db45bd0101", + "CreatedBy": "", + "LastModifiedBy": "Addam Schroll", + "ReadOnly": false, + "ExternalIdentity": "", + "Comment": "This policy detects the presence of credit card numbers in externally shared documents and emails. End users are notified of the detection with the suggestion to consider either removing the sensitive data or restricting the sharing.", + "Enabled": true, + "DistributionStatus": "Pending", + "DistributionResults": null, + "LastStatusUpdateTime": null, + "ModificationTimeUtc": "/Date(1682462627107)/", + "CreationTimeUtc": "/Date(1614652120970)/", + "PolicyRBACScopes": [], + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Default Office 365 DLP policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Default Office 365 DLP policy", + "DistinguishedName": "CN=Default Office 365 DLP policy,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedPolicy"], + "WhenChanged": "/Date(1682448226000)/", + "WhenCreated": "/Date(1617646100000)/", + "WhenChangedUTC": "/Date(1682448226000)/", + "WhenCreatedUTC": "/Date(1617646100000)/", + "ExchangeObjectId": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "Guid": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", + "OriginatingServer": "", + "ObjectState": "Changed" }, { - "Enabled": true, - "ImpersonationProtectionState": "Manual", - "EnableTargetedUserProtection": true, - "EnableMailboxIntelligenceProtection": true, - "EnableTargetedDomainsProtection": true, - "EnableOrganizationDomainsProtection": true, - "EnableMailboxIntelligence": true, - "EnableFirstContactSafetyTips": true, - "EnableSimilarUsersSafetyTips": true, - "EnableSimilarDomainsSafetyTips": true, - "EnableUnusualCharactersSafetyTips": true, - "TargetedUserProtectionAction": "Quarantine", - "TargetedUserQuarantineTag": "DefaultFullAccessPolicy", - "MailboxIntelligenceProtectionAction": "Quarantine", - "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", - "TargetedDomainProtectionAction": "Quarantine", - "TargetedDomainQuarantineTag": "DefaultFullAccessPolicy", - "AuthenticationFailAction": "Quarantine", - "SpoofQuarantineTag": "DefaultFullAccessPolicy", - "EnableSpoofIntelligence": true, - "EnableViaTag": true, - "EnableUnauthenticatedSender": true, - "EnableSuspiciousSafetyTip": false, - "HonorDmarcPolicy": true, - "DmarcRejectAction": "Reject", - "DmarcQuarantineAction": "Quarantine", - "PhishThresholdLevel": 2, - "TargetedUsersToProtect": [ - "ronnie brown - ctr - az;robrown-az@agency.onmicrosoft.com", - "rex trotter;rtrotter-az@agency.onmicrosoft.com", - "tommy williams - ctr - az;tommy.williams-az@agency.onmicrosoft.com" - ], - "TargetedUserActionRecipients": [ - - ], - "MailboxIntelligenceProtectionActionRecipients": [ - - ], - "TargetedDomainsToProtect": [ - "agency.mail.onmicrosoft.com" - ], - "TargetedDomainActionRecipients": [ - - ], - "ExcludedDomains": [ - - ], - "ExcludedSenders": [ - - ], - "IsDefault": true, - "AdminDisplayName": "", - "PolicyTag": "", - "RecommendedPolicyType": "Custom", - "Identity": "Office365 AntiPhish Default", - "Id": "Office365 AntiPhish Default", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Office365 AntiPhish Default", - "DistinguishedName": "CN=Office365 AntiPhish Default,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1661272560000)/", - "WhenCreated": "/Date(1619484591000)/", - "WhenChangedUTC": "/Date(1661272560000)/", - "WhenCreatedUTC": "/Date(1619484591000)/", - "ExchangeObjectId": "84178a51-0850-4bd4-873c-b8eea28e304c", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "1c36a79e-281c-41ac-adf0-441a9ef992c3", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Mode": "Enable", + "DisplayName": "agency DLP Policy for PII", + "Type": "Dlp", + "ExchangeLocation": ["All"], + "SharePointLocation": ["All"], + "SharePointLocationException": [], + "OneDriveLocation": ["All"], + "OneDriveLocationException": [], + "ExchangeOnPremisesLocation": [], + "SharePointOnPremisesLocation": [], + "SharePointOnPremisesLocationException": [], + "TeamsLocation": ["All"], + "TeamsLocationException": [], + "EndpointDlpLocation": [], + "EndpointDlpLocationException": [], + "ThirdPartyAppDlpLocation": [], + "ThirdPartyAppDlpLocationException": [], + "OnPremisesScannerDlpLocation": [], + "OnPremisesScannerDlpLocationException": [], + "PowerBIDlpLocation": [], + "PowerBIDlpLocationException": [], + "ExchangeSender": [], + "ExchangeSenderException": [], + "PolicyTemplateInfo": {}, + "MatchedItemsCount": null, + "TotalItemsCount": null, + "TopNLocationStatistics": null, + "WorkloadStatistics": null, + "IsSimulationPolicy": false, + "SimulationStatus": null, + "AutoEnableAfter": null, + "ExtendedProperties": null, + "Summary": false, + "OneDriveSharedBy": [], + "ExceptIfOneDriveSharedBy": [], + "OneDriveSharedByMemberOf": [], + "ExceptIfOneDriveSharedByMemberOf": [], + "ExchangeSenderMemberOf": [], + "ExchangeSenderMemberOfException": [], + "ExpectedLocations": 0, + "CompletedLocations": 0, + "FailedLocations": 0, + "ItemStatistics": null, + "RuleMatchBlob": null, + "ErrorMetadata": null, + "UserAdministrativeUnitMembershipMap": null, + "ForceValidate": false, + "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-06-14T14:36:08.0311995Z'}", + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", + "Priority": 1, + "ObjectVersion": "9acc0ace-bf62-43ad-0710-08db6ce4b417", + "CreatedBy": "d459e626-e311-4242-bb40-263313097103", + "LastModifiedBy": "Addam Schroll", + "ReadOnly": false, + "ExternalIdentity": "", + "Comment": "", + "Enabled": true, + "DistributionStatus": "Pending", + "DistributionResults": null, + "LastStatusUpdateTime": null, + "ModificationTimeUtc": "/Date(1686767773280)/", + "CreationTimeUtc": "/Date(1618332438880)/", + "PolicyRBACScopes": [], + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/agency DLP Policy for PII", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency DLP Policy for PII", + "DistinguishedName": "CN=agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedPolicy"], + "WhenChanged": "/Date(1686753373000)/", + "WhenCreated": "/Date(1618318038000)/", + "WhenChangedUTC": "/Date(1686753373000)/", + "WhenCreatedUTC": "/Date(1618318038000)/", + "ExchangeObjectId": "b800d92f-a479-47a9-bcfa-306db665aaa1", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "Guid": "b800d92f-a479-47a9-bcfa-306db665aaa1", + "OriginatingServer": "", + "ObjectState": "Changed" }, { - "Enabled": true, - "ImpersonationProtectionState": "Automatic", - "EnableTargetedUserProtection": true, - "EnableMailboxIntelligenceProtection": true, - "EnableTargetedDomainsProtection": true, - "EnableOrganizationDomainsProtection": true, - "EnableMailboxIntelligence": true, - "EnableFirstContactSafetyTips": false, - "EnableSimilarUsersSafetyTips": true, - "EnableSimilarDomainsSafetyTips": true, - "EnableUnusualCharactersSafetyTips": true, - "TargetedUserProtectionAction": "Quarantine", - "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "MailboxIntelligenceProtectionAction": "MoveToJmf", - "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", - "TargetedDomainProtectionAction": "Quarantine", - "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "AuthenticationFailAction": "MoveToJmf", - "SpoofQuarantineTag": "DefaultFullAccessPolicy", - "EnableSpoofIntelligence": true, - "EnableViaTag": true, - "EnableUnauthenticatedSender": true, - "EnableSuspiciousSafetyTip": false, - "HonorDmarcPolicy": true, - "DmarcRejectAction": "Reject", - "DmarcQuarantineAction": "Quarantine", - "PhishThresholdLevel": 3, - "TargetedUsersToProtect": [ - - ], - "TargetedUserActionRecipients": [ - - ], - "MailboxIntelligenceProtectionActionRecipients": [ - - ], - "TargetedDomainsToProtect": [ - - ], - "TargetedDomainActionRecipients": [ - - ], - "ExcludedDomains": [ - - ], - "ExcludedSenders": [ - - ], - "IsDefault": false, - "AdminDisplayName": "", - "PolicyTag": "", - "RecommendedPolicyType": "Standard", - "Identity": "Standard Preset Security Policy1659535429826", - "Id": "Standard Preset Security Policy1659535429826", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Standard Preset Security Policy1659535429826", - "DistinguishedName": "CN=Standard Preset Security Policy1659535429826,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1687302657000)/", - "WhenCreated": "/Date(1659535432000)/", - "WhenChangedUTC": "/Date(1687302657000)/", - "WhenCreatedUTC": "/Date(1659535432000)/", - "ExchangeObjectId": "c039f211-68f7-43e8-822f-91c1e0e018f7", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "c039f211-68f7-43e8-822f-91c1e0e018f7", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Mode": "Enable", + "DisplayName": "MS.DEFENDER.4.1v1 Test", + "Type": "Dlp", + "ExchangeLocation": ["All"], + "SharePointLocation": ["All"], + "SharePointLocationException": [], + "OneDriveLocation": ["All"], + "OneDriveLocationException": [], + "ExchangeOnPremisesLocation": [], + "SharePointOnPremisesLocation": [], + "SharePointOnPremisesLocationException": [], + "TeamsLocation": ["All"], + "TeamsLocationException": [], + "EndpointDlpLocation": ["All"], + "EndpointDlpLocationException": [], + "ThirdPartyAppDlpLocation": [], + "ThirdPartyAppDlpLocationException": [], + "OnPremisesScannerDlpLocation": ["All"], + "OnPremisesScannerDlpLocationException": [], + "PowerBIDlpLocation": [], + "PowerBIDlpLocationException": [], + "ExchangeSender": [], + "ExchangeSenderException": [], + "PolicyTemplateInfo": null, + "MatchedItemsCount": null, + "TotalItemsCount": null, + "TopNLocationStatistics": null, + "WorkloadStatistics": null, + "IsSimulationPolicy": false, + "SimulationStatus": null, + "AutoEnableAfter": null, + "ExtendedProperties": null, + "Summary": false, + "OneDriveSharedBy": [], + "ExceptIfOneDriveSharedBy": [], + "OneDriveSharedByMemberOf": [], + "ExceptIfOneDriveSharedByMemberOf": [], + "ExchangeSenderMemberOf": [], + "ExchangeSenderMemberOfException": [], + "ExpectedLocations": 0, + "CompletedLocations": 0, + "FailedLocations": 0, + "ItemStatistics": null, + "RuleMatchBlob": null, + "ErrorMetadata": null, + "UserAdministrativeUnitMembershipMap": null, + "ForceValidate": false, + "PolicyRulesMetaData": "{'WhenRulesChangedUtc':'2023-08-14T19:00:01.3768698Z'}", + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", + "Priority": 2, + "ObjectVersion": "f7210a5b-91bb-4470-8ffa-08db9cf8a991", + "CreatedBy": "Addam Schroll", + "LastModifiedBy": "Addam Schroll", + "ReadOnly": false, + "ExternalIdentity": "", + "Comment": "Create a custom policy from scratch. You will choose the type of content to protect and how you want to protect it.", + "Enabled": true, + "DistributionStatus": "Pending", + "DistributionResults": null, + "LastStatusUpdateTime": null, + "ModificationTimeUtc": "/Date(1692054001377)/", + "CreationTimeUtc": "/Date(1692053995207)/", + "PolicyRBACScopes": [], + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/MS.DEFENDER.4.1v1 Test", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "MS.DEFENDER.4.1v1 Test", + "DistinguishedName": "CN=MS.DEFENDER.4.1v1 Test,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedPolicy"], + "WhenChanged": "/Date(1692039601000)/", + "WhenCreated": "/Date(1692039595000)/", + "WhenChangedUTC": "/Date(1692039601000)/", + "WhenCreatedUTC": "/Date(1692039595000)/", + "ExchangeObjectId": "cfe272a6-564c-4c7b-96c7-8d187487a755", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "Guid": "cfe272a6-564c-4c7b-96c7-8d187487a755", + "OriginatingServer": "", + "ObjectState": "Changed" } -], - "hosted_content_filter_policies": [ + ], + "dlp_compliance_rules": [ { - "AdminDisplayName": "", - "AddXHeaderValue": "", - "ModifySubjectValue": "", - "RedirectToRecipients": [ - - ], - "TestModeBccToRecipients": [ - - ], - "FalsePositiveAdditionalRecipients": [ - - ], - "QuarantineRetentionPeriod": 30, - "TestModeAction": "None", - "IncreaseScoreWithImageLinks": "Off", - "IncreaseScoreWithNumericIps": "Off", - "IncreaseScoreWithRedirectToOtherPort": "Off", - "IncreaseScoreWithBizOrInfoUrls": "Off", - "MarkAsSpamEmptyMessages": "Off", - "MarkAsSpamJavaScriptInHtml": "Off", - "MarkAsSpamFramesInHtml": "Off", - "MarkAsSpamObjectTagsInHtml": "Off", - "MarkAsSpamEmbedTagsInHtml": "Off", - "MarkAsSpamFormTagsInHtml": "Off", - "MarkAsSpamWebBugsInHtml": "Off", - "MarkAsSpamSensitiveWordList": "Off", - "MarkAsSpamSpfRecordHardFail": "Off", - "MarkAsSpamFromAddressAuthFail": "Off", - "MarkAsSpamBulkMail": "On", - "MarkAsSpamNdrBackscatter": "Off", - "IsDefault": false, - "LanguageBlockList": [ - - ], - "RegionBlockList": [ - - ], - "HighConfidenceSpamAction": "Quarantine", - "SpamAction": "Quarantine", - "DownloadLink": false, - "EnableRegionBlockList": false, - "EnableLanguageBlockList": false, - "BulkThreshold": 5, - "AllowedSenders": [ - - ], - "AllowedSenderDomains": [ - - ], - "BlockedSenders": [ - - ], - "BlockedSenderDomains": [ - - ], - "ZapEnabled": true, - "InlineSafetyTipsEnabled": true, - "BulkSpamAction": "Quarantine", - "PhishSpamAction": "Quarantine", - "SpamZapEnabled": true, - "PhishZapEnabled": true, - "IntraOrgFilterState": "Default", - "HighConfidencePhishAction": "Quarantine", - "RecommendedPolicyType": "Strict", - "SpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", - "BulkQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "Identity": "Strict Preset Security Policy1681329956650", - "Id": "Strict Preset Security Policy1681329956650", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Strict Preset Security Policy1681329956650", - "DistinguishedName": "CN=Strict Preset Security Policy1681329956650,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1681329967000)/", - "WhenCreated": "/Date(1681329957000)/", - "WhenChangedUTC": "/Date(1681329967000)/", - "WhenCreatedUTC": "/Date(1681329957000)/", - "ExchangeObjectId": "01a6119b-4398-43b1-a329-7335e292bd5d", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "01a6119b-4398-43b1-a329-7335e292bd5d", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "SubjectContainsWords": [], + "ExceptIfSubjectContainsWords": [], + "SubjectOrBodyMatchesPatterns": [], + "ExceptIfSubjectOrBodyMatchesPatterns": [], + "SubjectOrBodyContainsWords": [], + "ExceptIfSubjectOrBodyContainsWords": [], + "DocumentMatchesPatterns": [], + "ExceptIfDocumentMatchesPatterns": [], + "DocumentContainsWords": [], + "ExceptIfDocumentContainsWords": [], + "SenderADAttributeMatchesPatterns": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "SenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ContentCharacterSetContainsWords": [], + "ExceptIfContentCharacterSetContainsWords": [], + "DocumentNameMatchesPatterns": [], + "ExceptIfDocumentNameMatchesPatterns": [], + "MessageSizeOver": "", + "ExceptIfMessageSizeOver": "", + "MessageTypeMatches": null, + "ExceptIfMessageTypeMatches": null, + "UnscannableDocumentExtensionIs": [], + "ExceptIfUnscannableDocumentExtensionIs": [], + "HeaderContainsWords": null, + "ExceptIfHeaderContainsWords": null, + "DeviceManagementType": null, + "ExceptIfDeviceManagementType": null, + "AccessedBy": [], + "ExceptIfAccessedBy": [], + "AccessedByMemberOf": [], + "ExceptIfAccessedByMemberOf": [], + "BlockAccess": true, + "BlockAccessScope": "All", + "EncryptRMSTemplate": null, + "EnforcePortalAccess": true, + "ApplyBrandingTemplate": "", + "RemoveRMSTemplate": false, + "EndpointDlpRestrictions": [ + { + "setting": "CloudEgress", + "defaultmessage": "none", + "value": "Audit", + "appgroup": "none" + }, + { + "setting": "UnallowedApps", + "defaultmessage": "none", + "value": "Block", + "appgroup": "none" + } + ], + "EndpointDlpBrowserRestrictions": null, + "ThirdPartyAppDlpRestrictions": null, + "OnPremisesScannerDlpRestrictions": null, + "PowerBIDlpRestrictions": null, + "AlertProperties": { + "AggregationType": "None" + }, + "GenerateAlert": ["true"], + "GenerateIncidentReport": [], + "IncidentReportContent": null, + "NotifyUser": ["LastModifier"], + "NotifyAllowOverride": null, + "NotifyEmailCustomText": "", + "NotifyEmailCustomSubject": "", + "NotifyEmailCustomSenderDisplayName": "", + "NotifyEmailExchangeIncludeAttachment": true, + "NotifyEmailOnedriveRemediationActions": "NotSet", + "NotifyJustificationCustomText": "", + "NotifyJustificationCustomTextTranslations": [], + "NotifyPolicyTipCustomText": "", + "NotifyUserType": "NotSet", + "NotifyPolicyTipCustomTextTranslations": [], + "NotifyOverrideRequirements": "None", + "NotifyPolicyTipDisplayOption": "Tip", + "NotifyPolicyTipUrl": "", + "NotifyEndpointUser": null, + "RemoveHeader": [], + "AccessTimeControl": null, + "StopPolicyProcessing": false, + "SetHeader": null, + "AddRecipients": null, + "Moderate": null, + "ModifySubject": null, + "MapRecipients": null, + "RedirectMessageTo": null, + "PrependSubject": "", + "ApplyHtmlDisclaimer": null, + "Quarantine": false, + "TriggerPowerAutomateFlow": "", + "RestrictAccess": null, + "Guid": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", + "AdvancedRuleBuilderContext": null, + "ParentPolicyName": "Default Office 365 DLP policy", + "ReportSeverityLevel": "Low", + "ActivationDate": null, + "ExpiryDate": null, + "SenderType": null, + "SenderAddressLocation": null, + "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", + "ExecutionRuleGuids": null, + "DisplayName": "Baseline Rule", + "StorageBindings": null, + "EvaluateRulePerComponent": false, + "IsAdvancedRule": false, + "ContentContainsSensitiveInformation": [ + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Individual Taxpayer Identification Number (ITIN)", + "mincount": "1", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "High", + "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", + "minconfidence": "85", + "classifiertype": "Content", + "name": "Credit Card Number", + "mincount": "1", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Social Security Number (SSN)", + "mincount": "1", + "maxcount": "-1" + } + ], + "ExceptIfContentContainsSensitiveInformation": null, + "ContentMissingSensitivityLabel": null, + "ContentIsNotLabeled": false, + "DocumentCreatedBy": [], + "ExceptIfDocumentCreatedBy": [], + "DocumentSizeOver": "", + "ExceptIfDocumentSizeOver": "", + "DocumentNameMatchesWords": [], + "ExceptIfDocumentNameMatchesWords": [], + "AccessScope": null, + "NonBifurcatingAccessScope": null, + "ExceptIfAccessScope": null, + "FromScope": null, + "ExceptIfFromScope": null, + "WithImportance": null, + "ExceptIfWithImportance": null, + "ExternalScenarioDependancies": { + "ProtectionAlertId": "b314399f-5d64-4c49-98c3-06deb1be2b6f" + }, + "ContentPropertyContainsWords": [], + "ExceptIfContentPropertyContainsWords": [], + "From": null, + "ExceptIfFrom": null, + "FromMemberOf": null, + "ExceptIfFromMemberOf": null, + "DocumentIsUnsupported": false, + "ExceptIfDocumentIsUnsupported": false, + "HasSenderOverride": false, + "ExceptIfHasSenderOverride": false, + "RestrictBrowserAccess": false, + "ProcessingLimitExceeded": false, + "ExceptIfProcessingLimitExceeded": false, + "SentTo": [], + "ExceptIfSentTo": [], + "RecipientDomainIs": [], + "ExceptIfRecipientDomainIs": [], + "DocumentIsPasswordProtected": false, + "ExceptIfDocumentIsPasswordProtected": false, + "SenderIPRanges": [], + "ExceptIfSenderIPRanges": [], + "ContentExtensionMatchesWords": [], + "ExceptIfContentExtensionMatchesWords": [], + "ContentFileTypeMatches": [], + "ExceptIfContentFileTypeMatches": [], + "HeaderMatchesPatterns": null, + "ExceptIfHeaderMatchesPatterns": null, + "SubjectMatchesPatterns": [], + "ExceptIfSubjectMatchesPatterns": [], + "AnyOfRecipientAddressContainsWords": [], + "ExceptIfAnyOfRecipientAddressContainsWords": [], + "AnyOfRecipientAddressMatchesPatterns": [], + "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], + "FromAddressMatchesPatterns": [], + "ExceptIfFromAddressMatchesPatterns": [], + "FromAddressContainsWords": [], + "ExceptIfFromAddressContainsWords": [], + "SenderDomainIs": [], + "ExceptIfSenderDomainIs": [], + "SentToMemberOf": null, + "ExceptIfSentToMemberOf": null, + "DocumentCreatedByMemberOf": null, + "ExceptIfDocumentCreatedByMemberOf": null, + "HasLabelDowngradedFrom": [], + "ContentIsShared": false, + "ExceptIfContentIsShared": false, + "SharedByIRMUserRisk": [], + "RuleErrorAction": null, + "RuleXml": "", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", + "Priority": 0, + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", + "Policy": "8cb4f574-1a54-45e1-bf58-73bbe023ebad", + "Comment": "Blocks the minimum items prescribed in the baseline: credit card numbers, TIN numbers, and SSN numbers.", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "c54e50b4-fb46-494d-9ad3-08db45bd017e", + "MaximumBlobRuleLength": 0, + "CreatedBy": "Alden Hilton - CTR", + "LastModifiedBy": "Addam Schroll", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Baseline Rule", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Baseline Rule", + "DistinguishedName": "CN=Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1682448227000)/", + "WhenCreated": "/Date(1651250001000)/", + "WhenChangedUTC": "/Date(1682448227000)/", + "WhenCreatedUTC": "/Date(1651250001000)/", + "ExchangeObjectId": "74f600e2-dccc-4d6f-a748-7bff5ed5da69", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "Changed", + "IsObjectUnderSystemOperation": false }, { - "AdminDisplayName": "", - "AddXHeaderValue": "", - "ModifySubjectValue": "", - "RedirectToRecipients": [ - - ], - "TestModeBccToRecipients": [ - - ], - "FalsePositiveAdditionalRecipients": [ - - ], - "QuarantineRetentionPeriod": 30, - "TestModeAction": "None", - "IncreaseScoreWithImageLinks": "Off", - "IncreaseScoreWithNumericIps": "Off", - "IncreaseScoreWithRedirectToOtherPort": "Off", - "IncreaseScoreWithBizOrInfoUrls": "Off", - "MarkAsSpamEmptyMessages": "Off", - "MarkAsSpamJavaScriptInHtml": "Off", - "MarkAsSpamFramesInHtml": "Off", - "MarkAsSpamObjectTagsInHtml": "Off", - "MarkAsSpamEmbedTagsInHtml": "Off", - "MarkAsSpamFormTagsInHtml": "Off", - "MarkAsSpamWebBugsInHtml": "Off", - "MarkAsSpamSensitiveWordList": "Off", - "MarkAsSpamSpfRecordHardFail": "Off", - "MarkAsSpamFromAddressAuthFail": "Off", - "MarkAsSpamBulkMail": "On", - "MarkAsSpamNdrBackscatter": "Off", - "IsDefault": true, - "LanguageBlockList": [ - - ], - "RegionBlockList": [ - - ], - "HighConfidenceSpamAction": "Quarantine", - "SpamAction": "MoveToJmf", - "DownloadLink": false, - "EnableRegionBlockList": false, - "EnableLanguageBlockList": false, - "BulkThreshold": 6, - "AllowedSenders": [ - - ], - "AllowedSenderDomains": [ - - ], - "BlockedSenders": [ - - ], - "BlockedSenderDomains": [ - - ], - "ZapEnabled": true, - "InlineSafetyTipsEnabled": true, - "BulkSpamAction": "Quarantine", - "PhishSpamAction": "Quarantine", - "SpamZapEnabled": true, - "PhishZapEnabled": true, - "IntraOrgFilterState": "Default", - "HighConfidencePhishAction": "Quarantine", - "RecommendedPolicyType": "Custom", - "SpamQuarantineTag": "DefaultFullAccessPolicy", - "HighConfidenceSpamQuarantineTag": "NotificationEnabledPolicy", - "PhishQuarantineTag": "NotificationEnabledPolicy", - "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", - "BulkQuarantineTag": "NotificationEnabledPolicy", - "Identity": "Default", - "Id": "Default", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Default", - "DistinguishedName": "CN=Default,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1647039792000)/", - "WhenCreated": "/Date(1619484590000)/", - "WhenChangedUTC": "/Date(1647039792000)/", - "WhenCreatedUTC": "/Date(1619484590000)/", - "ExchangeObjectId": "c2a6239d-0253-4693-b841-33ccd870af91", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "d07707d6-355e-4be5-a368-61e7757b28f5", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "SubjectContainsWords": [], + "ExceptIfSubjectContainsWords": [], + "SubjectOrBodyMatchesPatterns": [], + "ExceptIfSubjectOrBodyMatchesPatterns": [], + "SubjectOrBodyContainsWords": [], + "ExceptIfSubjectOrBodyContainsWords": [], + "DocumentMatchesPatterns": [], + "ExceptIfDocumentMatchesPatterns": [], + "DocumentContainsWords": [], + "ExceptIfDocumentContainsWords": [], + "SenderADAttributeMatchesPatterns": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "SenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ContentCharacterSetContainsWords": [], + "ExceptIfContentCharacterSetContainsWords": [], + "DocumentNameMatchesPatterns": [], + "ExceptIfDocumentNameMatchesPatterns": [], + "MessageSizeOver": "", + "ExceptIfMessageSizeOver": "", + "MessageTypeMatches": null, + "ExceptIfMessageTypeMatches": null, + "UnscannableDocumentExtensionIs": [], + "ExceptIfUnscannableDocumentExtensionIs": [], + "HeaderContainsWords": null, + "ExceptIfHeaderContainsWords": null, + "DeviceManagementType": null, + "ExceptIfDeviceManagementType": null, + "AccessedBy": [], + "ExceptIfAccessedBy": [], + "AccessedByMemberOf": [], + "ExceptIfAccessedByMemberOf": [], + "BlockAccess": false, + "BlockAccessScope": null, + "EncryptRMSTemplate": null, + "EnforcePortalAccess": true, + "ApplyBrandingTemplate": "", + "RemoveRMSTemplate": false, + "EndpointDlpRestrictions": null, + "EndpointDlpBrowserRestrictions": null, + "ThirdPartyAppDlpRestrictions": null, + "OnPremisesScannerDlpRestrictions": null, + "PowerBIDlpRestrictions": null, + "AlertProperties": null, + "GenerateAlert": [], + "GenerateIncidentReport": [], + "IncidentReportContent": null, + "NotifyUser": ["SiteAdmin", "LastModifier", "Owner"], + "NotifyAllowOverride": null, + "NotifyEmailCustomText": "", + "NotifyEmailCustomSubject": "", + "NotifyEmailCustomSenderDisplayName": "", + "NotifyEmailExchangeIncludeAttachment": true, + "NotifyEmailOnedriveRemediationActions": "NotSet", + "NotifyJustificationCustomText": "", + "NotifyJustificationCustomTextTranslations": [], + "NotifyPolicyTipCustomText": "", + "NotifyUserType": "NotSet", + "NotifyPolicyTipCustomTextTranslations": [], + "NotifyOverrideRequirements": "None", + "NotifyPolicyTipDisplayOption": "Tip", + "NotifyPolicyTipUrl": "", + "NotifyEndpointUser": null, + "RemoveHeader": [], + "AccessTimeControl": null, + "StopPolicyProcessing": false, + "SetHeader": null, + "AddRecipients": null, + "Moderate": null, + "ModifySubject": null, + "MapRecipients": null, + "RedirectMessageTo": null, + "PrependSubject": "", + "ApplyHtmlDisclaimer": null, + "Quarantine": false, + "TriggerPowerAutomateFlow": "", + "RestrictAccess": null, + "Guid": "f2e78982-66b6-488a-a43a-e921800f6304", + "AdvancedRuleBuilderContext": null, + "ParentPolicyName": "agency DLP Policy for PII", + "ReportSeverityLevel": "Low", + "ActivationDate": null, + "ExpiryDate": null, + "SenderType": null, + "SenderAddressLocation": null, + "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '9',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '9',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", + "ExecutionRuleGuids": null, + "DisplayName": "Low volume of content detected agency DLP Policy for PII", + "StorageBindings": null, + "EvaluateRulePerComponent": false, + "IsAdvancedRule": false, + "ContentContainsSensitiveInformation": [ + { + "maxconfidence": "100", + "confidencelevel": "High", + "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", + "minconfidence": "85", + "classifiertype": "Content", + "name": "Credit Card Number", + "mincount": "1", + "maxcount": "9" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Bank Account Number", + "mincount": "1", + "maxcount": "9" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", + "minconfidence": "75", + "classifiertype": "Content", + "name": "ABA Routing Number", + "mincount": "1", + "maxcount": "9" + } + ], + "ExceptIfContentContainsSensitiveInformation": null, + "ContentMissingSensitivityLabel": null, + "ContentIsNotLabeled": false, + "DocumentCreatedBy": [], + "ExceptIfDocumentCreatedBy": [], + "DocumentSizeOver": "", + "ExceptIfDocumentSizeOver": "", + "DocumentNameMatchesWords": [], + "ExceptIfDocumentNameMatchesWords": [], + "AccessScope": "NotInOrganization", + "NonBifurcatingAccessScope": null, + "ExceptIfAccessScope": null, + "FromScope": null, + "ExceptIfFromScope": null, + "WithImportance": null, + "ExceptIfWithImportance": null, + "ExternalScenarioDependancies": {}, + "ContentPropertyContainsWords": [], + "ExceptIfContentPropertyContainsWords": [], + "From": null, + "ExceptIfFrom": null, + "FromMemberOf": null, + "ExceptIfFromMemberOf": null, + "DocumentIsUnsupported": false, + "ExceptIfDocumentIsUnsupported": false, + "HasSenderOverride": false, + "ExceptIfHasSenderOverride": false, + "RestrictBrowserAccess": false, + "ProcessingLimitExceeded": false, + "ExceptIfProcessingLimitExceeded": false, + "SentTo": [], + "ExceptIfSentTo": [], + "RecipientDomainIs": [], + "ExceptIfRecipientDomainIs": [], + "DocumentIsPasswordProtected": false, + "ExceptIfDocumentIsPasswordProtected": false, + "SenderIPRanges": [], + "ExceptIfSenderIPRanges": [], + "ContentExtensionMatchesWords": [], + "ExceptIfContentExtensionMatchesWords": [], + "ContentFileTypeMatches": [], + "ExceptIfContentFileTypeMatches": [], + "HeaderMatchesPatterns": null, + "ExceptIfHeaderMatchesPatterns": null, + "SubjectMatchesPatterns": [], + "ExceptIfSubjectMatchesPatterns": [], + "AnyOfRecipientAddressContainsWords": [], + "ExceptIfAnyOfRecipientAddressContainsWords": [], + "AnyOfRecipientAddressMatchesPatterns": [], + "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], + "FromAddressMatchesPatterns": [], + "ExceptIfFromAddressMatchesPatterns": [], + "FromAddressContainsWords": [], + "ExceptIfFromAddressContainsWords": [], + "SenderDomainIs": [], + "ExceptIfSenderDomainIs": [], + "SentToMemberOf": null, + "ExceptIfSentToMemberOf": null, + "DocumentCreatedByMemberOf": null, + "ExceptIfDocumentCreatedByMemberOf": null, + "HasLabelDowngradedFrom": [], + "ContentIsShared": false, + "ExceptIfContentIsShared": false, + "SharedByIRMUserRisk": [], + "RuleErrorAction": null, + "RuleXml": "", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "3dc18322-891b-436e-8240-755f95fef33c", + "Priority": 0, + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", + "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", + "Comment": "", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "f6f7ec90-c0aa-4ae4-e784-08dafa37f4cf", + "MaximumBlobRuleLength": 0, + "CreatedBy": "d459e626-e311-4242-bb40-263313097103", + "LastModifiedBy": "Addam Schroll", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/Low volume of content detected agency DLP Policy for PII", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Low volume of content detected agency DLP Policy for PII", + "DistinguishedName": "CN=Low volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1674144746000)/", + "WhenCreated": "/Date(1618318043000)/", + "WhenChangedUTC": "/Date(1674144746000)/", + "WhenCreatedUTC": "/Date(1618318043000)/", + "ExchangeObjectId": "f2e78982-66b6-488a-a43a-e921800f6304", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "Changed", + "IsObjectUnderSystemOperation": false }, { - "AdminDisplayName": "", - "AddXHeaderValue": "", - "ModifySubjectValue": "", - "RedirectToRecipients": [ - - ], - "TestModeBccToRecipients": [ - - ], - "FalsePositiveAdditionalRecipients": [ - - ], - "QuarantineRetentionPeriod": 30, - "TestModeAction": "None", - "IncreaseScoreWithImageLinks": "Off", - "IncreaseScoreWithNumericIps": "Off", - "IncreaseScoreWithRedirectToOtherPort": "Off", - "IncreaseScoreWithBizOrInfoUrls": "Off", - "MarkAsSpamEmptyMessages": "Off", - "MarkAsSpamJavaScriptInHtml": "Off", - "MarkAsSpamFramesInHtml": "Off", - "MarkAsSpamObjectTagsInHtml": "Off", - "MarkAsSpamEmbedTagsInHtml": "Off", - "MarkAsSpamFormTagsInHtml": "Off", - "MarkAsSpamWebBugsInHtml": "Off", - "MarkAsSpamSensitiveWordList": "Off", - "MarkAsSpamSpfRecordHardFail": "Off", - "MarkAsSpamFromAddressAuthFail": "Off", - "MarkAsSpamBulkMail": "On", - "MarkAsSpamNdrBackscatter": "Off", - "IsDefault": false, - "LanguageBlockList": [ - - ], - "RegionBlockList": [ - - ], - "HighConfidenceSpamAction": "Quarantine", - "SpamAction": "MoveToJmf", - "DownloadLink": false, - "EnableRegionBlockList": false, - "EnableLanguageBlockList": false, - "BulkThreshold": 6, - "AllowedSenders": [ - - ], - "AllowedSenderDomains": [ - - ], - "BlockedSenders": [ - - ], - "BlockedSenderDomains": [ - - ], - "ZapEnabled": true, - "InlineSafetyTipsEnabled": true, - "BulkSpamAction": "MoveToJmf", - "PhishSpamAction": "Quarantine", - "SpamZapEnabled": true, - "PhishZapEnabled": true, - "IntraOrgFilterState": "Default", - "HighConfidencePhishAction": "Quarantine", - "RecommendedPolicyType": "Standard", - "SpamQuarantineTag": "DefaultFullAccessPolicy", - "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", - "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", - "BulkQuarantineTag": "DefaultFullAccessPolicy", - "Identity": "Standard Preset Security Policy1659535432883", - "Id": "Standard Preset Security Policy1659535432883", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Standard Preset Security Policy1659535432883", - "DistinguishedName": "CN=Standard Preset Security Policy1659535432883,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1688679110000)/", - "WhenCreated": "/Date(1659535433000)/", - "WhenChangedUTC": "/Date(1688679110000)/", - "WhenCreatedUTC": "/Date(1659535433000)/", - "ExchangeObjectId": "5422a22e-b87d-4400-835d-4a63acc75082", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "5422a22e-b87d-4400-835d-4a63acc75082", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "SubjectContainsWords": [], + "ExceptIfSubjectContainsWords": [], + "SubjectOrBodyMatchesPatterns": [], + "ExceptIfSubjectOrBodyMatchesPatterns": [], + "SubjectOrBodyContainsWords": [], + "ExceptIfSubjectOrBodyContainsWords": [], + "DocumentMatchesPatterns": [], + "ExceptIfDocumentMatchesPatterns": [], + "DocumentContainsWords": [], + "ExceptIfDocumentContainsWords": [], + "SenderADAttributeMatchesPatterns": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "SenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ContentCharacterSetContainsWords": [], + "ExceptIfContentCharacterSetContainsWords": [], + "DocumentNameMatchesPatterns": [], + "ExceptIfDocumentNameMatchesPatterns": [], + "MessageSizeOver": "", + "ExceptIfMessageSizeOver": "", + "MessageTypeMatches": null, + "ExceptIfMessageTypeMatches": null, + "UnscannableDocumentExtensionIs": [], + "ExceptIfUnscannableDocumentExtensionIs": [], + "HeaderContainsWords": null, + "ExceptIfHeaderContainsWords": null, + "DeviceManagementType": null, + "ExceptIfDeviceManagementType": null, + "AccessedBy": [], + "ExceptIfAccessedBy": [], + "AccessedByMemberOf": [], + "ExceptIfAccessedByMemberOf": [], + "BlockAccess": false, + "BlockAccessScope": null, + "EncryptRMSTemplate": null, + "EnforcePortalAccess": true, + "ApplyBrandingTemplate": "", + "RemoveRMSTemplate": false, + "EndpointDlpRestrictions": null, + "EndpointDlpBrowserRestrictions": null, + "ThirdPartyAppDlpRestrictions": null, + "OnPremisesScannerDlpRestrictions": null, + "PowerBIDlpRestrictions": null, + "AlertProperties": null, + "GenerateAlert": [], + "GenerateIncidentReport": [], + "IncidentReportContent": null, + "NotifyUser": ["LastModifier", "SiteAdmin", "Owner"], + "NotifyAllowOverride": null, + "NotifyEmailCustomText": "", + "NotifyEmailCustomSubject": "", + "NotifyEmailCustomSenderDisplayName": "", + "NotifyEmailExchangeIncludeAttachment": true, + "NotifyEmailOnedriveRemediationActions": "NotSet", + "NotifyJustificationCustomText": "", + "NotifyJustificationCustomTextTranslations": [], + "NotifyPolicyTipCustomText": "", + "NotifyUserType": "NotSet", + "NotifyPolicyTipCustomTextTranslations": [], + "NotifyOverrideRequirements": "None", + "NotifyPolicyTipDisplayOption": "Tip", + "NotifyPolicyTipUrl": "", + "NotifyEndpointUser": null, + "RemoveHeader": [], + "AccessTimeControl": null, + "StopPolicyProcessing": false, + "SetHeader": null, + "AddRecipients": null, + "Moderate": null, + "ModifySubject": null, + "MapRecipients": null, + "RedirectMessageTo": null, + "PrependSubject": "", + "ApplyHtmlDisclaimer": null, + "Quarantine": false, + "TriggerPowerAutomateFlow": "", + "RestrictAccess": null, + "Guid": "8c40d462-f7c0-434d-bd37-d35c083c297a", + "AdvancedRuleBuilderContext": null, + "ParentPolicyName": "agency DLP Policy for PII", + "ReportSeverityLevel": "High", + "ActivationDate": null, + "ExpiryDate": null, + "SenderType": null, + "SenderAddressLocation": null, + "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'AccessScope',rn 'Value': 'NotInOrganization'rn },rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'a2ce32a8-f935-4bb6-8e96-2a5157672e2c',rn 'maxconfidence': '100',rn 'name': 'U.S. Bank Account Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'cb353f78-2b72-4c3c-8827-92ebe4f69fdf',rn 'maxconfidence': '100',rn 'name': 'ABA Routing Number',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '10',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", + "ExecutionRuleGuids": null, + "DisplayName": "High volume of content detected agency DLP Policy for PII", + "StorageBindings": null, + "EvaluateRulePerComponent": false, + "IsAdvancedRule": false, + "ContentContainsSensitiveInformation": [ + { + "maxconfidence": "100", + "confidencelevel": "High", + "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", + "minconfidence": "85", + "classifiertype": "Content", + "name": "Credit Card Number", + "mincount": "10", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "a2ce32a8-f935-4bb6-8e96-2a5157672e2c", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Bank Account Number", + "mincount": "10", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "cb353f78-2b72-4c3c-8827-92ebe4f69fdf", + "minconfidence": "75", + "classifiertype": "Content", + "name": "ABA Routing Number", + "mincount": "10", + "maxcount": "-1" + } + ], + "ExceptIfContentContainsSensitiveInformation": null, + "ContentMissingSensitivityLabel": null, + "ContentIsNotLabeled": false, + "DocumentCreatedBy": [], + "ExceptIfDocumentCreatedBy": [], + "DocumentSizeOver": "", + "ExceptIfDocumentSizeOver": "", + "DocumentNameMatchesWords": [], + "ExceptIfDocumentNameMatchesWords": [], + "AccessScope": "NotInOrganization", + "NonBifurcatingAccessScope": null, + "ExceptIfAccessScope": null, + "FromScope": null, + "ExceptIfFromScope": null, + "WithImportance": null, + "ExceptIfWithImportance": null, + "ExternalScenarioDependancies": {}, + "ContentPropertyContainsWords": [], + "ExceptIfContentPropertyContainsWords": [], + "From": null, + "ExceptIfFrom": null, + "FromMemberOf": null, + "ExceptIfFromMemberOf": null, + "DocumentIsUnsupported": false, + "ExceptIfDocumentIsUnsupported": false, + "HasSenderOverride": false, + "ExceptIfHasSenderOverride": false, + "RestrictBrowserAccess": false, + "ProcessingLimitExceeded": false, + "ExceptIfProcessingLimitExceeded": false, + "SentTo": [], + "ExceptIfSentTo": [], + "RecipientDomainIs": [], + "ExceptIfRecipientDomainIs": [], + "DocumentIsPasswordProtected": false, + "ExceptIfDocumentIsPasswordProtected": false, + "SenderIPRanges": [], + "ExceptIfSenderIPRanges": [], + "ContentExtensionMatchesWords": [], + "ExceptIfContentExtensionMatchesWords": [], + "ContentFileTypeMatches": [], + "ExceptIfContentFileTypeMatches": [], + "HeaderMatchesPatterns": null, + "ExceptIfHeaderMatchesPatterns": null, + "SubjectMatchesPatterns": [], + "ExceptIfSubjectMatchesPatterns": [], + "AnyOfRecipientAddressContainsWords": [], + "ExceptIfAnyOfRecipientAddressContainsWords": [], + "AnyOfRecipientAddressMatchesPatterns": [], + "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], + "FromAddressMatchesPatterns": [], + "ExceptIfFromAddressMatchesPatterns": [], + "FromAddressContainsWords": [], + "ExceptIfFromAddressContainsWords": [], + "SenderDomainIs": [], + "ExceptIfSenderDomainIs": [], + "SentToMemberOf": null, + "ExceptIfSentToMemberOf": null, + "DocumentCreatedByMemberOf": null, + "ExceptIfDocumentCreatedByMemberOf": null, + "HasLabelDowngradedFrom": [], + "ContentIsShared": false, + "ExceptIfContentIsShared": false, + "SharedByIRMUserRisk": [], + "RuleErrorAction": null, + "RuleXml": "", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "b933b4dd-4152-4d9a-b4b5-0376f8b57d6d", + "Priority": 1, + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams", + "Policy": "b800d92f-a479-47a9-bcfa-306db665aaa1", + "Comment": "", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "daf9a24d-19dd-4978-51b9-08dafa37f6c9", + "MaximumBlobRuleLength": 0, + "CreatedBy": "d459e626-e311-4242-bb40-263313097103", + "LastModifiedBy": "Addam Schroll", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/High volume of content detected agency DLP Policy for PII", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "High volume of content detected agency DLP Policy for PII", + "DistinguishedName": "CN=High volume of content detected agency DLP Policy for PII,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1674144749000)/", + "WhenCreated": "/Date(1618318041000)/", + "WhenChangedUTC": "/Date(1674144749000)/", + "WhenCreatedUTC": "/Date(1618318041000)/", + "ExchangeObjectId": "8c40d462-f7c0-434d-bd37-d35c083c297a", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "Changed", + "IsObjectUnderSystemOperation": false + }, + { + "SubjectContainsWords": [], + "ExceptIfSubjectContainsWords": [], + "SubjectOrBodyMatchesPatterns": [], + "ExceptIfSubjectOrBodyMatchesPatterns": [], + "SubjectOrBodyContainsWords": [], + "ExceptIfSubjectOrBodyContainsWords": [], + "DocumentMatchesPatterns": [], + "ExceptIfDocumentMatchesPatterns": [], + "DocumentContainsWords": [], + "ExceptIfDocumentContainsWords": [], + "SenderADAttributeMatchesPatterns": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "SenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ContentCharacterSetContainsWords": [], + "ExceptIfContentCharacterSetContainsWords": [], + "DocumentNameMatchesPatterns": [], + "ExceptIfDocumentNameMatchesPatterns": [], + "MessageSizeOver": "", + "ExceptIfMessageSizeOver": "", + "MessageTypeMatches": null, + "ExceptIfMessageTypeMatches": null, + "UnscannableDocumentExtensionIs": [], + "ExceptIfUnscannableDocumentExtensionIs": [], + "HeaderContainsWords": null, + "ExceptIfHeaderContainsWords": null, + "DeviceManagementType": null, + "ExceptIfDeviceManagementType": null, + "AccessedBy": [], + "ExceptIfAccessedBy": [], + "AccessedByMemberOf": [], + "ExceptIfAccessedByMemberOf": [], + "BlockAccess": true, + "BlockAccessScope": "All", + "EncryptRMSTemplate": null, + "EnforcePortalAccess": true, + "ApplyBrandingTemplate": "", + "RemoveRMSTemplate": false, + "EndpointDlpRestrictions": null, + "EndpointDlpBrowserRestrictions": null, + "ThirdPartyAppDlpRestrictions": null, + "OnPremisesScannerDlpRestrictions": null, + "PowerBIDlpRestrictions": null, + "AlertProperties": { + "AggregationType": "None" + }, + "GenerateAlert": ["true"], + "GenerateIncidentReport": [], + "IncidentReportContent": null, + "NotifyUser": [], + "NotifyAllowOverride": null, + "NotifyEmailCustomText": "", + "NotifyEmailCustomSubject": "", + "NotifyEmailCustomSenderDisplayName": "", + "NotifyEmailExchangeIncludeAttachment": true, + "NotifyEmailOnedriveRemediationActions": null, + "NotifyJustificationCustomText": "", + "NotifyJustificationCustomTextTranslations": [], + "NotifyPolicyTipCustomText": "", + "NotifyUserType": null, + "NotifyPolicyTipCustomTextTranslations": [], + "NotifyOverrideRequirements": null, + "NotifyPolicyTipDisplayOption": null, + "NotifyPolicyTipUrl": "", + "NotifyEndpointUser": null, + "RemoveHeader": [], + "AccessTimeControl": null, + "StopPolicyProcessing": false, + "SetHeader": null, + "AddRecipients": null, + "Moderate": null, + "ModifySubject": null, + "MapRecipients": null, + "RedirectMessageTo": null, + "PrependSubject": "", + "ApplyHtmlDisclaimer": null, + "Quarantine": false, + "TriggerPowerAutomateFlow": "", + "RestrictAccess": null, + "Guid": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", + "AdvancedRuleBuilderContext": null, + "ParentPolicyName": "MS.DEFENDER.4.1v1 Test", + "ReportSeverityLevel": "Low", + "ActivationDate": null, + "ExpiryDate": null, + "SenderType": null, + "SenderAddressLocation": null, + "AdvancedRule": "{rn 'Version': '1.0',rn 'Condition': {rn 'Operator': 'And',rn 'SubConditions': [rn {rn 'ConditionName': 'ContentContainsSensitiveInformation',rn 'Value': [rn {rn 'id': '50842eb7-edc8-4019-85dd-5a5c1f2bb085',rn 'maxconfidence': '100',rn 'name': 'Credit Card Number',rn 'maxcount': '-1',rn 'minconfidence': '85',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'High'rn },rn {rn 'id': 'e55e2a32-f92d-4985-a35d-a0b269eb687b',rn 'maxconfidence': '100',rn 'name': 'U.S. Individual Taxpayer Identification Number (ITIN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn },rn {rn 'id': 'a44669fe-0d48-453d-a9b1-2cc83f2cba77',rn 'maxconfidence': '100',rn 'name': 'U.S. Social Security Number (SSN)',rn 'maxcount': '-1',rn 'minconfidence': '75',rn 'classifiertype': 'Content',rn 'mincount': '1',rn 'confidencelevel': 'Medium'rn }rn ]rn }rn ]rn }rn}", + "ExecutionRuleGuids": null, + "DisplayName": "PII Check", + "StorageBindings": null, + "EvaluateRulePerComponent": false, + "IsAdvancedRule": false, + "ContentContainsSensitiveInformation": [ + { + "maxconfidence": "100", + "confidencelevel": "High", + "id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085", + "minconfidence": "85", + "classifiertype": "Content", + "name": "Credit Card Number", + "mincount": "1", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "e55e2a32-f92d-4985-a35d-a0b269eb687b", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Individual Taxpayer Identification Number (ITIN)", + "mincount": "1", + "maxcount": "-1" + }, + { + "maxconfidence": "100", + "confidencelevel": "Medium", + "id": "a44669fe-0d48-453d-a9b1-2cc83f2cba77", + "minconfidence": "75", + "classifiertype": "Content", + "name": "U.S. Social Security Number (SSN)", + "mincount": "1", + "maxcount": "-1" + } + ], + "ExceptIfContentContainsSensitiveInformation": null, + "ContentMissingSensitivityLabel": null, + "ContentIsNotLabeled": false, + "DocumentCreatedBy": [], + "ExceptIfDocumentCreatedBy": [], + "DocumentSizeOver": "", + "ExceptIfDocumentSizeOver": "", + "DocumentNameMatchesWords": [], + "ExceptIfDocumentNameMatchesWords": [], + "AccessScope": null, + "NonBifurcatingAccessScope": null, + "ExceptIfAccessScope": null, + "FromScope": null, + "ExceptIfFromScope": null, + "WithImportance": null, + "ExceptIfWithImportance": null, + "ExternalScenarioDependancies": { + "ProtectionAlertId": "37a2473a-9a91-4790-a96f-a93db6da9d55" + }, + "ContentPropertyContainsWords": [], + "ExceptIfContentPropertyContainsWords": [], + "From": null, + "ExceptIfFrom": null, + "FromMemberOf": null, + "ExceptIfFromMemberOf": null, + "DocumentIsUnsupported": false, + "ExceptIfDocumentIsUnsupported": false, + "HasSenderOverride": false, + "ExceptIfHasSenderOverride": false, + "RestrictBrowserAccess": false, + "ProcessingLimitExceeded": false, + "ExceptIfProcessingLimitExceeded": false, + "SentTo": [], + "ExceptIfSentTo": [], + "RecipientDomainIs": [], + "ExceptIfRecipientDomainIs": [], + "DocumentIsPasswordProtected": false, + "ExceptIfDocumentIsPasswordProtected": false, + "SenderIPRanges": [], + "ExceptIfSenderIPRanges": [], + "ContentExtensionMatchesWords": [], + "ExceptIfContentExtensionMatchesWords": [], + "ContentFileTypeMatches": [], + "ExceptIfContentFileTypeMatches": [], + "HeaderMatchesPatterns": null, + "ExceptIfHeaderMatchesPatterns": null, + "SubjectMatchesPatterns": [], + "ExceptIfSubjectMatchesPatterns": [], + "AnyOfRecipientAddressContainsWords": [], + "ExceptIfAnyOfRecipientAddressContainsWords": [], + "AnyOfRecipientAddressMatchesPatterns": [], + "ExceptIfAnyOfRecipientAddressMatchesPatterns": [], + "FromAddressMatchesPatterns": [], + "ExceptIfFromAddressMatchesPatterns": [], + "FromAddressContainsWords": [], + "ExceptIfFromAddressContainsWords": [], + "SenderDomainIs": [], + "ExceptIfSenderDomainIs": [], + "SentToMemberOf": null, + "ExceptIfSentToMemberOf": null, + "DocumentCreatedByMemberOf": null, + "ExceptIfDocumentCreatedByMemberOf": null, + "HasLabelDowngradedFrom": [], + "ContentIsShared": false, + "ExceptIfContentIsShared": false, + "SharedByIRMUserRisk": [], + "RuleErrorAction": null, + "RuleXml": "", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "9a7b93f6-6c70-474c-854a-82116ce288ef", + "Priority": 0, + "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams, EndpointDevices, OnPremisesScanner", + "Policy": "cfe272a6-564c-4c7b-96c7-8d187487a755", + "Comment": "", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "825da2a8-5b6d-499b-6b2a-08db9cf8a96b", + "MaximumBlobRuleLength": 0, + "CreatedBy": "Addam Schroll", + "LastModifiedBy": "Addam Schroll", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/PII Check", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "PII Check", + "DistinguishedName": "CN=PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1692039601000)/", + "WhenCreated": "/Date(1692039601000)/", + "WhenChangedUTC": "/Date(1692039601000)/", + "WhenCreatedUTC": "/Date(1692039601000)/", + "ExchangeObjectId": "a9519f64-754d-42f9-8d5e-c9f4c68646b8", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "New", + "IsObjectUnderSystemOperation": false + } + ], + "malware_filter_policies": [ + { + "AdminDisplayName": "", + "CustomExternalBody": "", + "CustomExternalSubject": "", + "CustomInternalBody": "", + "CustomInternalSubject": "", + "CustomFromAddress": "", + "CustomFromName": "", + "CustomNotifications": false, + "EnableExternalSenderAdminNotifications": false, + "EnableFileFilter": true, + "EnableInternalSenderAdminNotifications": false, + "ExternalSenderAdminAddress": "", + "FileTypeAction": "Reject", + "FileTypes": null, + "InternalSenderAdminAddress": "", + "IsDefault": false, + "IsPolicyOverrideApplied": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Strict", + "ZapEnabled": true, + "Identity": "Strict Preset Security Policy1681329957931", + "Id": "Strict Preset Security Policy1681329957931", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Strict Preset Security Policy1681329957931", + "DistinguishedName": "CN=Strict Preset Security Policy1681329957931,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", + "ObjectClass": ["top", "msExchMalwareFilterConfig"], + "WhenChanged": "/Date(1681329967000)/", + "WhenCreated": "/Date(1681329958000)/", + "WhenChangedUTC": "/Date(1681329967000)/", + "WhenCreatedUTC": "/Date(1681329958000)/", + "ExchangeObjectId": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "e5c89531-c0bf-43f2-b7ba-461efd0115ae", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "AdminDisplayName": "", + "CustomExternalBody": "", + "CustomExternalSubject": "", + "CustomInternalBody": "", + "CustomInternalSubject": "", + "CustomFromAddress": "", + "CustomFromName": "", + "CustomNotifications": false, + "EnableExternalSenderAdminNotifications": false, + "EnableFileFilter": true, + "EnableInternalSenderAdminNotifications": false, + "ExternalSenderAdminAddress": "", + "FileTypeAction": "Reject", + "FileTypes": [ + "ace", + "ani", + "apk", + "app", + "appx", + "arj", + "bat", + "cab", + "cmd", + "com", + "deb", + "dex", + "dll", + "docm", + "elf", + "exe", + "hta", + "img", + "iso", + "jar", + "jnlp", + "kext", + "lha", + "lib", + "library", + "lnk", + "lzh", + "macho", + "msc", + "msi", + "msix", + "msp", + "mst", + "pif", + "ppa", + "ppam", + "ps1", + "ps2", + "reg", + "rev", + "scf", + "scr", + "sct", + "sys", + "uif", + "vb", + "vbe", + "vbs", + "vxd", + "wsc", + "wsf", + "wsh", + "xll", + "xz", + "z" + ], + "InternalSenderAdminAddress": "", + "IsDefault": true, + "IsPolicyOverrideApplied": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Custom", + "ZapEnabled": true, + "Identity": "Default", + "Id": "Default", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Default", + "DistinguishedName": "CN=Default,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", + "ObjectClass": ["top", "msExchMalwareFilterConfig"], + "WhenChanged": "/Date(1691001178000)/", + "WhenCreated": "/Date(1619484590000)/", + "WhenChangedUTC": "/Date(1691001178000)/", + "WhenCreatedUTC": "/Date(1619484590000)/", + "ExchangeObjectId": "537d5d48-4157-4f2c-a840-f11be9a5ad50", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "5614934b-8055-41dd-93a4-4f8618ee50ca", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "AdminDisplayName": "", + "CustomExternalBody": "", + "CustomExternalSubject": "", + "CustomInternalBody": "", + "CustomInternalSubject": "", + "CustomFromAddress": "", + "CustomFromName": "", + "CustomNotifications": false, + "EnableExternalSenderAdminNotifications": false, + "EnableFileFilter": true, + "EnableInternalSenderAdminNotifications": false, + "ExternalSenderAdminAddress": "", + "FileTypeAction": "Reject", + "FileTypes": [ + "ace", + "apk", + "app", + "appx", + "ani", + "arj", + "bat", + "cab", + "cmd", + "com", + "deb", + "dex", + "dll", + "docm", + "elf", + "exe", + "hta", + "img", + "iso", + "jar", + "jnlp", + "kext", + "lha", + "lib", + "library", + "lnk", + "lzh", + "macho", + "msc", + "msi", + "msix", + "msp", + "mst", + "pif", + "ppa", + "ppam", + "reg", + "rev", + "scf", + "scr", + "sct", + "sys", + "uif", + "vb", + "vbe", + "vbs", + "vxd", + "wsc", + "wsf", + "wsh", + "xll", + "xz", + "z" + ], + "InternalSenderAdminAddress": "", + "IsDefault": false, + "IsPolicyOverrideApplied": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Standard", + "ZapEnabled": true, + "Identity": "Standard Preset Security Policy1659535435292", + "Id": "Standard Preset Security Policy1659535435292", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Standard Preset Security Policy1659535435292", + "DistinguishedName": "CN=Standard Preset Security Policy1659535435292,CN=Malware Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Malware-Filter-Config", + "ObjectClass": ["top", "msExchMalwareFilterConfig"], + "WhenChanged": "/Date(1688679108000)/", + "WhenCreated": "/Date(1659535435000)/", + "WhenChangedUTC": "/Date(1688679108000)/", + "WhenCreatedUTC": "/Date(1659535435000)/", + "ExchangeObjectId": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "2cb7ae84-9319-4ae9-93b1-01a5b4e60170", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + } + ], + "anti_phish_policies": [ + { + "Enabled": true, + "ImpersonationProtectionState": "Automatic", + "EnableTargetedUserProtection": true, + "EnableMailboxIntelligenceProtection": true, + "EnableTargetedDomainsProtection": true, + "EnableOrganizationDomainsProtection": true, + "EnableMailboxIntelligence": true, + "EnableFirstContactSafetyTips": false, + "EnableSimilarUsersSafetyTips": true, + "EnableSimilarDomainsSafetyTips": true, + "EnableUnusualCharactersSafetyTips": true, + "TargetedUserProtectionAction": "Quarantine", + "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "MailboxIntelligenceProtectionAction": "Quarantine", + "MailboxIntelligenceQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "TargetedDomainProtectionAction": "Quarantine", + "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "AuthenticationFailAction": "Quarantine", + "SpoofQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "EnableSpoofIntelligence": true, + "EnableViaTag": true, + "EnableUnauthenticatedSender": true, + "EnableSuspiciousSafetyTip": true, + "HonorDmarcPolicy": true, + "DmarcRejectAction": "Reject", + "DmarcQuarantineAction": "Quarantine", + "PhishThresholdLevel": 4, + "TargetedUsersToProtect": [], + "TargetedUserActionRecipients": [], + "MailboxIntelligenceProtectionActionRecipients": [], + "TargetedDomainsToProtect": [], + "TargetedDomainActionRecipients": [], + "ExcludedDomains": [], + "ExcludedSenders": [], + "IsDefault": false, + "AdminDisplayName": "", + "PolicyTag": "", + "RecommendedPolicyType": "Strict", + "Identity": "Strict Preset Security Policy1681329955447", + "Id": "Strict Preset Security Policy1681329955447", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Strict Preset Security Policy1681329955447", + "DistinguishedName": "CN=Strict Preset Security Policy1681329955447,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1681329967000)/", + "WhenCreated": "/Date(1681329956000)/", + "WhenChangedUTC": "/Date(1681329967000)/", + "WhenCreatedUTC": "/Date(1681329956000)/", + "ExchangeObjectId": "dd855979-da0e-4109-b218-cebf593d1771", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "dd855979-da0e-4109-b218-cebf593d1771", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "Enabled": true, + "ImpersonationProtectionState": "Manual", + "EnableTargetedUserProtection": true, + "EnableMailboxIntelligenceProtection": true, + "EnableTargetedDomainsProtection": true, + "EnableOrganizationDomainsProtection": true, + "EnableMailboxIntelligence": true, + "EnableFirstContactSafetyTips": true, + "EnableSimilarUsersSafetyTips": true, + "EnableSimilarDomainsSafetyTips": true, + "EnableUnusualCharactersSafetyTips": true, + "TargetedUserProtectionAction": "Quarantine", + "TargetedUserQuarantineTag": "DefaultFullAccessPolicy", + "MailboxIntelligenceProtectionAction": "Quarantine", + "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", + "TargetedDomainProtectionAction": "Quarantine", + "TargetedDomainQuarantineTag": "DefaultFullAccessPolicy", + "AuthenticationFailAction": "Quarantine", + "SpoofQuarantineTag": "DefaultFullAccessPolicy", + "EnableSpoofIntelligence": true, + "EnableViaTag": true, + "EnableUnauthenticatedSender": true, + "EnableSuspiciousSafetyTip": false, + "HonorDmarcPolicy": true, + "DmarcRejectAction": "Reject", + "DmarcQuarantineAction": "Quarantine", + "PhishThresholdLevel": 2, + "TargetedUsersToProtect": [ + "ronnie brown - ctr - az;robrown-az@agency.onmicrosoft.com", + "rex trotter;rtrotter-az@agency.onmicrosoft.com", + "tommy williams - ctr - az;tommy.williams-az@agency.onmicrosoft.com" + ], + "TargetedUserActionRecipients": [], + "MailboxIntelligenceProtectionActionRecipients": [], + "TargetedDomainsToProtect": ["agency.mail.onmicrosoft.com"], + "TargetedDomainActionRecipients": [], + "ExcludedDomains": [], + "ExcludedSenders": [], + "IsDefault": true, + "AdminDisplayName": "", + "PolicyTag": "", + "RecommendedPolicyType": "Custom", + "Identity": "Office365 AntiPhish Default", + "Id": "Office365 AntiPhish Default", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Office365 AntiPhish Default", + "DistinguishedName": "CN=Office365 AntiPhish Default,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1661272560000)/", + "WhenCreated": "/Date(1619484591000)/", + "WhenChangedUTC": "/Date(1661272560000)/", + "WhenCreatedUTC": "/Date(1619484591000)/", + "ExchangeObjectId": "84178a51-0850-4bd4-873c-b8eea28e304c", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "1c36a79e-281c-41ac-adf0-441a9ef992c3", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "Enabled": true, + "ImpersonationProtectionState": "Automatic", + "EnableTargetedUserProtection": true, + "EnableMailboxIntelligenceProtection": true, + "EnableTargetedDomainsProtection": true, + "EnableOrganizationDomainsProtection": true, + "EnableMailboxIntelligence": true, + "EnableFirstContactSafetyTips": false, + "EnableSimilarUsersSafetyTips": true, + "EnableSimilarDomainsSafetyTips": true, + "EnableUnusualCharactersSafetyTips": true, + "TargetedUserProtectionAction": "Quarantine", + "TargetedUserQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "MailboxIntelligenceProtectionAction": "MoveToJmf", + "MailboxIntelligenceQuarantineTag": "DefaultFullAccessPolicy", + "TargetedDomainProtectionAction": "Quarantine", + "TargetedDomainQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "AuthenticationFailAction": "MoveToJmf", + "SpoofQuarantineTag": "DefaultFullAccessPolicy", + "EnableSpoofIntelligence": true, + "EnableViaTag": true, + "EnableUnauthenticatedSender": true, + "EnableSuspiciousSafetyTip": false, + "HonorDmarcPolicy": true, + "DmarcRejectAction": "Reject", + "DmarcQuarantineAction": "Quarantine", + "PhishThresholdLevel": 3, + "TargetedUsersToProtect": [], + "TargetedUserActionRecipients": [], + "MailboxIntelligenceProtectionActionRecipients": [], + "TargetedDomainsToProtect": [], + "TargetedDomainActionRecipients": [], + "ExcludedDomains": [], + "ExcludedSenders": [], + "IsDefault": false, + "AdminDisplayName": "", + "PolicyTag": "", + "RecommendedPolicyType": "Standard", + "Identity": "Standard Preset Security Policy1659535429826", + "Id": "Standard Preset Security Policy1659535429826", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Standard Preset Security Policy1659535429826", + "DistinguishedName": "CN=Standard Preset Security Policy1659535429826,CN=AntiPhish,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1687302657000)/", + "WhenCreated": "/Date(1659535432000)/", + "WhenChangedUTC": "/Date(1687302657000)/", + "WhenCreatedUTC": "/Date(1659535432000)/", + "ExchangeObjectId": "c039f211-68f7-43e8-822f-91c1e0e018f7", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "c039f211-68f7-43e8-822f-91c1e0e018f7", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" } -], - "safe_attachment_policies": [ + ], + "hosted_content_filter_policies": [ { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": false, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Custom", - "Redirect": true, - "RedirectAddress": "david.bui@agency.onmicrosoft.com", - "Identity": "Block unknown malware", - "Id": "Block unknown malware", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Block unknown malware", - "DistinguishedName": "CN=Block unknown malware,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1657151230000)/", - "WhenCreated": "/Date(1626469482000)/", - "WhenChangedUTC": "/Date(1657151230000)/", - "WhenCreatedUTC": "/Date(1626469482000)/", - "ExchangeObjectId": "d79581a3-b144-4d95-bdea-2031fca7aebc", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "d79581a3-b144-4d95-bdea-2031fca7aebc", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "AdminDisplayName": "", + "AddXHeaderValue": "", + "ModifySubjectValue": "", + "RedirectToRecipients": [], + "TestModeBccToRecipients": [], + "FalsePositiveAdditionalRecipients": [], + "QuarantineRetentionPeriod": 30, + "TestModeAction": "None", + "IncreaseScoreWithImageLinks": "Off", + "IncreaseScoreWithNumericIps": "Off", + "IncreaseScoreWithRedirectToOtherPort": "Off", + "IncreaseScoreWithBizOrInfoUrls": "Off", + "MarkAsSpamEmptyMessages": "Off", + "MarkAsSpamJavaScriptInHtml": "Off", + "MarkAsSpamFramesInHtml": "Off", + "MarkAsSpamObjectTagsInHtml": "Off", + "MarkAsSpamEmbedTagsInHtml": "Off", + "MarkAsSpamFormTagsInHtml": "Off", + "MarkAsSpamWebBugsInHtml": "Off", + "MarkAsSpamSensitiveWordList": "Off", + "MarkAsSpamSpfRecordHardFail": "Off", + "MarkAsSpamFromAddressAuthFail": "Off", + "MarkAsSpamBulkMail": "On", + "MarkAsSpamNdrBackscatter": "Off", + "IsDefault": false, + "LanguageBlockList": [], + "RegionBlockList": [], + "HighConfidenceSpamAction": "Quarantine", + "SpamAction": "Quarantine", + "DownloadLink": false, + "EnableRegionBlockList": false, + "EnableLanguageBlockList": false, + "BulkThreshold": 5, + "AllowedSenders": [], + "AllowedSenderDomains": [], + "BlockedSenders": [], + "BlockedSenderDomains": [], + "ZapEnabled": true, + "InlineSafetyTipsEnabled": true, + "BulkSpamAction": "Quarantine", + "PhishSpamAction": "Quarantine", + "SpamZapEnabled": true, + "PhishZapEnabled": true, + "IntraOrgFilterState": "Default", + "HighConfidencePhishAction": "Quarantine", + "RecommendedPolicyType": "Strict", + "SpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", + "BulkQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "Identity": "Strict Preset Security Policy1681329956650", + "Id": "Strict Preset Security Policy1681329956650", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Strict Preset Security Policy1681329956650", + "DistinguishedName": "CN=Strict Preset Security Policy1681329956650,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1681329967000)/", + "WhenCreated": "/Date(1681329957000)/", + "WhenChangedUTC": "/Date(1681329967000)/", + "WhenCreatedUTC": "/Date(1681329957000)/", + "ExchangeObjectId": "01a6119b-4398-43b1-a329-7335e292bd5d", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "01a6119b-4398-43b1-a329-7335e292bd5d", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": true, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Custom", - "Redirect": false, - "RedirectAddress": "", - "Identity": "Built-In Protection Policy", - "Id": "Built-In Protection Policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Built-In Protection Policy", - "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1643236382000)/", - "WhenCreated": "/Date(1643236368000)/", - "WhenChangedUTC": "/Date(1643236382000)/", - "WhenCreatedUTC": "/Date(1643236368000)/", - "ExchangeObjectId": "c34a2328-8f39-4afa-873a-8eba4b467a14", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "c34a2328-8f39-4afa-873a-8eba4b467a14", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "AdminDisplayName": "", + "AddXHeaderValue": "", + "ModifySubjectValue": "", + "RedirectToRecipients": [], + "TestModeBccToRecipients": [], + "FalsePositiveAdditionalRecipients": [], + "QuarantineRetentionPeriod": 30, + "TestModeAction": "None", + "IncreaseScoreWithImageLinks": "Off", + "IncreaseScoreWithNumericIps": "Off", + "IncreaseScoreWithRedirectToOtherPort": "Off", + "IncreaseScoreWithBizOrInfoUrls": "Off", + "MarkAsSpamEmptyMessages": "Off", + "MarkAsSpamJavaScriptInHtml": "Off", + "MarkAsSpamFramesInHtml": "Off", + "MarkAsSpamObjectTagsInHtml": "Off", + "MarkAsSpamEmbedTagsInHtml": "Off", + "MarkAsSpamFormTagsInHtml": "Off", + "MarkAsSpamWebBugsInHtml": "Off", + "MarkAsSpamSensitiveWordList": "Off", + "MarkAsSpamSpfRecordHardFail": "Off", + "MarkAsSpamFromAddressAuthFail": "Off", + "MarkAsSpamBulkMail": "On", + "MarkAsSpamNdrBackscatter": "Off", + "IsDefault": true, + "LanguageBlockList": [], + "RegionBlockList": [], + "HighConfidenceSpamAction": "Quarantine", + "SpamAction": "MoveToJmf", + "DownloadLink": false, + "EnableRegionBlockList": false, + "EnableLanguageBlockList": false, + "BulkThreshold": 6, + "AllowedSenders": [], + "AllowedSenderDomains": [], + "BlockedSenders": [], + "BlockedSenderDomains": [], + "ZapEnabled": true, + "InlineSafetyTipsEnabled": true, + "BulkSpamAction": "Quarantine", + "PhishSpamAction": "Quarantine", + "SpamZapEnabled": true, + "PhishZapEnabled": true, + "IntraOrgFilterState": "Default", + "HighConfidencePhishAction": "Quarantine", + "RecommendedPolicyType": "Custom", + "SpamQuarantineTag": "DefaultFullAccessPolicy", + "HighConfidenceSpamQuarantineTag": "NotificationEnabledPolicy", + "PhishQuarantineTag": "NotificationEnabledPolicy", + "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", + "BulkQuarantineTag": "NotificationEnabledPolicy", + "Identity": "Default", + "Id": "Default", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1647039792000)/", + "WhenCreated": "/Date(1619484590000)/", + "WhenChangedUTC": "/Date(1647039792000)/", + "WhenCreatedUTC": "/Date(1619484590000)/", + "ExchangeObjectId": "c2a6239d-0253-4693-b841-33ccd870af91", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "d07707d6-355e-4be5-a368-61e7757b28f5", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": false, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Strict", - "Redirect": false, - "RedirectAddress": "", - "Identity": "Strict Preset Security Policy1681329958553", - "Id": "Strict Preset Security Policy1681329958553", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Strict Preset Security Policy1681329958553", - "DistinguishedName": "CN=Strict Preset Security Policy1681329958553,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1681329967000)/", - "WhenCreated": "/Date(1681329958000)/", - "WhenChangedUTC": "/Date(1681329967000)/", - "WhenCreatedUTC": "/Date(1681329958000)/", - "ExchangeObjectId": "b653a1e5-018a-4f46-8144-4b7da91c6cea", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "b653a1e5-018a-4f46-8144-4b7da91c6cea", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "AdminDisplayName": "", + "AddXHeaderValue": "", + "ModifySubjectValue": "", + "RedirectToRecipients": [], + "TestModeBccToRecipients": [], + "FalsePositiveAdditionalRecipients": [], + "QuarantineRetentionPeriod": 30, + "TestModeAction": "None", + "IncreaseScoreWithImageLinks": "Off", + "IncreaseScoreWithNumericIps": "Off", + "IncreaseScoreWithRedirectToOtherPort": "Off", + "IncreaseScoreWithBizOrInfoUrls": "Off", + "MarkAsSpamEmptyMessages": "Off", + "MarkAsSpamJavaScriptInHtml": "Off", + "MarkAsSpamFramesInHtml": "Off", + "MarkAsSpamObjectTagsInHtml": "Off", + "MarkAsSpamEmbedTagsInHtml": "Off", + "MarkAsSpamFormTagsInHtml": "Off", + "MarkAsSpamWebBugsInHtml": "Off", + "MarkAsSpamSensitiveWordList": "Off", + "MarkAsSpamSpfRecordHardFail": "Off", + "MarkAsSpamFromAddressAuthFail": "Off", + "MarkAsSpamBulkMail": "On", + "MarkAsSpamNdrBackscatter": "Off", + "IsDefault": false, + "LanguageBlockList": [], + "RegionBlockList": [], + "HighConfidenceSpamAction": "Quarantine", + "SpamAction": "MoveToJmf", + "DownloadLink": false, + "EnableRegionBlockList": false, + "EnableLanguageBlockList": false, + "BulkThreshold": 6, + "AllowedSenders": [], + "AllowedSenderDomains": [], + "BlockedSenders": [], + "BlockedSenderDomains": [], + "ZapEnabled": true, + "InlineSafetyTipsEnabled": true, + "BulkSpamAction": "MoveToJmf", + "PhishSpamAction": "Quarantine", + "SpamZapEnabled": true, + "PhishZapEnabled": true, + "IntraOrgFilterState": "Default", + "HighConfidencePhishAction": "Quarantine", + "RecommendedPolicyType": "Standard", + "SpamQuarantineTag": "DefaultFullAccessPolicy", + "HighConfidenceSpamQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "PhishQuarantineTag": "DefaultFullAccessWithNotificationPolicy", + "HighConfidencePhishQuarantineTag": "AdminOnlyAccessPolicy", + "BulkQuarantineTag": "DefaultFullAccessPolicy", + "Identity": "Standard Preset Security Policy1659535432883", + "Id": "Standard Preset Security Policy1659535432883", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Standard Preset Security Policy1659535432883", + "DistinguishedName": "CN=Standard Preset Security Policy1659535432883,CN=Hosted Content Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1688679110000)/", + "WhenCreated": "/Date(1659535433000)/", + "WhenChangedUTC": "/Date(1688679110000)/", + "WhenCreatedUTC": "/Date(1659535433000)/", + "ExchangeObjectId": "5422a22e-b87d-4400-835d-4a63acc75082", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "5422a22e-b87d-4400-835d-4a63acc75082", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + } + ], + "safe_attachment_policies": [ + { + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": false, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Custom", + "Redirect": true, + "RedirectAddress": "david.bui@agency.onmicrosoft.com", + "Identity": "Block unknown malware", + "Id": "Block unknown malware", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Block unknown malware", + "DistinguishedName": "CN=Block unknown malware,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1657151230000)/", + "WhenCreated": "/Date(1626469482000)/", + "WhenChangedUTC": "/Date(1657151230000)/", + "WhenCreatedUTC": "/Date(1626469482000)/", + "ExchangeObjectId": "d79581a3-b144-4d95-bdea-2031fca7aebc", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "d79581a3-b144-4d95-bdea-2031fca7aebc", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": true, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Custom", + "Redirect": false, + "RedirectAddress": "", + "Identity": "Built-In Protection Policy", + "Id": "Built-In Protection Policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Built-In Protection Policy", + "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1643236382000)/", + "WhenCreated": "/Date(1643236368000)/", + "WhenChangedUTC": "/Date(1643236382000)/", + "WhenCreatedUTC": "/Date(1643236368000)/", + "ExchangeObjectId": "c34a2328-8f39-4afa-873a-8eba4b467a14", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "c34a2328-8f39-4afa-873a-8eba4b467a14", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": false, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Custom", - "Redirect": false, - "RedirectAddress": "", - "Identity": "AgencyImplementation", - "Id": "AgencyImplementation", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "AgencyImplementation", - "DistinguishedName": "CN=AgencyImplementation,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1651250217000)/", - "WhenCreated": "/Date(1651250213000)/", - "WhenChangedUTC": "/Date(1651250217000)/", - "WhenCreatedUTC": "/Date(1651250213000)/", - "ExchangeObjectId": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": false, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Strict", + "Redirect": false, + "RedirectAddress": "", + "Identity": "Strict Preset Security Policy1681329958553", + "Id": "Strict Preset Security Policy1681329958553", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Strict Preset Security Policy1681329958553", + "DistinguishedName": "CN=Strict Preset Security Policy1681329958553,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1681329967000)/", + "WhenCreated": "/Date(1681329958000)/", + "WhenChangedUTC": "/Date(1681329967000)/", + "WhenCreatedUTC": "/Date(1681329958000)/", + "ExchangeObjectId": "b653a1e5-018a-4f46-8144-4b7da91c6cea", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "b653a1e5-018a-4f46-8144-4b7da91c6cea", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": false, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Custom", - "Redirect": false, - "RedirectAddress": "", - "Identity": "Baseline Policy", - "Id": "Baseline Policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Baseline Policy", - "DistinguishedName": "CN=Baseline Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1651702853000)/", - "WhenCreated": "/Date(1651702851000)/", - "WhenChangedUTC": "/Date(1651702853000)/", - "WhenCreatedUTC": "/Date(1651702851000)/", - "ExchangeObjectId": "9c0b02d9-3b2e-434a-8370-316879ff9905", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "9c0b02d9-3b2e-434a-8370-316879ff9905", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": false, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Custom", + "Redirect": false, + "RedirectAddress": "", + "Identity": "AgencyImplementation", + "Id": "AgencyImplementation", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "AgencyImplementation", + "DistinguishedName": "CN=AgencyImplementation,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1651250217000)/", + "WhenCreated": "/Date(1651250213000)/", + "WhenChangedUTC": "/Date(1651250217000)/", + "WhenCreatedUTC": "/Date(1651250213000)/", + "ExchangeObjectId": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "592e7e80-97b4-4fd3-94b1-22e65fde4d4a", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Action": "Block", - "AdminDisplayName": "", - "Enable": true, - "EnableOrganizationBranding": false, - "IsBuiltInProtection": false, - "IsDefault": false, - "QuarantineTag": "AdminOnlyAccessPolicy", - "RecommendedPolicyType": "Standard", - "Redirect": false, - "RedirectAddress": "", - "Identity": "Standard Preset Security Policy1659535436109", - "Id": "Standard Preset Security Policy1659535436109", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Standard Preset Security Policy1659535436109", - "DistinguishedName": "CN=Standard Preset Security Policy1659535436109,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", - "ObjectClass": [ - "top", - "msExchSafeAttachmentProtectionConfig" - ], - "WhenChanged": "/Date(1688679110000)/", - "WhenCreated": "/Date(1659535436000)/", - "WhenChangedUTC": "/Date(1688679110000)/", - "WhenCreatedUTC": "/Date(1659535436000)/", - "ExchangeObjectId": "0f24b36f-33e9-4e08-89ca-b917a2c75427", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "0f24b36f-33e9-4e08-89ca-b917a2c75427", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": false, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Custom", + "Redirect": false, + "RedirectAddress": "", + "Identity": "Baseline Policy", + "Id": "Baseline Policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Baseline Policy", + "DistinguishedName": "CN=Baseline Policy,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1651702853000)/", + "WhenCreated": "/Date(1651702851000)/", + "WhenChangedUTC": "/Date(1651702853000)/", + "WhenCreatedUTC": "/Date(1651702851000)/", + "ExchangeObjectId": "9c0b02d9-3b2e-434a-8370-316879ff9905", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "9c0b02d9-3b2e-434a-8370-316879ff9905", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + }, + { + "Action": "Block", + "AdminDisplayName": "", + "Enable": true, + "EnableOrganizationBranding": false, + "IsBuiltInProtection": false, + "IsDefault": false, + "QuarantineTag": "AdminOnlyAccessPolicy", + "RecommendedPolicyType": "Standard", + "Redirect": false, + "RedirectAddress": "", + "Identity": "Standard Preset Security Policy1659535436109", + "Id": "Standard Preset Security Policy1659535436109", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Standard Preset Security Policy1659535436109", + "DistinguishedName": "CN=Standard Preset Security Policy1659535436109,CN=Safe Attachment,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Safe-Attachment-Protection-Config", + "ObjectClass": ["top", "msExchSafeAttachmentProtectionConfig"], + "WhenChanged": "/Date(1688679110000)/", + "WhenCreated": "/Date(1659535436000)/", + "WhenChangedUTC": "/Date(1688679110000)/", + "WhenCreatedUTC": "/Date(1659535436000)/", + "ExchangeObjectId": "0f24b36f-33e9-4e08-89ca-b917a2c75427", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "0f24b36f-33e9-4e08-89ca-b917a2c75427", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" } -], - "safe_attachment_rules": [ + ], + "safe_attachment_rules": [ { - "SafeAttachmentPolicy": "Block unknown malware", - "State": "Enabled", - "Priority": 0, - "Comments": null, - "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027associates.dhs.agency.govu0027 or u0027agency.netu0027 or u0027agency.onmicrosoft.comu0027 or u0027dhs.agency.govu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027rnTake the following actions:rntApply safe attachment policy 'Block unknown malware'.rn", - "RuleVersion": { - "Major": 15, - "Minor": 0, - "Build": 5, - "Revision": 2, - "MajorRevision": 0, - "MinorRevision": 2 - }, - "SentTo": null, - "SentToMemberOf": null, - "RecipientDomainIs": [ - "associates.dhs.agency.gov", - "agency.net", - "agency.onmicrosoft.com", - "dhs.agency.gov", - "agency.mail.onmicrosoft.com", - "test365.agency.dhs.gov" - ], - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" - ], - "Exceptions": null, - "Identity": "Block unknown malware", - "DistinguishedName": "CN=Block unknown malware,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", - "ImmutableId": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "Block unknown malware", - "IsValid": true, - "WhenChanged": "/Date(1657146377000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "SafeAttachmentPolicy": "Block unknown malware", + "State": "Enabled", + "Priority": 0, + "Comments": null, + "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027associates.dhs.agency.govu0027 or u0027agency.netu0027 or u0027agency.onmicrosoft.comu0027 or u0027dhs.agency.govu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027rnTake the following actions:rntApply safe attachment policy 'Block unknown malware'.rn", + "RuleVersion": { + "Major": 15, + "Minor": 0, + "Build": 5, + "Revision": 2, + "MajorRevision": 0, + "MinorRevision": 2 + }, + "SentTo": null, + "SentToMemberOf": null, + "RecipientDomainIs": [ + "associates.dhs.agency.gov", + "agency.net", + "agency.onmicrosoft.com", + "dhs.agency.gov", + "agency.mail.onmicrosoft.com", + "test365.agency.dhs.gov" + ], + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" + ], + "Exceptions": null, + "Identity": "Block unknown malware", + "DistinguishedName": "CN=Block unknown malware,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", + "ImmutableId": "73eb5fcb-92e1-4c9d-90a2-0c791fb4df7b", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "Block unknown malware", + "IsValid": true, + "WhenChanged": "/Date(1657146377000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" }, { - "SafeAttachmentPolicy": "AgencyImplementation", - "State": "Enabled", - "Priority": 1, - "Comments": null, - "Description": "If the message:rntIs sent to u0027alden.hilton@agency.onmicrosoft.comu0027rntand recipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'AgencyImplementation'.rn", - "RuleVersion": { - "Major": 15, - "Minor": 0, - "Build": 5, - "Revision": 2, - "MajorRevision": 0, - "MinorRevision": 2 - }, - "SentTo": [ - "alden.hilton@agency.onmicrosoft.com" - ], - "SentToMemberOf": null, - "RecipientDomainIs": [ - "agency.onmicrosoft.com" - ], - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate", - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" - ], - "Exceptions": null, - "Identity": "AgencyImplementation", - "DistinguishedName": "CN=AgencyImplementation,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "9c771902-50c2-428a-b15e-4768da56f444", - "ImmutableId": "9c771902-50c2-428a-b15e-4768da56f444", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "AgencyImplementation", - "IsValid": true, - "WhenChanged": "/Date(1651250217000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "SafeAttachmentPolicy": "AgencyImplementation", + "State": "Enabled", + "Priority": 1, + "Comments": null, + "Description": "If the message:rntIs sent to u0027alden.hilton@agency.onmicrosoft.comu0027rntand recipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'AgencyImplementation'.rn", + "RuleVersion": { + "Major": 15, + "Minor": 0, + "Build": 5, + "Revision": 2, + "MajorRevision": 0, + "MinorRevision": 2 + }, + "SentTo": ["alden.hilton@agency.onmicrosoft.com"], + "SentToMemberOf": null, + "RecipientDomainIs": ["agency.onmicrosoft.com"], + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate", + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" + ], + "Exceptions": null, + "Identity": "AgencyImplementation", + "DistinguishedName": "CN=AgencyImplementation,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "9c771902-50c2-428a-b15e-4768da56f444", + "ImmutableId": "9c771902-50c2-428a-b15e-4768da56f444", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "AgencyImplementation", + "IsValid": true, + "WhenChanged": "/Date(1651250217000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" }, { - "SafeAttachmentPolicy": "Baseline Policy", - "State": "Enabled", - "Priority": 2, - "Comments": null, - "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'Baseline Policy'.rn", - "RuleVersion": { - "Major": 15, - "Minor": 0, - "Build": 5, - "Revision": 2, - "MajorRevision": 0, - "MinorRevision": 2 - }, - "SentTo": null, - "SentToMemberOf": null, - "RecipientDomainIs": [ - "agency.onmicrosoft.com" - ], - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" - ], - "Exceptions": null, - "Identity": "Baseline Policy", - "DistinguishedName": "CN=Baseline Policy,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", - "ImmutableId": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "Baseline Policy", - "IsValid": true, - "WhenChanged": "/Date(1651702853000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "SafeAttachmentPolicy": "Baseline Policy", + "State": "Enabled", + "Priority": 2, + "Comments": null, + "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027rnTake the following actions:rntApply safe attachment policy 'Baseline Policy'.rn", + "RuleVersion": { + "Major": 15, + "Minor": 0, + "Build": 5, + "Revision": 2, + "MajorRevision": 0, + "MinorRevision": 2 + }, + "SentTo": null, + "SentToMemberOf": null, + "RecipientDomainIs": ["agency.onmicrosoft.com"], + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" + ], + "Exceptions": null, + "Identity": "Baseline Policy", + "DistinguishedName": "CN=Baseline Policy,CN=SafeAttachmentVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", + "ImmutableId": "0ad2c9bc-ac7a-43d2-a41d-33a8b45e1d20", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "Baseline Policy", + "IsValid": true, + "WhenChanged": "/Date(1651702853000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" } -], - "all_domains": [ + ], + "all_domains": [ { - "DomainName": "dhs.agency.gov", - "CatchAllRecipientID": null, - "DomainType": "Authoritative", - "MatchSubDomains": false, - "AddressBookEnabled": true, - "Default": false, - "EmailOnly": false, - "ExternallyManaged": false, - "RawAuthenticationType": "Managed", - "AuthenticationType": "Managed", - "LiveIdInstanceType": "Business", - "PendingRemoval": false, - "PendingCompletion": false, - "FederatedOrganizationLink": "Federation", - "MailFlowPartner": null, - "OutboundOnly": false, - "PendingFederatedAccountNamespace": false, - "PendingFederatedDomain": false, - "IsCoexistenceDomain": false, - "PerimeterDuplicateDetected": false, - "IsDefaultFederatedDomain": false, - "EnableNego2Authentication": false, - "CanHaveCloudCache": false, - "SendingFromDomainDisabled": false, - "InitialDomain": false, - "AdminDisplayName": "", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "dhs.agency.gov", - "DistinguishedName": "CN=dhs.agency.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "dhs.agency.gov", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", - "ObjectClass": [ - "top", - "msExchAcceptedDomain" - ], - "WhenChanged": "/Date(1644602837000)/", - "WhenCreated": "/Date(1622044989000)/", - "WhenChangedUTC": "/Date(1644602837000)/", - "WhenCreatedUTC": "/Date(1622044989000)/", - "ExchangeObjectId": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "dhs.agency.gov", - "Guid": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "DomainName": "dhs.agency.gov", + "CatchAllRecipientID": null, + "DomainType": "Authoritative", + "MatchSubDomains": false, + "AddressBookEnabled": true, + "Default": false, + "EmailOnly": false, + "ExternallyManaged": false, + "RawAuthenticationType": "Managed", + "AuthenticationType": "Managed", + "LiveIdInstanceType": "Business", + "PendingRemoval": false, + "PendingCompletion": false, + "FederatedOrganizationLink": "Federation", + "MailFlowPartner": null, + "OutboundOnly": false, + "PendingFederatedAccountNamespace": false, + "PendingFederatedDomain": false, + "IsCoexistenceDomain": false, + "PerimeterDuplicateDetected": false, + "IsDefaultFederatedDomain": false, + "EnableNego2Authentication": false, + "CanHaveCloudCache": false, + "SendingFromDomainDisabled": false, + "InitialDomain": false, + "AdminDisplayName": "", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "dhs.agency.gov", + "DistinguishedName": "CN=dhs.agency.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "dhs.agency.gov", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", + "ObjectClass": ["top", "msExchAcceptedDomain"], + "WhenChanged": "/Date(1644602837000)/", + "WhenCreated": "/Date(1622044989000)/", + "WhenChangedUTC": "/Date(1644602837000)/", + "WhenCreatedUTC": "/Date(1622044989000)/", + "ExchangeObjectId": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "dhs.agency.gov", + "Guid": "fd4d7ca3-1d0f-4fba-812c-60c380d2ede1", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" }, { - "DomainName": "test365.agency.dhs.gov", - "CatchAllRecipientID": null, - "DomainType": "Authoritative", - "MatchSubDomains": false, - "AddressBookEnabled": true, - "Default": false, - "EmailOnly": false, - "ExternallyManaged": false, - "RawAuthenticationType": "Managed", - "AuthenticationType": "Managed", - "LiveIdInstanceType": "Business", - "PendingRemoval": false, - "PendingCompletion": false, - "FederatedOrganizationLink": "Federation", - "MailFlowPartner": null, - "OutboundOnly": false, - "PendingFederatedAccountNamespace": false, - "PendingFederatedDomain": false, - "IsCoexistenceDomain": false, - "PerimeterDuplicateDetected": false, - "IsDefaultFederatedDomain": false, - "EnableNego2Authentication": false, - "CanHaveCloudCache": false, - "SendingFromDomainDisabled": false, - "InitialDomain": false, - "AdminDisplayName": "", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "test365.agency.dhs.gov", - "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "test365.agency.dhs.gov", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", - "ObjectClass": [ - "top", - "msExchAcceptedDomain" - ], - "WhenChanged": "/Date(1644607747000)/", - "WhenCreated": "/Date(1644607740000)/", - "WhenChangedUTC": "/Date(1644607747000)/", - "WhenCreatedUTC": "/Date(1644607740000)/", - "ExchangeObjectId": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "test365.agency.dhs.gov", - "Guid": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "DomainName": "test365.agency.dhs.gov", + "CatchAllRecipientID": null, + "DomainType": "Authoritative", + "MatchSubDomains": false, + "AddressBookEnabled": true, + "Default": false, + "EmailOnly": false, + "ExternallyManaged": false, + "RawAuthenticationType": "Managed", + "AuthenticationType": "Managed", + "LiveIdInstanceType": "Business", + "PendingRemoval": false, + "PendingCompletion": false, + "FederatedOrganizationLink": "Federation", + "MailFlowPartner": null, + "OutboundOnly": false, + "PendingFederatedAccountNamespace": false, + "PendingFederatedDomain": false, + "IsCoexistenceDomain": false, + "PerimeterDuplicateDetected": false, + "IsDefaultFederatedDomain": false, + "EnableNego2Authentication": false, + "CanHaveCloudCache": false, + "SendingFromDomainDisabled": false, + "InitialDomain": false, + "AdminDisplayName": "", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "test365.agency.dhs.gov", + "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "test365.agency.dhs.gov", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", + "ObjectClass": ["top", "msExchAcceptedDomain"], + "WhenChanged": "/Date(1644607747000)/", + "WhenCreated": "/Date(1644607740000)/", + "WhenChangedUTC": "/Date(1644607747000)/", + "WhenCreatedUTC": "/Date(1644607740000)/", + "ExchangeObjectId": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "test365.agency.dhs.gov", + "Guid": "29b2ebcb-77d8-4e37-80ce-83c660e56b3f", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" }, { - "DomainName": "agency.mail.onmicrosoft.com", - "CatchAllRecipientID": null, - "DomainType": "Authoritative", - "MatchSubDomains": false, - "AddressBookEnabled": true, - "Default": false, - "EmailOnly": false, - "ExternallyManaged": false, - "RawAuthenticationType": "Managed", - "AuthenticationType": "Managed", - "LiveIdInstanceType": "Business", - "PendingRemoval": false, - "PendingCompletion": false, - "FederatedOrganizationLink": "Federation", - "MailFlowPartner": null, - "OutboundOnly": false, - "PendingFederatedAccountNamespace": false, - "PendingFederatedDomain": false, - "IsCoexistenceDomain": true, - "PerimeterDuplicateDetected": false, - "IsDefaultFederatedDomain": false, - "EnableNego2Authentication": false, - "CanHaveCloudCache": false, - "SendingFromDomainDisabled": false, - "InitialDomain": false, - "AdminDisplayName": "", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency.mail.onmicrosoft.com", - "DistinguishedName": "CN=agency.mail.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "agency.mail.onmicrosoft.com", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", - "ObjectClass": [ - "top", - "msExchAcceptedDomain" - ], - "WhenChanged": "/Date(1638297172000)/", - "WhenCreated": "/Date(1638297171000)/", - "WhenChangedUTC": "/Date(1638297172000)/", - "WhenCreatedUTC": "/Date(1638297171000)/", - "ExchangeObjectId": "b9ca153b-90dc-4583-87c4-d74af214be2d", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "agency.mail.onmicrosoft.com", - "Guid": "b9ca153b-90dc-4583-87c4-d74af214be2d", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "DomainName": "agency.mail.onmicrosoft.com", + "CatchAllRecipientID": null, + "DomainType": "Authoritative", + "MatchSubDomains": false, + "AddressBookEnabled": true, + "Default": false, + "EmailOnly": false, + "ExternallyManaged": false, + "RawAuthenticationType": "Managed", + "AuthenticationType": "Managed", + "LiveIdInstanceType": "Business", + "PendingRemoval": false, + "PendingCompletion": false, + "FederatedOrganizationLink": "Federation", + "MailFlowPartner": null, + "OutboundOnly": false, + "PendingFederatedAccountNamespace": false, + "PendingFederatedDomain": false, + "IsCoexistenceDomain": true, + "PerimeterDuplicateDetected": false, + "IsDefaultFederatedDomain": false, + "EnableNego2Authentication": false, + "CanHaveCloudCache": false, + "SendingFromDomainDisabled": false, + "InitialDomain": false, + "AdminDisplayName": "", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency.mail.onmicrosoft.com", + "DistinguishedName": "CN=agency.mail.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "agency.mail.onmicrosoft.com", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", + "ObjectClass": ["top", "msExchAcceptedDomain"], + "WhenChanged": "/Date(1638297172000)/", + "WhenCreated": "/Date(1638297171000)/", + "WhenChangedUTC": "/Date(1638297172000)/", + "WhenCreatedUTC": "/Date(1638297171000)/", + "ExchangeObjectId": "b9ca153b-90dc-4583-87c4-d74af214be2d", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "agency.mail.onmicrosoft.com", + "Guid": "b9ca153b-90dc-4583-87c4-d74af214be2d", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" }, { - "DomainName": "agency.onmicrosoft.com", - "CatchAllRecipientID": null, - "DomainType": "Authoritative", - "MatchSubDomains": false, - "AddressBookEnabled": true, - "Default": true, - "EmailOnly": false, - "ExternallyManaged": false, - "RawAuthenticationType": "Managed", - "AuthenticationType": "Managed", - "LiveIdInstanceType": "Business", - "PendingRemoval": false, - "PendingCompletion": false, - "FederatedOrganizationLink": "Federation", - "MailFlowPartner": null, - "OutboundOnly": false, - "PendingFederatedAccountNamespace": false, - "PendingFederatedDomain": false, - "IsCoexistenceDomain": false, - "PerimeterDuplicateDetected": false, - "IsDefaultFederatedDomain": false, - "EnableNego2Authentication": false, - "CanHaveCloudCache": false, - "SendingFromDomainDisabled": false, - "InitialDomain": true, - "AdminDisplayName": "", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency.onmicrosoft.com", - "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "agency.onmicrosoft.com", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", - "ObjectClass": [ - "top", - "msExchAcceptedDomain" - ], - "WhenChanged": "/Date(1638297928000)/", - "WhenCreated": "/Date(1619484595000)/", - "WhenChangedUTC": "/Date(1638297928000)/", - "WhenCreatedUTC": "/Date(1619484595000)/", - "ExchangeObjectId": "e4efdb30-a9d0-4418-b5dc-a2e05cfce7a8", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "agency.onmicrosoft.com", - "Guid": "4bb75a29-a0ad-46bc-b70c-e3928a29256a", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "DomainName": "agency.onmicrosoft.com", + "CatchAllRecipientID": null, + "DomainType": "Authoritative", + "MatchSubDomains": false, + "AddressBookEnabled": true, + "Default": true, + "EmailOnly": false, + "ExternallyManaged": false, + "RawAuthenticationType": "Managed", + "AuthenticationType": "Managed", + "LiveIdInstanceType": "Business", + "PendingRemoval": false, + "PendingCompletion": false, + "FederatedOrganizationLink": "Federation", + "MailFlowPartner": null, + "OutboundOnly": false, + "PendingFederatedAccountNamespace": false, + "PendingFederatedDomain": false, + "IsCoexistenceDomain": false, + "PerimeterDuplicateDetected": false, + "IsDefaultFederatedDomain": false, + "EnableNego2Authentication": false, + "CanHaveCloudCache": false, + "SendingFromDomainDisabled": false, + "InitialDomain": true, + "AdminDisplayName": "", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency.onmicrosoft.com", + "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Accepted Domains,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "agency.onmicrosoft.com", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Accepted-Domain", + "ObjectClass": ["top", "msExchAcceptedDomain"], + "WhenChanged": "/Date(1638297928000)/", + "WhenCreated": "/Date(1619484595000)/", + "WhenChangedUTC": "/Date(1638297928000)/", + "WhenCreatedUTC": "/Date(1619484595000)/", + "ExchangeObjectId": "e4efdb30-a9d0-4418-b5dc-a2e05cfce7a8", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "agency.onmicrosoft.com", + "Guid": "4bb75a29-a0ad-46bc-b70c-e3928a29256a", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" } -], - "protection_alerts": [ + ], + "protection_alerts": [ { - "Filter": null, - "Operation": [ - "DlpRuleGenerateAlertMatch" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": { - "DlpRuleId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", - "EndpointDlpRestrictiveOperations": "FileUploadedToCloud,FileAccessedByUnallowedApp" - }, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "DataLossPrevention", - "IsSystemRule": false, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "3b7a951e-cfb8-4c75-ae74-f93079e0f31a", - "Comment": "", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "1dc97d3c-e298-4fef-d90f-08db45bcfdbb", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "b314399f-5d64-4c49-98c3-06deb1be2b6f", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "DLP-Baseline Rule", - "DistinguishedName": "CN=DLP-Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1682448225000)/", - "WhenCreated": "/Date(1651249999000)/", - "WhenChangedUTC": "/Date(1682448225000)/", - "WhenCreatedUTC": "/Date(1651249999000)/", - "ExchangeObjectId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["DlpRuleGenerateAlertMatch"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": { + "DlpRuleId": "2e3f0308-5340-46ac-9f8d-d54f208a8024", + "EndpointDlpRestrictiveOperations": "FileUploadedToCloud,FileAccessedByUnallowedApp" + }, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "DataLossPrevention", + "IsSystemRule": false, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "3b7a951e-cfb8-4c75-ae74-f93079e0f31a", + "Comment": "", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "1dc97d3c-e298-4fef-d90f-08db45bcfdbb", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "b314399f-5d64-4c49-98c3-06deb1be2b6f", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-Baseline Rule", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "DLP-Baseline Rule", + "DistinguishedName": "CN=DLP-Baseline Rule,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1682448225000)/", + "WhenCreated": "/Date(1651249999000)/", + "WhenChangedUTC": "/Date(1682448225000)/", + "WhenCreatedUTC": "/Date(1651249999000)/", + "ExchangeObjectId": "b314399f-5d64-4c49-98c3-06deb1be2b6f", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "DlpRuleGenerateAlertMatch" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": { - "DlpRuleId": "9a7b93f6-6c70-474c-854a-82116ce288ef" - }, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "DataLossPrevention", - "IsSystemRule": false, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "37a2473a-9a91-4790-a96f-a93db6da9d55", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "389ecc86-2adf-4498-be19-81c3fd5ef512", - "Comment": "", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "b7142061-eba9-4341-594a-08db9cf8a82e", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "37a2473a-9a91-4790-a96f-a93db6da9d55", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "DLP-PII Check", - "DistinguishedName": "CN=DLP-PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1692039599000)/", - "WhenCreated": "/Date(1692039599000)/", - "WhenChangedUTC": "/Date(1692039599000)/", - "WhenCreatedUTC": "/Date(1692039599000)/", - "ExchangeObjectId": "37a2473a-9a91-4790-a96f-a93db6da9d55", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["DlpRuleGenerateAlertMatch"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": { + "DlpRuleId": "9a7b93f6-6c70-474c-854a-82116ce288ef" + }, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "DataLossPrevention", + "IsSystemRule": false, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "37a2473a-9a91-4790-a96f-a93db6da9d55", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "389ecc86-2adf-4498-be19-81c3fd5ef512", + "Comment": "", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "b7142061-eba9-4341-594a-08db9cf8a82e", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "37a2473a-9a91-4790-a96f-a93db6da9d55", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration/DLP-PII Check", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "DLP-PII Check", + "DistinguishedName": "CN=DLP-PII Check,CN=Configuration,CN=agency.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1692039599000)/", + "WhenCreated": "/Date(1692039599000)/", + "WhenChangedUTC": "/Date(1692039599000)/", + "WhenCreatedUTC": "/Date(1692039599000)/", + "ExchangeObjectId": "37a2473a-9a91-4790-a96f-a93db6da9d55", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "MipAutoLabelSimulationCompletion" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", - "Comment": "AutoLabel policy simulation has been completed. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "38ef539d-4bbc-403b-ba71-08d8e31643f7", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "MIP AutoLabel simulation completed", - "DistinguishedName": "CN=MIP AutoLabel simulation completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1615306404000)/", - "WhenCreated": "/Date(1615306404000)/", - "WhenChangedUTC": "/Date(1615306404000)/", - "WhenCreatedUTC": "/Date(1615306404000)/", - "ExchangeObjectId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["MipAutoLabelSimulationCompletion"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", + "Comment": "AutoLabel policy simulation has been completed. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "38ef539d-4bbc-403b-ba71-08d8e31643f7", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/MIP AutoLabel simulation completed", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "MIP AutoLabel simulation completed", + "DistinguishedName": "CN=MIP AutoLabel simulation completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1615306404000)/", + "WhenCreated": "/Date(1615306404000)/", + "WhenChangedUTC": "/Date(1615306404000)/", + "WhenCreatedUTC": "/Date(1615306404000)/", + "ExchangeObjectId": "dac59cbc-1d3b-4f5e-91e0-02d780c53915", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", - "Operation": [ - "CompromisedWarningAccount" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "be215649-fba8-4339-9ddd-05991a43b948", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "105a3254-0eca-4a3d-8686-a66115a99235", - "Comment": "User has been detected as sending suspicious messages outside the organization and will be restricted if this activity continues. -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "6ab41379-a75a-4432-6909-08d7b68de580", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "be215649-fba8-4339-9ddd-05991a43b948", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Suspicious email sending patterns detected", - "DistinguishedName": "CN=Suspicious email sending patterns detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1582262485000)/", - "WhenCreated": "/Date(1556224605000)/", - "WhenChangedUTC": "/Date(1582262485000)/", - "WhenCreatedUTC": "/Date(1556224605000)/", - "ExchangeObjectId": "be215649-fba8-4339-9ddd-05991a43b948", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", + "Operation": ["CompromisedWarningAccount"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "be215649-fba8-4339-9ddd-05991a43b948", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "105a3254-0eca-4a3d-8686-a66115a99235", + "Comment": "User has been detected as sending suspicious messages outside the organization and will be restricted if this activity continues. -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "6ab41379-a75a-4432-6909-08d7b68de580", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "be215649-fba8-4339-9ddd-05991a43b948", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious email sending patterns detected", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Suspicious email sending patterns detected", + "DistinguishedName": "CN=Suspicious email sending patterns detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1582262485000)/", + "WhenCreated": "/Date(1556224605000)/", + "WhenChangedUTC": "/Date(1582262485000)/", + "WhenCreatedUTC": "/Date(1556224605000)/", + "ExchangeObjectId": "be215649-fba8-4339-9ddd-05991a43b948", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and (Mail.IsGenericZapped -eq 1) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malicious", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "a1f563cc-fb1f-466b-1fb5-08d8d71a3050", - "Comment": "Malicious emails were delivered and later removed -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "9f756b13-a826-4e49-bb3e-08da1c767a9f", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "b8f6b088-5487-4c70-037c-08d8d71a43fe", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages removed after delivery​", - "DistinguishedName": "CN=Email messages removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1649762441000)/", - "WhenCreated": "/Date(1620114418000)/", - "WhenChangedUTC": "/Date(1649762441000)/", - "WhenCreatedUTC": "/Date(1620114418000)/", - "ExchangeObjectId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and (Mail.IsGenericZapped -eq 1) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malicious", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "a1f563cc-fb1f-466b-1fb5-08d8d71a3050", + "Comment": "Malicious emails were delivered and later removed -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "9f756b13-a826-4e49-bb3e-08da1c767a9f", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "b8f6b088-5487-4c70-037c-08d8d71a43fe", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages removed after delivery​", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages removed after delivery​", + "DistinguishedName": "CN=Email messages removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1649762441000)/", + "WhenCreated": "/Date(1620114418000)/", + "WhenChangedUTC": "/Date(1649762441000)/", + "WhenCreatedUTC": "/Date(1620114418000)/", + "ExchangeObjectId": "b8f6b088-5487-4c70-037c-08d8d71a43fe", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsCampaignZapped -eq 1 -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malicious", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "ef850570-5624-42b2-ff0a-08d8d899d578", - "Comment": "Emails messages from a campaign were delivered and later removed -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "be3e023e-6cff-4e27-926d-08da1c767be1", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages from a campaign removed after delivery​", - "DistinguishedName": "CN=Email messages from a campaign removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1649762443000)/", - "WhenCreated": "/Date(1620114417000)/", - "WhenChangedUTC": "/Date(1649762443000)/", - "WhenCreatedUTC": "/Date(1620114417000)/", - "ExchangeObjectId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsCampaignZapped -eq 1 -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malicious", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "ef850570-5624-42b2-ff0a-08d8d899d578", + "Comment": "Emails messages from a campaign were delivered and later removed -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "be3e023e-6cff-4e27-926d-08da1c767be1", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages from a campaign removed after delivery​", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages from a campaign removed after delivery​", + "DistinguishedName": "CN=Email messages from a campaign removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1649762443000)/", + "WhenCreated": "/Date(1620114417000)/", + "WhenChangedUTC": "/Date(1649762443000)/", + "WhenCreatedUTC": "/Date(1620114417000)/", + "ExchangeObjectId": "c8522cbb-9368-4e25-4ee9-08d8d899dfab", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.AirItemType -eq u0027Useru0027", - "Operation": [ - "AirManualInvestigation" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "845686e4-f843-42cf-36d7-08d8e2eca19c", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "fbb0585f-318a-4e26-eec9-08d8e2ec980c", - "Comment": "This alert is triggered because an admin triggered investigation of a user -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "9ea1637e-f98f-4a7f-a6ae-08d9565f1334", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "845686e4-f843-42cf-36d7-08d8e2eca19c", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Admin triggered user compromise investigation", - "DistinguishedName": "CN=Admin triggered user compromise investigation,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1627982059000)/", - "WhenCreated": "/Date(1627982059000)/", - "WhenChangedUTC": "/Date(1627982059000)/", - "WhenCreatedUTC": "/Date(1627982059000)/", - "ExchangeObjectId": "845686e4-f843-42cf-36d7-08d8e2eca19c", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.AirItemType -eq u0027Useru0027", + "Operation": ["AirManualInvestigation"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "845686e4-f843-42cf-36d7-08d8e2eca19c", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "fbb0585f-318a-4e26-eec9-08d8e2ec980c", + "Comment": "This alert is triggered because an admin triggered investigation of a user -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "9ea1637e-f98f-4a7f-a6ae-08d9565f1334", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "845686e4-f843-42cf-36d7-08d8e2eca19c", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered user compromise investigation", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Admin triggered user compromise investigation", + "DistinguishedName": "CN=Admin triggered user compromise investigation,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1627982059000)/", + "WhenCreated": "/Date(1627982059000)/", + "WhenChangedUTC": "/Date(1627982059000)/", + "WhenCreatedUTC": "/Date(1627982059000)/", + "ExchangeObjectId": "845686e4-f843-42cf-36d7-08d8e2eca19c", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Click.IsSystemBlockOverriden -eq 1) -or (Click.IsTenantBlockOverriden -eq 1)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "None", - "ThreatType": "MaliciousUrlClick", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "MaliciousUrlClick", - "Scenario": "MaliciousUrlClick", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "e7fec753-4e4b-491c-2152-08d97b58ad34", - "Comment": "We have detected that one of your users has recently clicked through on a link that was found to be malicious. -V1.0.0.3", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "5634e57e-6702-4cdd-f4a0-08da42ee473d", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "A user clicked through to a potentially malicious URL​", - "DistinguishedName": "CN=A user clicked through to a potentially malicious URL​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1653992039000)/", - "WhenCreated": "/Date(1653992039000)/", - "WhenChangedUTC": "/Date(1653992039000)/", - "WhenCreatedUTC": "/Date(1653992039000)/", - "ExchangeObjectId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Click.IsSystemBlockOverriden -eq 1) -or (Click.IsTenantBlockOverriden -eq 1)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "None", + "ThreatType": "MaliciousUrlClick", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "MaliciousUrlClick", + "Scenario": "MaliciousUrlClick", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "e7fec753-4e4b-491c-2152-08d97b58ad34", + "Comment": "We have detected that one of your users has recently clicked through on a link that was found to be malicious. -V1.0.0.3", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "5634e57e-6702-4cdd-f4a0-08da42ee473d", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A user clicked through to a potentially malicious URL​", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "A user clicked through to a potentially malicious URL​", + "DistinguishedName": "CN=A user clicked through to a potentially malicious URL​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1653992039000)/", + "WhenCreated": "/Date(1653992039000)/", + "WhenChangedUTC": "/Date(1653992039000)/", + "WhenCreatedUTC": "/Date(1653992039000)/", + "ExchangeObjectId": "5453b67e-6c81-4a46-b96c-08d97b58d4ac", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "ConnectorAbuse" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "d1de9ca1-fcd8-4ce1-f041-08da05b11773", - "Comment": "Connector has been restricted from sending messages due to potential compromise activity. -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "df6b603b-1b0b-4b0a-7440-08da326d8875", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Suspicious connector activity", - "DistinguishedName": "CN=Suspicious connector activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1652177524000)/", - "WhenCreated": "/Date(1652177524000)/", - "WhenChangedUTC": "/Date(1652177524000)/", - "WhenCreatedUTC": "/Date(1652177524000)/", - "ExchangeObjectId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["ConnectorAbuse"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "d1de9ca1-fcd8-4ce1-f041-08da05b11773", + "Comment": "Connector has been restricted from sending messages due to potential compromise activity. -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "df6b603b-1b0b-4b0a-7440-08da326d8875", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious connector activity", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Suspicious connector activity", + "DistinguishedName": "CN=Suspicious connector activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1652177524000)/", + "WhenCreated": "/Date(1652177524000)/", + "WhenChangedUTC": "/Date(1652177524000)/", + "WhenCreatedUTC": "/Date(1652177524000)/", + "ExchangeObjectId": "8bb9c6c8-dc12-40e1-5bb8-08da05b13393", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "UploadDataCompleted" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1647059763913)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "55272906-f9a5-4adf-9395-0abeec18aee1", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "8d58b459-63cd-4b73-aca0-f24ed896f018", - "Comment": "New sensitive information was uploaded and is ready to be protected. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "a6a5ec5d-6e43-43c3-420c-08d8d285b1f9", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "55272906-f9a5-4adf-9395-0abeec18aee1", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Successful exact data match upload", - "DistinguishedName": "CN=Successful exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1613485093000)/", - "WhenCreated": "/Date(1613485093000)/", - "WhenChangedUTC": "/Date(1613485093000)/", - "WhenCreatedUTC": "/Date(1613485093000)/", - "ExchangeObjectId": "55272906-f9a5-4adf-9395-0abeec18aee1", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["UploadDataCompleted"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1647059763913)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "55272906-f9a5-4adf-9395-0abeec18aee1", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "8d58b459-63cd-4b73-aca0-f24ed896f018", + "Comment": "New sensitive information was uploaded and is ready to be protected. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "a6a5ec5d-6e43-43c3-420c-08d8d285b1f9", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "55272906-f9a5-4adf-9395-0abeec18aee1", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Successful exact data match upload", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Successful exact data match upload", + "DistinguishedName": "CN=Successful exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1613485093000)/", + "WhenCreated": "/Date(1613485093000)/", + "WhenChangedUTC": "/Date(1613485093000)/", + "WhenCreatedUTC": "/Date(1613485093000)/", + "ExchangeObjectId": "55272906-f9a5-4adf-9395-0abeec18aee1", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "GrantAdminPermission" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "AccessGovernance", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "17d51759-88e1-40c1-8df3-20bcf2e43057", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "ae6108c1-8814-4a00-bf93-22396aad4bd8", - "Comment": "This alert is triggered when someone in your organization becomes an Exchange admin or gets new Exchange admin permissions -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "18bb7a7d-0b75-4033-cc22-08d6bdf100e3", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "17d51759-88e1-40c1-8df3-20bcf2e43057", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Elevation of Exchange admin privilege", - "DistinguishedName": "CN=Elevation of Exchange admin privilege,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1554927211000)/", - "WhenCreated": "/Date(1554927211000)/", - "WhenChangedUTC": "/Date(1554927211000)/", - "WhenCreatedUTC": "/Date(1554927211000)/", - "ExchangeObjectId": "17d51759-88e1-40c1-8df3-20bcf2e43057", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["GrantAdminPermission"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "AccessGovernance", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "17d51759-88e1-40c1-8df3-20bcf2e43057", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "ae6108c1-8814-4a00-bf93-22396aad4bd8", + "Comment": "This alert is triggered when someone in your organization becomes an Exchange admin or gets new Exchange admin permissions -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "18bb7a7d-0b75-4033-cc22-08d6bdf100e3", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "17d51759-88e1-40c1-8df3-20bcf2e43057", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Elevation of Exchange admin privilege", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Elevation of Exchange admin privilege", + "DistinguishedName": "CN=Elevation of Exchange admin privilege,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1554927211000)/", + "WhenCreated": "/Date(1554927211000)/", + "WhenChangedUTC": "/Date(1554927211000)/", + "WhenCreatedUTC": "/Date(1554927211000)/", + "ExchangeObjectId": "17d51759-88e1-40c1-8df3-20bcf2e43057", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Message.Verdict -eq u0027Blocku0027", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": 1, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "None", - "ThreatType": "MailFlow", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "MailFlow", - "Scenario": "MailFlowProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "CustomAggregation", - "Category": "MailFlow", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "ce504573-4841-4e45-81e2-21e8a11ba221", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "497d08c4-ecce-4a94-b8f4-bcce7de01389", - "Comment": "This alert is triggered when a reply-all storm is detected and at least one reply-all to the mail thread has been blocked. See the Reply-all Storm Protection mail flow report for more information. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "a41b6668-24a9-47f8-67a4-08dba3f19809", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "ce504573-4841-4e45-81e2-21e8a11ba221", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Reply-all storm detected", - "DistinguishedName": "CN=Reply-all storm detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1692806223000)/", - "WhenCreated": "/Date(1692806223000)/", - "WhenChangedUTC": "/Date(1692806223000)/", - "WhenCreatedUTC": "/Date(1692806223000)/", - "ExchangeObjectId": "ce504573-4841-4e45-81e2-21e8a11ba221", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Message.Verdict -eq u0027Blocku0027", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": 1, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "None", + "ThreatType": "MailFlow", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "MailFlow", + "Scenario": "MailFlowProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "CustomAggregation", + "Category": "MailFlow", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "ce504573-4841-4e45-81e2-21e8a11ba221", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "497d08c4-ecce-4a94-b8f4-bcce7de01389", + "Comment": "This alert is triggered when a reply-all storm is detected and at least one reply-all to the mail thread has been blocked. See the Reply-all Storm Protection mail flow report for more information. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "a41b6668-24a9-47f8-67a4-08dba3f19809", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "ce504573-4841-4e45-81e2-21e8a11ba221", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Reply-all storm detected", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Reply-all storm detected", + "DistinguishedName": "CN=Reply-all storm detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1692806223000)/", + "WhenCreated": "/Date(1692806223000)/", + "WhenChangedUTC": "/Date(1692806223000)/", + "WhenCreatedUTC": "/Date(1692806223000)/", + "ExchangeObjectId": "ce504573-4841-4e45-81e2-21e8a11ba221", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Mail.IsSystemZappedMalware -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malware", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659550035493)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "0179b3f7-3fda-40c3-8f24-278563978dbb", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "b7d4272b-96c3-4514-b9bd-e4d4c051d162", - "Comment": "Emails with malware that were delivered and later removed -V1.0.0.8", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "bd13b65f-ccaf-4fd4-669b-08d90ed0cca9", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "0179b3f7-3fda-40c3-8f24-278563978dbb", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages containing malware removed after delivery", - "DistinguishedName": "CN=Email messages containing malware removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1620114419000)/", - "WhenCreated": "/Date(1554927210000)/", - "WhenChangedUTC": "/Date(1620114419000)/", - "WhenCreatedUTC": "/Date(1554927210000)/", - "ExchangeObjectId": "0179b3f7-3fda-40c3-8f24-278563978dbb", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Mail.IsSystemZappedMalware -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malware", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659550035493)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "0179b3f7-3fda-40c3-8f24-278563978dbb", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "b7d4272b-96c3-4514-b9bd-e4d4c051d162", + "Comment": "Emails with malware that were delivered and later removed -V1.0.0.8", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "bd13b65f-ccaf-4fd4-669b-08d90ed0cca9", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "0179b3f7-3fda-40c3-8f24-278563978dbb", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malware removed after delivery", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages containing malware removed after delivery", + "DistinguishedName": "CN=Email messages containing malware removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1620114419000)/", + "WhenCreated": "/Date(1554927210000)/", + "WhenChangedUTC": "/Date(1620114419000)/", + "WhenCreatedUTC": "/Date(1554927210000)/", + "ExchangeObjectId": "0179b3f7-3fda-40c3-8f24-278563978dbb", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByURLs -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malicious", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659550031883)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "435ca8f9-fb3b-4514-9bec-52fed47d84f9", - "Comment": "Emails with malicious URL that were delivered and later removed -V1.0.0.3", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "3f3a9e91-d013-4e37-4a62-08da1c767922", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages containing malicious URL removed after delivery​", - "DistinguishedName": "CN=Email messages containing malicious URL removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1649762439000)/", - "WhenCreated": "/Date(1612829713000)/", - "WhenChangedUTC": "/Date(1649762439000)/", - "WhenCreatedUTC": "/Date(1612829713000)/", - "ExchangeObjectId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByURLs -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malicious", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659550031883)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "435ca8f9-fb3b-4514-9bec-52fed47d84f9", + "Comment": "Emails with malicious URL that were delivered and later removed -V1.0.0.3", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "3f3a9e91-d013-4e37-4a62-08da1c767922", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious URL removed after delivery​", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages containing malicious URL removed after delivery​", + "DistinguishedName": "CN=Email messages containing malicious URL removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1649762439000)/", + "WhenCreated": "/Date(1612829713000)/", + "WhenChangedUTC": "/Date(1649762439000)/", + "WhenCreatedUTC": "/Date(1612829713000)/", + "ExchangeObjectId": "8e6ba277-ef39-404e-aaf1-294f6d9a2b88", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "UserRestrictedByDistributingForms" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.onmicrosoft.com" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618341750470)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "f86c81d5-272e-4825-a957-366e964f702c", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "29af60e8-9eae-4962-ba2e-a030fc6f7661", - "Comment": "Microsoft Forms identified repeated phishing attempts by a user in your tenant. This user is now blocked from sharing forms and collecting responses. -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "b0409299-daa4-491d-20f0-08d8d285b2c2", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "f86c81d5-272e-4825-a957-366e964f702c", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "User restricted from sharing forms and collecting responses", - "DistinguishedName": "CN=User restricted from sharing forms and collecting responses,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1613485094000)/", - "WhenCreated": "/Date(1613485094000)/", - "WhenChangedUTC": "/Date(1613485094000)/", - "WhenCreatedUTC": "/Date(1613485094000)/", - "ExchangeObjectId": "f86c81d5-272e-4825-a957-366e964f702c", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["UserRestrictedByDistributingForms"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618341750470)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "f86c81d5-272e-4825-a957-366e964f702c", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "29af60e8-9eae-4962-ba2e-a030fc6f7661", + "Comment": "Microsoft Forms identified repeated phishing attempts by a user in your tenant. This user is now blocked from sharing forms and collecting responses. -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "b0409299-daa4-491d-20f0-08d8d285b2c2", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "f86c81d5-272e-4825-a957-366e964f702c", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sharing forms and collecting responses", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "User restricted from sharing forms and collecting responses", + "DistinguishedName": "CN=User restricted from sharing forms and collecting responses,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1613485094000)/", + "WhenCreated": "/Date(1613485094000)/", + "WhenChangedUTC": "/Date(1613485094000)/", + "WhenCreatedUTC": "/Date(1613485094000)/", + "ExchangeObjectId": "f86c81d5-272e-4825-a957-366e964f702c", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Activity.SubmissionType -eq u0027Phishu0027) -or (Activity.SubmissionType -eq u0027Malwareu0027)", - "Operation": [ - "UserSubmission" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659550021173)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "d326019d-b122-450c-a96e-de82aaf46ab9", - "Comment": "This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "63e2710c-398f-46dd-e621-08d909846bab", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email reported by user as malware or phish", - "DistinguishedName": "CN=Email reported by user as malware or phish,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1619531859000)/", - "WhenCreated": "/Date(1554927209000)/", - "WhenChangedUTC": "/Date(1619531859000)/", - "WhenCreatedUTC": "/Date(1554927209000)/", - "ExchangeObjectId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Activity.SubmissionType -eq u0027Phishu0027) -or (Activity.SubmissionType -eq u0027Malwareu0027)", + "Operation": ["UserSubmission"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659550021173)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "d326019d-b122-450c-a96e-de82aaf46ab9", + "Comment": "This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.3", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "63e2710c-398f-46dd-e621-08d909846bab", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as malware or phish", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email reported by user as malware or phish", + "DistinguishedName": "CN=Email reported by user as malware or phish,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1619531859000)/", + "WhenCreated": "/Date(1554927209000)/", + "WhenChangedUTC": "/Date(1619531859000)/", + "WhenCreatedUTC": "/Date(1554927209000)/", + "ExchangeObjectId": "b26a5770-0c38-434a-9380-3a3c2c27bbb3", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "RetentionAutoLabelSimulationCompletion" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "404fd903-ef34-43df-8362-ac45c1bb2a1c", - "Comment": "Retention auto-labeling policy simulation has been completed. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "2ad7b104-a45f-4b35-896a-08da6efbe6cf", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Retention Auto-labeling Policy Simulation Completed", - "DistinguishedName": "CN=Retention Auto-labeling Policy Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1658835741000)/", - "WhenCreated": "/Date(1658835741000)/", - "WhenChangedUTC": "/Date(1658835741000)/", - "WhenCreatedUTC": "/Date(1658835741000)/", - "ExchangeObjectId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["RetentionAutoLabelSimulationCompletion"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "404fd903-ef34-43df-8362-ac45c1bb2a1c", + "Comment": "Retention auto-labeling policy simulation has been completed. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "2ad7b104-a45f-4b35-896a-08da6efbe6cf", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Retention Auto-labeling Policy Simulation Completed", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Retention Auto-labeling Policy Simulation Completed", + "DistinguishedName": "CN=Retention Auto-labeling Policy Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1658835741000)/", + "WhenCreated": "/Date(1658835741000)/", + "WhenChangedUTC": "/Date(1658835741000)/", + "WhenCreatedUTC": "/Date(1658835741000)/", + "ExchangeObjectId": "a8f4ff90-ee7d-4813-a629-42c9db2204dd", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.AirItemType -eq u0027Emailu0027", - "Operation": [ - "AirManualInvestigation" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360321020)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "cfb0af3a-7410-445c-a872-45f95c45f0de", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "8aa5392e-0533-4a43-9952-b25fcea4af4b", - "Comment": "This alert is triggered because an admin triggered manual investigation of an Email from explorer -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "9f5f9152-5833-4255-a2b6-08d88b0fc747", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "cfb0af3a-7410-445c-a872-45f95c45f0de", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Admin triggered manual investigation of email", - "DistinguishedName": "CN=Admin triggered manual investigation of email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1605627915000)/", - "WhenCreated": "/Date(1605627915000)/", - "WhenChangedUTC": "/Date(1605627915000)/", - "WhenCreatedUTC": "/Date(1605627915000)/", - "ExchangeObjectId": "cfb0af3a-7410-445c-a872-45f95c45f0de", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.AirItemType -eq u0027Emailu0027", + "Operation": ["AirManualInvestigation"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360321020)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "cfb0af3a-7410-445c-a872-45f95c45f0de", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "8aa5392e-0533-4a43-9952-b25fcea4af4b", + "Comment": "This alert is triggered because an admin triggered manual investigation of an Email from explorer -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "9f5f9152-5833-4255-a2b6-08d88b0fc747", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "cfb0af3a-7410-445c-a872-45f95c45f0de", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Admin triggered manual investigation of email", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Admin triggered manual investigation of email", + "DistinguishedName": "CN=Admin triggered manual investigation of email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1605627915000)/", + "WhenCreated": "/Date(1605627915000)/", + "WhenChangedUTC": "/Date(1605627915000)/", + "WhenCreatedUTC": "/Date(1605627915000)/", + "ExchangeObjectId": "cfb0af3a-7410-445c-a872-45f95c45f0de", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "eDiscoverySearchStartedOrExported" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360396727)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "f39d84d4-568b-47d2-8f6d-b4ae9d4aba97", - "Comment": "The alert is triggered when users start content searches or eDiscovery searches or when search results are downloaded or exported -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "a2b6879c-35c4-4147-7c67-08d909846d2b", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "6fdc5710-3998-47f0-afbb-57cefd7378ae", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "eDiscovery search started or exported", - "DistinguishedName": "CN=eDiscovery search started or exported,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1619531862000)/", - "WhenCreated": "/Date(1554927214000)/", - "WhenChangedUTC": "/Date(1619531862000)/", - "WhenCreatedUTC": "/Date(1554927214000)/", - "ExchangeObjectId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["eDiscoverySearchStartedOrExported"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360396727)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "f39d84d4-568b-47d2-8f6d-b4ae9d4aba97", + "Comment": "The alert is triggered when users start content searches or eDiscovery searches or when search results are downloaded or exported -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "a2b6879c-35c4-4147-7c67-08d909846d2b", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "6fdc5710-3998-47f0-afbb-57cefd7378ae", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/eDiscovery search started or exported", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "eDiscovery search started or exported", + "DistinguishedName": "CN=eDiscovery search started or exported,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1619531862000)/", + "WhenCreated": "/Date(1554927214000)/", + "WhenChangedUTC": "/Date(1619531862000)/", + "WhenCreatedUTC": "/Date(1554927214000)/", + "ExchangeObjectId": "6fdc5710-3998-47f0-afbb-57cefd7378ae", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "QuarantineRequestReleaseMessage" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "34116cef-7761-4cdf-a30b-5aa944d93d74", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "c633eeaf-090e-4dc2-ad59-770158128390", - "Comment": "A user has requested to release an email from quarantine. -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "e57d8c5b-83f6-4c92-bf85-08d9a96de94d", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "34116cef-7761-4cdf-a30b-5aa944d93d74", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "User requested to release a quarantined message", - "DistinguishedName": "CN=User requested to release a quarantined message,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1637114378000)/", - "WhenCreated": "/Date(1637114378000)/", - "WhenChangedUTC": "/Date(1637114378000)/", - "WhenCreatedUTC": "/Date(1637114378000)/", - "ExchangeObjectId": "34116cef-7761-4cdf-a30b-5aa944d93d74", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["QuarantineRequestReleaseMessage"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "34116cef-7761-4cdf-a30b-5aa944d93d74", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "c633eeaf-090e-4dc2-ad59-770158128390", + "Comment": "A user has requested to release an email from quarantine. -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "e57d8c5b-83f6-4c92-bf85-08d9a96de94d", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "34116cef-7761-4cdf-a30b-5aa944d93d74", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User requested to release a quarantined message", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "User requested to release a quarantined message", + "DistinguishedName": "CN=User requested to release a quarantined message,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1637114378000)/", + "WhenCreated": "/Date(1637114378000)/", + "WhenChangedUTC": "/Date(1637114378000)/", + "WhenCreatedUTC": "/Date(1637114378000)/", + "ExchangeObjectId": "34116cef-7761-4cdf-a30b-5aa944d93d74", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByFiles -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malicious", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659550000637)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "c056ed0c-0a2c-4c2f-989e-c32681100d63", - "Comment": "Emails with malicious file that were delivered and later removed -V1.0.0.3", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "bdbe591f-7207-4f25-9ea0-08da1c767b27", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages containing malicious file removed after delivery​", - "DistinguishedName": "CN=Email messages containing malicious file removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1649762442000)/", - "WhenCreated": "/Date(1612829714000)/", - "WhenChangedUTC": "/Date(1649762442000)/", - "WhenCreatedUTC": "/Date(1612829714000)/", - "ExchangeObjectId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.IsMailZAPSuccessful -eq 1) -and Mail.IsSystemZappedByFiles -eq 1 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malicious", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659550000637)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "c056ed0c-0a2c-4c2f-989e-c32681100d63", + "Comment": "Emails with malicious file that were delivered and later removed -V1.0.0.3", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "bdbe591f-7207-4f25-9ea0-08da1c767b27", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing malicious file removed after delivery​", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages containing malicious file removed after delivery​", + "DistinguishedName": "CN=Email messages containing malicious file removed after delivery​,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1649762442000)/", + "WhenCreated": "/Date(1612829714000)/", + "WhenChangedUTC": "/Date(1649762442000)/", + "WhenCreatedUTC": "/Date(1612829714000)/", + "ExchangeObjectId": "4b1820ec-39dc-45f3-abf6-5ee80df51fd2", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.Operation -eq u0027MSTICNationStateNotificationu0027", - "Operation": [ - "MSTICNationStateNotification" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "3942e844-78a9-4110-9f47-9f6c1e1d1c99", - "Comment": "Microsoft Threat Intelligence Center detected an attempt to compromise accounts from your tenant. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "9b5ff5c6-ff67-43a3-31ab-08d9a96de846", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Potential Nation-State Activity", - "DistinguishedName": "CN=Potential Nation-State Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1637114376000)/", - "WhenCreated": "/Date(1637114376000)/", - "WhenChangedUTC": "/Date(1637114376000)/", - "WhenCreatedUTC": "/Date(1637114376000)/", - "ExchangeObjectId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.Operation -eq u0027MSTICNationStateNotificationu0027", + "Operation": ["MSTICNationStateNotification"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "3942e844-78a9-4110-9f47-9f6c1e1d1c99", + "Comment": "Microsoft Threat Intelligence Center detected an attempt to compromise accounts from your tenant. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "9b5ff5c6-ff67-43a3-31ab-08d9a96de846", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Potential Nation-State Activity", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Potential Nation-State Activity", + "DistinguishedName": "CN=Potential Nation-State Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1637114376000)/", + "WhenCreated": "/Date(1637114376000)/", + "WhenChangedUTC": "/Date(1637114376000)/", + "WhenCreatedUTC": "/Date(1637114376000)/", + "ExchangeObjectId": "3b3085a4-553a-4b61-bbf1-691fa4e0bf76", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "EmailSendingLimitExceeded" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360467210)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "66420b7c-b772-4749-8e23-01672295fcc2", - "Comment": "User has exceeded their email sending limit and the action defined within the Outbound Spam policy has been applied. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "31f20d68-c10f-47b4-20ea-08d74b7e0175", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email sending limit exceeded", - "DistinguishedName": "CN=Email sending limit exceeded,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1570490885000)/", - "WhenCreated": "/Date(1570490885000)/", - "WhenChangedUTC": "/Date(1570490885000)/", - "WhenCreatedUTC": "/Date(1570490885000)/", - "ExchangeObjectId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["EmailSendingLimitExceeded"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360467210)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "66420b7c-b772-4749-8e23-01672295fcc2", + "Comment": "User has exceeded their email sending limit and the action defined within the Outbound Spam policy has been applied. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "31f20d68-c10f-47b4-20ea-08d74b7e0175", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email sending limit exceeded", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email sending limit exceeded", + "DistinguishedName": "CN=Email sending limit exceeded,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1570490885000)/", + "WhenCreated": "/Date(1570490885000)/", + "WhenChangedUTC": "/Date(1570490885000)/", + "WhenCreatedUTC": "/Date(1570490885000)/", + "ExchangeObjectId": "2cc44934-4d16-420b-b4e8-74a77fd0ab24", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Activity.AirAdminActionType -eq u0027MailActionu0027 -or Activity.AirAdminActionType -eq u0027BlockUrlActionu0027 -or Activity.AirAdminActionType -eq u0027BlockSenderActionu0027)", - "Operation": [ - "AirAdminActionInvestigation" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659549993130)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "39c5b427-a54f-4c38-a799-8541c5a105a8", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "bcafb035-406a-4a14-b5c3-67396c524edc", - "Comment": "This alert is triggered when an admin takes remediation action on the selected entity -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "846b7457-58a3-439c-1d0e-08d88b0fc808", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "39c5b427-a54f-4c38-a799-8541c5a105a8", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Remediation action taken by admin on emails or URL or sender", - "DistinguishedName": "CN=Remediation action taken by admin on emails or URL or sender,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1605627917000)/", - "WhenCreated": "/Date(1605627917000)/", - "WhenChangedUTC": "/Date(1605627917000)/", - "WhenCreatedUTC": "/Date(1605627917000)/", - "ExchangeObjectId": "39c5b427-a54f-4c38-a799-8541c5a105a8", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Activity.AirAdminActionType -eq u0027MailActionu0027 -or Activity.AirAdminActionType -eq u0027BlockUrlActionu0027 -or Activity.AirAdminActionType -eq u0027BlockSenderActionu0027)", + "Operation": ["AirAdminActionInvestigation"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659549993130)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "39c5b427-a54f-4c38-a799-8541c5a105a8", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "bcafb035-406a-4a14-b5c3-67396c524edc", + "Comment": "This alert is triggered when an admin takes remediation action on the selected entity -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "846b7457-58a3-439c-1d0e-08d88b0fc808", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "39c5b427-a54f-4c38-a799-8541c5a105a8", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Remediation action taken by admin on emails or URL or sender", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Remediation action taken by admin on emails or URL or sender", + "DistinguishedName": "CN=Remediation action taken by admin on emails or URL or sender,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1605627917000)/", + "WhenCreated": "/Date(1605627917000)/", + "WhenChangedUTC": "/Date(1605627917000)/", + "WhenCreatedUTC": "/Date(1605627917000)/", + "ExchangeObjectId": "39c5b427-a54f-4c38-a799-8541c5a105a8", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "MailRedirect" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "bc59a7c1-2cfd-49da-b762-f643f204babe", - "Comment": "This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "0d925ec2-9609-4c1b-cea4-08d909846c4c", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "d59a8fd4-1272-41ee-9408-86f7bcf72479", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Creation of forwarding/redirect rule", - "DistinguishedName": "CN=Creation of forwarding/redirect rule,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1619531860000)/", - "WhenCreated": "/Date(1554927211000)/", - "WhenChangedUTC": "/Date(1619531860000)/", - "WhenCreatedUTC": "/Date(1554927211000)/", - "ExchangeObjectId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["MailRedirect"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "bc59a7c1-2cfd-49da-b762-f643f204babe", + "Comment": "This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "0d925ec2-9609-4c1b-cea4-08d909846c4c", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "d59a8fd4-1272-41ee-9408-86f7bcf72479", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Creation of forwarding/redirect rule", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Creation of forwarding/redirect rule", + "DistinguishedName": "CN=Creation of forwarding/redirect rule,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1619531860000)/", + "WhenCreated": "/Date(1554927211000)/", + "WhenChangedUTC": "/Date(1619531860000)/", + "WhenCreatedUTC": "/Date(1554927211000)/", + "ExchangeObjectId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", - "Operation": [ - "CompromisedAccount" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.onmicrosoft.com" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618341798657)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "743af9b5-f679-418a-88e9-77360cd02fce", - "Comment": "User has been restricted from sending messages outside the organization due to potential compromised activity. -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "2ba121d0-5190-4209-d909-08d7b68de683", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "7a4e7306-bbcb-401f-b112-8ca5f798a230", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "User restricted from sending email", - "DistinguishedName": "CN=User restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1582262487000)/", - "WhenCreated": "/Date(1554927215000)/", - "WhenChangedUTC": "/Date(1582262487000)/", - "WhenCreatedUTC": "/Date(1554927215000)/", - "ExchangeObjectId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "-not (Activity.User.Tags -like u0027hveu0027)", + "Operation": ["CompromisedAccount"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618341798657)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "743af9b5-f679-418a-88e9-77360cd02fce", + "Comment": "User has been restricted from sending messages outside the organization due to potential compromised activity. -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "2ba121d0-5190-4209-d909-08d7b68de683", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "7a4e7306-bbcb-401f-b112-8ca5f798a230", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/User restricted from sending email", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "User restricted from sending email", + "DistinguishedName": "CN=User restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1582262487000)/", + "WhenCreated": "/Date(1554927215000)/", + "WhenChangedUTC": "/Date(1582262487000)/", + "WhenCreatedUTC": "/Date(1554927215000)/", + "ExchangeObjectId": "7a4e7306-bbcb-401f-b112-8ca5f798a230", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.EventId -eq u002712u0027", - "Operation": [ - "TenantAllowBlockListItemRemoved" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "19668d63-14b5-46f9-ab2e-382f2c949ba4", - "Comment": "A Tenant Allow/Block List entry will be removed. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "8ae64027-d367-4e6b-cd08-08db2726a5b7", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "d0d83ae6-5fbc-4400-8863-9276921a9cad", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Removed an entry in Tenant Allow/Block List", - "DistinguishedName": "CN=Removed an entry in Tenant Allow/Block List,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1679085114000)/", - "WhenCreated": "/Date(1679085114000)/", - "WhenChangedUTC": "/Date(1679085114000)/", - "WhenCreatedUTC": "/Date(1679085114000)/", - "ExchangeObjectId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.EventId -eq u002712u0027", + "Operation": ["TenantAllowBlockListItemRemoved"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "19668d63-14b5-46f9-ab2e-382f2c949ba4", + "Comment": "A Tenant Allow/Block List entry will be removed. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "8ae64027-d367-4e6b-cd08-08db2726a5b7", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "d0d83ae6-5fbc-4400-8863-9276921a9cad", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Removed an entry in Tenant Allow/Block List", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Removed an entry in Tenant Allow/Block List", + "DistinguishedName": "CN=Removed an entry in Tenant Allow/Block List,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1679085114000)/", + "WhenCreated": "/Date(1679085114000)/", + "WhenChangedUTC": "/Date(1679085114000)/", + "WhenCreatedUTC": "/Date(1679085114000)/", + "ExchangeObjectId": "d0d83ae6-5fbc-4400-8863-9276921a9cad", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.SubmissionType -eq u0027Junku0027", - "Operation": [ - "UserSubmission" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "a0e277be-7157-4907-874e-93e7b5170657", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "452dd2e4-5755-46a1-bbc4-18775737762b", - "Comment": "This alert is triggered when any email message is reported as junk by users -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "d5ff0075-b39c-408f-0a5f-08db354d4c0d", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "a0e277be-7157-4907-874e-93e7b5170657", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email reported by user as junk", - "DistinguishedName": "CN=Email reported by user as junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1680641030000)/", - "WhenCreated": "/Date(1680641030000)/", - "WhenChangedUTC": "/Date(1680641030000)/", - "WhenCreatedUTC": "/Date(1680641030000)/", - "ExchangeObjectId": "a0e277be-7157-4907-874e-93e7b5170657", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.SubmissionType -eq u0027Junku0027", + "Operation": ["UserSubmission"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "a0e277be-7157-4907-874e-93e7b5170657", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "452dd2e4-5755-46a1-bbc4-18775737762b", + "Comment": "This alert is triggered when any email message is reported as junk by users -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "d5ff0075-b39c-408f-0a5f-08db354d4c0d", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "a0e277be-7157-4907-874e-93e7b5170657", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as junk", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email reported by user as junk", + "DistinguishedName": "CN=Email reported by user as junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1680641030000)/", + "WhenCreated": "/Date(1680641030000)/", + "WhenChangedUTC": "/Date(1680641030000)/", + "WhenCreatedUTC": "/Date(1680641030000)/", + "ExchangeObjectId": "a0e277be-7157-4907-874e-93e7b5170657", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.IsMailZAPFailed -eq 1) -and ((((Mail.IsSystemZappedByFiles -eq 1) -or (Mail.IsSystemZappedByURLs -eq 1)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)) -or (((Mail.IsGenericZapped -eq 1) -or(Mail.IsCampaignZapped -eq 1)) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malicious", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "663e723a-4a74-47d9-9690-9638f0d496af", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "01fb826b-ea22-426e-b553-75fa3afd16f9", - "Comment": "Messages containing a malicious entity were delivered, and we could not remove them after delivery. Manual action is required. Please remove the malicious messages for the affected users. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "d0778db8-27f7-4d8f-3e2e-08da1c7679dc", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "663e723a-4a74-47d9-9690-9638f0d496af", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Messages containing malicious entity not removed after delivery", - "DistinguishedName": "CN=Messages containing malicious entity not removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1649762440000)/", - "WhenCreated": "/Date(1649762440000)/", - "WhenChangedUTC": "/Date(1649762440000)/", - "WhenCreatedUTC": "/Date(1649762440000)/", - "ExchangeObjectId": "663e723a-4a74-47d9-9690-9638f0d496af", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.IsMailZAPFailed -eq 1) -and ((((Mail.IsSystemZappedByFiles -eq 1) -or (Mail.IsSystemZappedByURLs -eq 1)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and (Mail.IsCampaignZapped -ne 1)) -or (((Mail.IsGenericZapped -eq 1) -or(Mail.IsCampaignZapped -eq 1)) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027PhishEduu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027SecOpsu0027) -and (Mail.TenantPolicyFinalVerdictSource -ne u0027ThirdPartyFilteringu0027)))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malicious", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "663e723a-4a74-47d9-9690-9638f0d496af", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "01fb826b-ea22-426e-b553-75fa3afd16f9", + "Comment": "Messages containing a malicious entity were delivered, and we could not remove them after delivery. Manual action is required. Please remove the malicious messages for the affected users. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "d0778db8-27f7-4d8f-3e2e-08da1c7679dc", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "663e723a-4a74-47d9-9690-9638f0d496af", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages containing malicious entity not removed after delivery", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Messages containing malicious entity not removed after delivery", + "DistinguishedName": "CN=Messages containing malicious entity not removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1649762440000)/", + "WhenCreated": "/Date(1649762440000)/", + "WhenChangedUTC": "/Date(1649762440000)/", + "WhenCreatedUTC": "/Date(1649762440000)/", + "ExchangeObjectId": "663e723a-4a74-47d9-9690-9638f0d496af", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "UnifiedSimulationCompletionNotification" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "7b99aef6-dca7-43b5-828a-96679dd553fc", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "1eb13e5b-2a40-4fca-85e7-a1a3072c04ed", - "Comment": "Simulation Horizontal policy simulation has been completed. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "7f9d151a-1148-43f5-5417-08db9f8e3469", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "7b99aef6-dca7-43b5-828a-96679dd553fc", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "SimH Simulation Completed", - "DistinguishedName": "CN=SimH Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1692323731000)/", - "WhenCreated": "/Date(1692323731000)/", - "WhenChangedUTC": "/Date(1692323731000)/", - "WhenCreatedUTC": "/Date(1692323731000)/", - "ExchangeObjectId": "7b99aef6-dca7-43b5-828a-96679dd553fc", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["UnifiedSimulationCompletionNotification"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "7b99aef6-dca7-43b5-828a-96679dd553fc", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "1eb13e5b-2a40-4fca-85e7-a1a3072c04ed", + "Comment": "Simulation Horizontal policy simulation has been completed. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "7f9d151a-1148-43f5-5417-08db9f8e3469", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "7b99aef6-dca7-43b5-828a-96679dd553fc", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/SimH Simulation Completed", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "SimH Simulation Completed", + "DistinguishedName": "CN=SimH Simulation Completed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1692323731000)/", + "WhenCreated": "/Date(1692323731000)/", + "WhenChangedUTC": "/Date(1692323731000)/", + "WhenCreatedUTC": "/Date(1692323731000)/", + "ExchangeObjectId": "7b99aef6-dca7-43b5-828a-96679dd553fc", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "ExternalFileSharing" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": [ - "Tenant" - ], - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360542547)/", - "AggregationType": "AnomalousAggregation", - "Category": "DataGovernance", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "94b6d359-065a-493d-a050-2a8c64ea1092", - "Comment": "This alert is triggered when the volume of external file sharing activities in your organization becomes unusual -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "46a87444-31c5-4676-a7a6-08d6bdf101db", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "d0ec2b5e-b51e-4b83-a232-972d3971d370", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Unusual volume of external file sharing", - "DistinguishedName": "CN=Unusual volume of external file sharing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1554927213000)/", - "WhenCreated": "/Date(1554927213000)/", - "WhenChangedUTC": "/Date(1554927213000)/", - "WhenCreatedUTC": "/Date(1554927213000)/", - "ExchangeObjectId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["ExternalFileSharing"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": ["Tenant"], + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360542547)/", + "AggregationType": "AnomalousAggregation", + "Category": "DataGovernance", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "94b6d359-065a-493d-a050-2a8c64ea1092", + "Comment": "This alert is triggered when the volume of external file sharing activities in your organization becomes unusual -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "46a87444-31c5-4676-a7a6-08d6bdf101db", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "d0ec2b5e-b51e-4b83-a232-972d3971d370", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Unusual volume of external file sharing", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Unusual volume of external file sharing", + "DistinguishedName": "CN=Unusual volume of external file sharing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1554927213000)/", + "WhenCreated": "/Date(1554927213000)/", + "WhenChangedUTC": "/Date(1554927213000)/", + "WhenCreatedUTC": "/Date(1554927213000)/", + "ExchangeObjectId": "d0ec2b5e-b51e-4b83-a232-972d3971d370", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "AutoBlockedForm" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.onmicrosoft.com" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618341910120)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "3d408d75-3093-40de-8611-9d1a273a11dc", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "a135d1a5-12e6-432d-8b01-7ea84090691e", - "Comment": "Microsoft Forms detected a potential phishing attempt from a form and blocked it from distribution and response collection. -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "4c68e64d-1cb4-41f5-5125-08d8d285b239", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "3d408d75-3093-40de-8611-9d1a273a11dc", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Form blocked due to potential phishing attempt", - "DistinguishedName": "CN=Form blocked due to potential phishing attempt,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1613485093000)/", - "WhenCreated": "/Date(1613485093000)/", - "WhenChangedUTC": "/Date(1613485093000)/", - "WhenCreatedUTC": "/Date(1613485093000)/", - "ExchangeObjectId": "3d408d75-3093-40de-8611-9d1a273a11dc", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["AutoBlockedForm"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618341910120)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "3d408d75-3093-40de-8611-9d1a273a11dc", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "a135d1a5-12e6-432d-8b01-7ea84090691e", + "Comment": "Microsoft Forms detected a potential phishing attempt from a form and blocked it from distribution and response collection. -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "4c68e64d-1cb4-41f5-5125-08d8d285b239", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "3d408d75-3093-40de-8611-9d1a273a11dc", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form blocked due to potential phishing attempt", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Form blocked due to potential phishing attempt", + "DistinguishedName": "CN=Form blocked due to potential phishing attempt,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1613485093000)/", + "WhenCreated": "/Date(1613485093000)/", + "WhenChangedUTC": "/Date(1613485093000)/", + "WhenCreatedUTC": "/Date(1613485093000)/", + "ExchangeObjectId": "3d408d75-3093-40de-8611-9d1a273a11dc", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.SubmissionType -eq u0027SecurityRisku0027", - "Operation": [ - "UserSubmission" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "661febed-80bc-46c2-a413-315d745fecaa", - "Comment": "This alert is triggered when any Teams message is reported as security risk by users -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "e4930e0c-0347-49fb-1224-08db2726a78b", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "34c03748-ee5d-415e-bb65-9fbac7d3a358", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Teams message reported by user as security risk", - "DistinguishedName": "CN=Teams message reported by user as security risk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1679085117000)/", - "WhenCreated": "/Date(1679085117000)/", - "WhenChangedUTC": "/Date(1679085117000)/", - "WhenCreatedUTC": "/Date(1679085117000)/", - "ExchangeObjectId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.SubmissionType -eq u0027SecurityRisku0027", + "Operation": ["UserSubmission"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "661febed-80bc-46c2-a413-315d745fecaa", + "Comment": "This alert is triggered when any Teams message is reported as security risk by users -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "e4930e0c-0347-49fb-1224-08db2726a78b", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "34c03748-ee5d-415e-bb65-9fbac7d3a358", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Teams message reported by user as security risk", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Teams message reported by user as security risk", + "DistinguishedName": "CN=Teams message reported by user as security risk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1679085117000)/", + "WhenCreated": "/Date(1679085117000)/", + "WhenChangedUTC": "/Date(1679085117000)/", + "WhenCreatedUTC": "/Date(1679085117000)/", + "ExchangeObjectId": "34c03748-ee5d-415e-bb65-9fbac7d3a358", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ETRu0027 -or Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Phish", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360572847)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "ce633f0a-0361-46b7-bbb0-5452f5669eec", - "Comment": "This alert fires when message containing phish was delivered due to an ETR override. -V1.0.0.5", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "51f32097-ce41-4c33-b1cb-08db52c776a6", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Phish delivered due to an ETR override", - "DistinguishedName": "CN=Phish delivered due to an ETR override,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1683882084000)/", - "WhenCreated": "/Date(1683882084000)/", - "WhenChangedUTC": "/Date(1683882084000)/", - "WhenCreatedUTC": "/Date(1683882084000)/", - "ExchangeObjectId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ETRu0027 -or Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Phish", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360572847)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "ce633f0a-0361-46b7-bbb0-5452f5669eec", + "Comment": "This alert fires when message containing phish was delivered due to an ETR override. -V1.0.0.5", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "51f32097-ce41-4c33-b1cb-08db52c776a6", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an ETR override", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Phish delivered due to an ETR override", + "DistinguishedName": "CN=Phish delivered due to an ETR override,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1683882084000)/", + "WhenCreated": "/Date(1683882084000)/", + "WhenChangedUTC": "/Date(1683882084000)/", + "WhenCreatedUTC": "/Date(1683882084000)/", + "ExchangeObjectId": "ce5b94b7-eafb-4b3f-8d44-a0a86245e62b", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Malware", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659550158373)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "2dc8e550-89dc-4e6b-9a0d-9d7135aa9452", - "Comment": "This alert fires when message containing malware was not zapped because ZAP is disabled. -V1.0.0.6", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "973b64cd-8165-4c8c-59ba-08da84ea1d2a", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Malware not zapped because ZAP is disabled", - "DistinguishedName": "CN=Malware not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1661247027000)/", - "WhenCreated": "/Date(1661247027000)/", - "WhenChangedUTC": "/Date(1661247027000)/", - "WhenCreatedUTC": "/Date(1661247027000)/", - "ExchangeObjectId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027 -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Malware", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659550158373)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "2dc8e550-89dc-4e6b-9a0d-9d7135aa9452", + "Comment": "This alert fires when message containing malware was not zapped because ZAP is disabled. -V1.0.0.6", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "973b64cd-8165-4c8c-59ba-08da84ea1d2a", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Malware not zapped because ZAP is disabled", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Malware not zapped because ZAP is disabled", + "DistinguishedName": "CN=Malware not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1661247027000)/", + "WhenCreated": "/Date(1661247027000)/", + "WhenChangedUTC": "/Date(1661247027000)/", + "WhenCreatedUTC": "/Date(1661247027000)/", + "ExchangeObjectId": "a5c402b2-eba9-4f9d-a0dd-a0c65db97200", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "SuspiciousForwarding" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360602643)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "bfd48f06-0865-41a6-85ff-adb746423ebf", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "1aa1676e-04c0-4b5e-bd0c-bf21c3a44971", - "Comment": "This alert is triggered once suspicious email forwarding is detected. -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "168fa645-e76c-41d5-1e2f-08d909846ed2", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "bfd48f06-0865-41a6-85ff-adb746423ebf", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Suspicious Email Forwarding Activity", - "DistinguishedName": "CN=Suspicious Email Forwarding Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1619531864000)/", - "WhenCreated": "/Date(1602615783000)/", - "WhenChangedUTC": "/Date(1619531864000)/", - "WhenCreatedUTC": "/Date(1602615783000)/", - "ExchangeObjectId": "bfd48f06-0865-41a6-85ff-adb746423ebf", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["SuspiciousForwarding"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360602643)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "bfd48f06-0865-41a6-85ff-adb746423ebf", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "1aa1676e-04c0-4b5e-bd0c-bf21c3a44971", + "Comment": "This alert is triggered once suspicious email forwarding is detected. -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "168fa645-e76c-41d5-1e2f-08d909846ed2", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "bfd48f06-0865-41a6-85ff-adb746423ebf", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious Email Forwarding Activity", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Suspicious Email Forwarding Activity", + "DistinguishedName": "CN=Suspicious Email Forwarding Activity,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1619531864000)/", + "WhenCreated": "/Date(1602615783000)/", + "WhenChangedUTC": "/Date(1619531864000)/", + "WhenCreatedUTC": "/Date(1602615783000)/", + "ExchangeObjectId": "bfd48f06-0865-41a6-85ff-adb746423ebf", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Mail.IsSystemZappedPhish -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Phish", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1659549976010)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "ea8169fa-0678-4751-8854-aebea7adeceb", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "6df73299-4af9-4173-97ff-800926831e09", - "Comment": "Emails with phish URLs that were delivered and later removed -V1.0.0.8", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "bf7b7b1f-b824-432a-1c94-08d90ed0cae4", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "ea8169fa-0678-4751-8854-aebea7adeceb", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email messages containing phish URLs removed after delivery", - "DistinguishedName": "CN=Email messages containing phish URLs removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1620114416000)/", - "WhenCreated": "/Date(1554927211000)/", - "WhenChangedUTC": "/Date(1620114416000)/", - "WhenCreatedUTC": "/Date(1554927211000)/", - "ExchangeObjectId": "ea8169fa-0678-4751-8854-aebea7adeceb", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Mail.IsSystemZappedPhish -eq 1 -and (-not (Mail.Recipients.Tags -like u0027hveu0027)) -and (-not (Mail.Sender.Tags -like u0027hveu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027)) -and ((Mail.IsGenericZapped -ne 1) -and (Mail.IsGenericZapped -ne 0)) -and ((Mail.IsCampaignZapped -ne 1) -and (Mail.IsCampaignZapped -ne 0))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Phish", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1659549976010)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "ea8169fa-0678-4751-8854-aebea7adeceb", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "6df73299-4af9-4173-97ff-800926831e09", + "Comment": "Emails with phish URLs that were delivered and later removed -V1.0.0.8", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "bf7b7b1f-b824-432a-1c94-08d90ed0cae4", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "ea8169fa-0678-4751-8854-aebea7adeceb", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email messages containing phish URLs removed after delivery", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email messages containing phish URLs removed after delivery", + "DistinguishedName": "CN=Email messages containing phish URLs removed after delivery,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1620114416000)/", + "WhenCreated": "/Date(1554927211000)/", + "WhenChangedUTC": "/Date(1620114416000)/", + "WhenCreatedUTC": "/Date(1554927211000)/", + "ExchangeObjectId": "ea8169fa-0678-4751-8854-aebea7adeceb", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "MessagesQueued.QueuedType -eq u0027ConnectorBasedMessagesQueuedu0027", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@cacilabs.net" - ], - "Severity": "High", - "Threshold": 2000, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "None", - "ThreatType": "MailFlow", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "MailFlow", - "Scenario": "MailFlowProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360686427)/", - "AggregationType": "CustomAggregation", - "Category": "MailFlow", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "ba52bbe8-d298-494f-893f-b1e9a4c18b86", - "Comment": "When Office 365 canu0027t deliver a message to your on-premises or partner servers via a connector, the message is queued in Office 365. This alert is triggered when the number of queued messages exceeds the policy threshold and have been queued for more than an hour. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "0ffd792e-cb1d-4ae7-6444-08d6bdf1012f", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "37a4e852-e711-45ca-b0f4-b076bae3adfd", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Messages have been delayed", - "DistinguishedName": "CN=Messages have been delayed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1554927212000)/", - "WhenCreated": "/Date(1554927212000)/", - "WhenChangedUTC": "/Date(1554927212000)/", - "WhenCreatedUTC": "/Date(1554927212000)/", - "ExchangeObjectId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "MessagesQueued.QueuedType -eq u0027ConnectorBasedMessagesQueuedu0027", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@cacilabs.net"], + "Severity": "High", + "Threshold": 2000, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "None", + "ThreatType": "MailFlow", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "MailFlow", + "Scenario": "MailFlowProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360686427)/", + "AggregationType": "CustomAggregation", + "Category": "MailFlow", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "ba52bbe8-d298-494f-893f-b1e9a4c18b86", + "Comment": "When Office 365 canu0027t deliver a message to your on-premises or partner servers via a connector, the message is queued in Office 365. This alert is triggered when the number of queued messages exceeds the policy threshold and have been queued for more than an hour. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "0ffd792e-cb1d-4ae7-6444-08d6bdf1012f", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "37a4e852-e711-45ca-b0f4-b076bae3adfd", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Messages have been delayed", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Messages have been delayed", + "DistinguishedName": "CN=Messages have been delayed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1554927212000)/", + "WhenCreated": "/Date(1554927212000)/", + "WhenChangedUTC": "/Date(1554927212000)/", + "WhenCreatedUTC": "/Date(1554927212000)/", + "ExchangeObjectId": "37a4e852-e711-45ca-b0f4-b076bae3adfd", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "ComplianceManagerActionScoreChange" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": 60, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ComplianceManager", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "c96a4b5c-8274-4f09-9d6f-badfa5744011", - "Comment": "This default policy will generate an alert for events that happen within 60 minutes of alert creation -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "3a773fda-8402-4264-5a78-08da4de2a787", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Compliance Manager Default Alert Policy", - "DistinguishedName": "CN=Compliance Manager Default Alert Policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1655196509000)/", - "WhenCreated": "/Date(1655196509000)/", - "WhenChangedUTC": "/Date(1655196509000)/", - "WhenCreatedUTC": "/Date(1655196509000)/", - "ExchangeObjectId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["ComplianceManagerActionScoreChange"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": 60, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ComplianceManager", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "c96a4b5c-8274-4f09-9d6f-badfa5744011", + "Comment": "This default policy will generate an alert for events that happen within 60 minutes of alert creation -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "3a773fda-8402-4264-5a78-08da4de2a787", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Compliance Manager Default Alert Policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Compliance Manager Default Alert Policy", + "DistinguishedName": "CN=Compliance Manager Default Alert Policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1655196509000)/", + "WhenCreated": "/Date(1655196509000)/", + "WhenChangedUTC": "/Date(1655196509000)/", + "WhenCreatedUTC": "/Date(1655196509000)/", + "ExchangeObjectId": "ed5f5244-a3e4-4bf7-895c-b49ef27ded46", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "CompromisedUnprovisionedTenantAccount" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360702013)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "50e7139b-1e4f-43ed-90e3-ce2e4fc5a2cf", - "Comment": "The majority of traffic related to unprovisioned domains from this tenant has been detected as suspicious and the tenant has been restricted from sending email with unregistered domains. Investigate any potentially compromised user/admins, new connectors, or open relays and contact support to unblock your tenant. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "56aa9a70-8ff4-4d79-0afa-08d77d1227cb", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Tenant restricted from sending unprovisioned email", - "DistinguishedName": "CN=Tenant restricted from sending unprovisioned email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1575942122000)/", - "WhenCreated": "/Date(1575942122000)/", - "WhenChangedUTC": "/Date(1575942122000)/", - "WhenCreatedUTC": "/Date(1575942122000)/", - "ExchangeObjectId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["CompromisedUnprovisionedTenantAccount"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360702013)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "50e7139b-1e4f-43ed-90e3-ce2e4fc5a2cf", + "Comment": "The majority of traffic related to unprovisioned domains from this tenant has been detected as suspicious and the tenant has been restricted from sending email with unregistered domains. Investigate any potentially compromised user/admins, new connectors, or open relays and contact support to unblock your tenant. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "56aa9a70-8ff4-4d79-0afa-08d77d1227cb", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending unprovisioned email", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Tenant restricted from sending unprovisioned email", + "DistinguishedName": "CN=Tenant restricted from sending unprovisioned email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1575942122000)/", + "WhenCreated": "/Date(1575942122000)/", + "WhenChangedUTC": "/Date(1575942122000)/", + "WhenCreatedUTC": "/Date(1575942122000)/", + "ExchangeObjectId": "5ed2d687-9bd3-49e7-9b56-b7dc0d9af5cb", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "CompromisedTenantAccount" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.onmicrosoft.com" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618341961437)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "a7032ff5-7eee-412b-805b-d1295c7e0932", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "e16d6517-4230-46e3-9514-4adf9c162d98", - "Comment": "The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending ability for the tenant. Ensure that any compromises or open relays have been resolved, and then contact support through your regular channel. -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "89dbe751-2576-4aee-2501-08d77d12288d", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "a7032ff5-7eee-412b-805b-d1295c7e0932", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Tenant restricted from sending email", - "DistinguishedName": "CN=Tenant restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1575942123000)/", - "WhenCreated": "/Date(1561476913000)/", - "WhenChangedUTC": "/Date(1575942123000)/", - "WhenCreatedUTC": "/Date(1561476913000)/", - "ExchangeObjectId": "a7032ff5-7eee-412b-805b-d1295c7e0932", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["CompromisedTenantAccount"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.onmicrosoft.com"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618341961437)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "a7032ff5-7eee-412b-805b-d1295c7e0932", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "e16d6517-4230-46e3-9514-4adf9c162d98", + "Comment": "The majority of traffic from this tenant has been detected as suspicious and has resulted in a ban on sending ability for the tenant. Ensure that any compromises or open relays have been resolved, and then contact support through your regular channel. -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "89dbe751-2576-4aee-2501-08d77d12288d", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "a7032ff5-7eee-412b-805b-d1295c7e0932", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant restricted from sending email", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Tenant restricted from sending email", + "DistinguishedName": "CN=Tenant restricted from sending email,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1575942123000)/", + "WhenCreated": "/Date(1561476913000)/", + "WhenChangedUTC": "/Date(1575942123000)/", + "WhenCreatedUTC": "/Date(1561476913000)/", + "ExchangeObjectId": "a7032ff5-7eee-412b-805b-d1295c7e0932", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "TenantAllowBlockListItemGraderDisagree" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "5ba37278-d17b-4674-bde7-d19ad231e324", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "00341b6e-c377-4f92-9fcb-57808f9bc1c2", - "Comment": "A Tenant Allow/Block List entry has been found malicious by grader. We recommend you remove the allow entry from the Tenant Allow/Block List. -V1.0.0.1", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "101ef390-a5cf-4d88-cef1-08db3668d570", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "5ba37278-d17b-4674-bde7-d19ad231e324", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "A Tenant Allow Block List entry has been found malicious", - "DistinguishedName": "CN=A Tenant Allow Block List entry has been found malicious,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1680762808000)/", - "WhenCreated": "/Date(1680762808000)/", - "WhenChangedUTC": "/Date(1680762808000)/", - "WhenCreatedUTC": "/Date(1680762808000)/", - "ExchangeObjectId": "5ba37278-d17b-4674-bde7-d19ad231e324", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["TenantAllowBlockListItemGraderDisagree"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "5ba37278-d17b-4674-bde7-d19ad231e324", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "00341b6e-c377-4f92-9fcb-57808f9bc1c2", + "Comment": "A Tenant Allow/Block List entry has been found malicious by grader. We recommend you remove the allow entry from the Tenant Allow/Block List. -V1.0.0.1", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "101ef390-a5cf-4d88-cef1-08db3668d570", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "5ba37278-d17b-4674-bde7-d19ad231e324", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A Tenant Allow Block List entry has been found malicious", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "A Tenant Allow Block List entry has been found malicious", + "DistinguishedName": "CN=A Tenant Allow Block List entry has been found malicious,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1680762808000)/", + "WhenCreated": "/Date(1680762808000)/", + "WhenChangedUTC": "/Date(1680762808000)/", + "WhenCreatedUTC": "/Date(1680762808000)/", + "ExchangeObjectId": "5ba37278-d17b-4674-bde7-d19ad231e324", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "Activity.SubmissionType -eq u0027NotJunku0027", - "Operation": [ - "UserSubmission" - ], - "LogicalOperationName": null, - "NotificationEnabled": false, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Low", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "8d510111-35c2-49df-9589-d582b05d7312", - "Comment": "This alert is triggered when any email message is reported as not junk by users -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "1fb1dac9-9db3-4384-1b23-08db354d4af6", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "79b0a077-8446-4d8c-b335-d89cdcd60b08", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Email reported by user as not junk", - "DistinguishedName": "CN=Email reported by user as not junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1680641029000)/", - "WhenCreated": "/Date(1680641029000)/", - "WhenChangedUTC": "/Date(1680641029000)/", - "WhenCreatedUTC": "/Date(1680641029000)/", - "ExchangeObjectId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "Activity.SubmissionType -eq u0027NotJunku0027", + "Operation": ["UserSubmission"], + "LogicalOperationName": null, + "NotificationEnabled": false, + "NotifyUser": ["TenantAdmins"], + "Severity": "Low", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "8d510111-35c2-49df-9589-d582b05d7312", + "Comment": "This alert is triggered when any email message is reported as not junk by users -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "1fb1dac9-9db3-4384-1b23-08db354d4af6", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "79b0a077-8446-4d8c-b335-d89cdcd60b08", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Email reported by user as not junk", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Email reported by user as not junk", + "DistinguishedName": "CN=Email reported by user as not junk,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1680641029000)/", + "WhenCreated": "/Date(1680641029000)/", + "WhenChangedUTC": "/Date(1680641029000)/", + "WhenCreatedUTC": "/Date(1680641029000)/", + "ExchangeObjectId": "79b0a077-8446-4d8c-b335-d89cdcd60b08", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ConnPolicyu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Phish", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360742317)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "cab1e16d-c018-40aa-9bcd-0f507e952fb5", - "Comment": "This alert fires when message containing phish was delivered due to an IP allow policy. -V1.0.0.4", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "bdf55924-0f02-4fb5-beea-08db52c774a3", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "8bd89c8d-1425-45ba-838a-e15fb89808d2", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Phish delivered due to an IP allow policy", - "DistinguishedName": "CN=Phish delivered due to an IP allow policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1683882081000)/", - "WhenCreated": "/Date(1683882081000)/", - "WhenChangedUTC": "/Date(1683882081000)/", - "WhenCreatedUTC": "/Date(1683882081000)/", - "ExchangeObjectId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.DeliveryStatus -eq u0027Deliveredu0027) -and (Mail.Direction -eq u0027Inboundu0027 -or Mail.AntispamDirection -eq u0027ToInternalRecipientu0027) -and (Mail.IsOriginalDelivery -eq 1) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (Mail.FinalVerdictSource -eq u0027Tenantu0027) -and (Mail.TenantPolicyFinalVerdict -eq u0027Allowu0027) -and (Mail.TenantPolicyFinalVerdictSource -eq u0027ConnPolicyu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Phish", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360742317)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "cab1e16d-c018-40aa-9bcd-0f507e952fb5", + "Comment": "This alert fires when message containing phish was delivered due to an IP allow policy. -V1.0.0.4", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "bdf55924-0f02-4fb5-beea-08db52c774a3", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "8bd89c8d-1425-45ba-838a-e15fb89808d2", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish delivered due to an IP allow policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Phish delivered due to an IP allow policy", + "DistinguishedName": "CN=Phish delivered due to an IP allow policy,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1683882081000)/", + "WhenCreated": "/Date(1683882081000)/", + "WhenChangedUTC": "/Date(1683882081000)/", + "WhenCreatedUTC": "/Date(1683882081000)/", + "ExchangeObjectId": "8bd89c8d-1425-45ba-838a-e15fb89808d2", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "cloudsecurity@agency.net" - ], - "Severity": "Medium", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Mail", - "ThreatType": "Phish", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Protection", - "Scenario": "ProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": "/Date(1618360763477)/", - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "4cfaefb2-b4bd-4306-becb-141044e80cd5", - "Comment": "This alert fires when message containing phish was not zapped because ZAP is disabled -V1.0.0.4", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "1b714863-ceae-4e25-7fda-08da84ea1e7a", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "c2a1f0cd-a669-49bc-a22b-e501350935e3", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Phish not zapped because ZAP is disabled", - "DistinguishedName": "CN=Phish not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1661247029000)/", - "WhenCreated": "/Date(1661247029000)/", - "WhenChangedUTC": "/Date(1661247029000)/", - "WhenCreatedUTC": "/Date(1661247029000)/", - "ExchangeObjectId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Mail.TimeTravelResult -eq u0027AdminPolicy_ZapDisabledu0027) -and (Mail.PhishConfidence -eq u0027Highu0027) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027PhishEduu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027SecOpsu0027)) -and (-not (Mail.TenantPolicyFinalVerdictSource -eq u0027ThirdPartyFilteringu0027))", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["cloudsecurity@agency.net"], + "Severity": "Medium", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Mail", + "ThreatType": "Phish", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Protection", + "Scenario": "ProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": "/Date(1618360763477)/", + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "4cfaefb2-b4bd-4306-becb-141044e80cd5", + "Comment": "This alert fires when message containing phish was not zapped because ZAP is disabled -V1.0.0.4", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "1b714863-ceae-4e25-7fda-08da84ea1e7a", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "c2a1f0cd-a669-49bc-a22b-e501350935e3", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Phish not zapped because ZAP is disabled", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Phish not zapped because ZAP is disabled", + "DistinguishedName": "CN=Phish not zapped because ZAP is disabled,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1661247029000)/", + "WhenCreated": "/Date(1661247029000)/", + "WhenChangedUTC": "/Date(1661247029000)/", + "WhenCreatedUTC": "/Date(1661247029000)/", + "ExchangeObjectId": "c2a1f0cd-a669-49bc-a22b-e501350935e3", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "UploadDataFailed" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "cafdbfad-0084-4052-8371-ea098aab3f64", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "fe23dc56-038d-483c-a528-64d9d4ff6d34", - "Comment": "New sensitive information failed to upload. Try again later. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "5dbae4ff-5372-42f4-ce34-08d8d285b158", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "cafdbfad-0084-4052-8371-ea098aab3f64", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Failed exact data match upload", - "DistinguishedName": "CN=Failed exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1613485092000)/", - "WhenCreated": "/Date(1613485092000)/", - "WhenChangedUTC": "/Date(1613485092000)/", - "WhenCreatedUTC": "/Date(1613485092000)/", - "ExchangeObjectId": "cafdbfad-0084-4052-8371-ea098aab3f64", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["UploadDataFailed"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "cafdbfad-0084-4052-8371-ea098aab3f64", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "fe23dc56-038d-483c-a528-64d9d4ff6d34", + "Comment": "New sensitive information failed to upload. Try again later. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "5dbae4ff-5372-42f4-ce34-08d8d285b158", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "cafdbfad-0084-4052-8371-ea098aab3f64", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Failed exact data match upload", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Failed exact data match upload", + "DistinguishedName": "CN=Failed exact data match upload,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1613485092000)/", + "WhenCreated": "/Date(1613485092000)/", + "WhenChangedUTC": "/Date(1613485092000)/", + "WhenCreatedUTC": "/Date(1613485092000)/", + "ExchangeObjectId": "cafdbfad-0084-4052-8371-ea098aab3f64", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "OSTTakenDownForm" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "2d161684-8def-403c-9df6-f20c66c64161", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "6f6b38f4-718f-496e-8c4c-211509eb9eb4", - "Comment": "A form created in Microsoft Forms from within your organization has been identified as phishing through Report Abuse and confirmed as phishing. -V1.0.0.2", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "349611dd-92fb-4c99-8650-08d8d285b310", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "2d161684-8def-403c-9df6-f20c66c64161", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Form flagged and confirmed as phishing", - "DistinguishedName": "CN=Form flagged and confirmed as phishing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1613485094000)/", - "WhenCreated": "/Date(1613485094000)/", - "WhenChangedUTC": "/Date(1613485094000)/", - "WhenCreatedUTC": "/Date(1613485094000)/", - "ExchangeObjectId": "2d161684-8def-403c-9df6-f20c66c64161", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["OSTTakenDownForm"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "2d161684-8def-403c-9df6-f20c66c64161", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "6f6b38f4-718f-496e-8c4c-211509eb9eb4", + "Comment": "A form created in Microsoft Forms from within your organization has been identified as phishing through Report Abuse and confirmed as phishing. -V1.0.0.2", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "349611dd-92fb-4c99-8650-08d8d285b310", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "2d161684-8def-403c-9df6-f20c66c64161", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Form flagged and confirmed as phishing", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Form flagged and confirmed as phishing", + "DistinguishedName": "CN=Form flagged and confirmed as phishing,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1613485094000)/", + "WhenCreated": "/Date(1613485094000)/", + "WhenChangedUTC": "/Date(1613485094000)/", + "WhenCreatedUTC": "/Date(1613485094000)/", + "ExchangeObjectId": "2d161684-8def-403c-9df6-f20c66c64161", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "TenantAllowBlockListItemExpiry" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "Informational", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "d063f1c3-572d-40ea-a32c-f339cab57a33", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "b50db3b4-fb66-4950-a7c0-389dd7d5b09d", - "Comment": "A Tenant Allow/Block List entry will be removed due to expiration. -V1.0.0.0", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "9b245f7b-cb18-400a-2722-08d98900fc0a", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "d063f1c3-572d-40ea-a32c-f339cab57a33", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Tenant Allow/Block List entry is about to expire", - "DistinguishedName": "CN=Tenant Allow/Block List entry is about to expire,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1633549157000)/", - "WhenCreated": "/Date(1633549157000)/", - "WhenChangedUTC": "/Date(1633549157000)/", - "WhenCreatedUTC": "/Date(1633549157000)/", - "ExchangeObjectId": "d063f1c3-572d-40ea-a32c-f339cab57a33", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["TenantAllowBlockListItemExpiry"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "Informational", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "d063f1c3-572d-40ea-a32c-f339cab57a33", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "b50db3b4-fb66-4950-a7c0-389dd7d5b09d", + "Comment": "A Tenant Allow/Block List entry will be removed due to expiration. -V1.0.0.0", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "9b245f7b-cb18-400a-2722-08d98900fc0a", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "d063f1c3-572d-40ea-a32c-f339cab57a33", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Tenant Allow/Block List entry is about to expire", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Tenant Allow/Block List entry is about to expire", + "DistinguishedName": "CN=Tenant Allow/Block List entry is about to expire,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1633549157000)/", + "WhenCreated": "/Date(1633549157000)/", + "WhenChangedUTC": "/Date(1633549157000)/", + "WhenCreatedUTC": "/Date(1633549157000)/", + "ExchangeObjectId": "d063f1c3-572d-40ea-a32c-f339cab57a33", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": null, - "Operation": [ - "TenantExceedsThresholdEarlyAlert" - ], - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "Activity", - "ThreatType": "Activity", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "Activity", - "Scenario": "AuditProtectionAlert", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "9e6a79f3-b756-47a6-9a6c-3f82cce2a4f5", - "Comment": "Suspicious sending patterns have been observed in your tenant, which may lead to your tenant being blocked from sending emails. Investigate any potentially compromised user and admin accounts, new connectors, or open relays to avoid tenant exceed threshold blocks. -V1.0.0.5", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "bf127ae6-a71d-46fa-8a31-08da9019a851", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Suspicious tenant sending patterns observed", - "DistinguishedName": "CN=Suspicious tenant sending patterns observed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1662476909000)/", - "WhenCreated": "/Date(1662476909000)/", - "WhenChangedUTC": "/Date(1662476909000)/", - "WhenCreatedUTC": "/Date(1662476909000)/", - "ExchangeObjectId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": null, + "Operation": ["TenantExceedsThresholdEarlyAlert"], + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "Activity", + "ThreatType": "Activity", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "Activity", + "Scenario": "AuditProtectionAlert", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "9e6a79f3-b756-47a6-9a6c-3f82cce2a4f5", + "Comment": "Suspicious sending patterns have been observed in your tenant, which may lead to your tenant being blocked from sending emails. Investigate any potentially compromised user and admin accounts, new connectors, or open relays to avoid tenant exceed threshold blocks. -V1.0.0.5", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "bf127ae6-a71d-46fa-8a31-08da9019a851", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/Suspicious tenant sending patterns observed", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Suspicious tenant sending patterns observed", + "DistinguishedName": "CN=Suspicious tenant sending patterns observed,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1662476909000)/", + "WhenCreated": "/Date(1662476909000)/", + "WhenChangedUTC": "/Date(1662476909000)/", + "WhenCreatedUTC": "/Date(1662476909000)/", + "ExchangeObjectId": "05b9e850-6d9d-4bab-a5c0-f54db2e7e887", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" }, { - "Filter": "(Click.IsLookBack -eq 1)", - "Operation": null, - "LogicalOperationName": null, - "NotificationEnabled": true, - "NotifyUser": [ - "TenantAdmins" - ], - "Severity": "High", - "Threshold": null, - "VolumeThreshold": null, - "ExternalScenarioData": null, - "TimeWindow": null, - "NotifyUserOnFilterMatch": false, - "MergedRuleXml": null, - "StreamType": "None", - "ThreatType": "MaliciousUrlClick", - "PrivacyManagementScopedSensitiveInformationTypes": null, - "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, - "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, - "AlertBy": null, - "AlertFor": null, - "AlertScenario": "MaliciousUrlClick", - "Scenario": "MaliciousUrlClick", - "NotifyUserThrottleThreshold": null, - "NotifyUserThrottleWindow": null, - "NotifyUserSuppressionExpiryDate": null, - "NotificationCulture": null, - "AlertOverrideChangedUtc": null, - "AggregationType": "None", - "Category": "ThreatManagement", - "IsSystemRule": true, - "TagFilter": null, - "UserTags": null, - "RecipientTags": null, - "SenderTags": null, - "CustomProperties": null, - "UseCreatedDateTime": null, - "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", - "ReadOnly": false, - "ErrorMetadata": null, - "ExternalIdentity": "", - "ImmutableId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", - "Priority": 0, - "Workload": "AuditAlerting", - "Policy": "e9a4983d-9f4e-47b0-80d1-fb2097adb484", - "Comment": "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5", - "Disabled": false, - "Mode": "Enforce", - "ObjectVersion": "93862b30-0045-4564-44b2-08da42ee4857", - "MaximumBlobRuleLength": 0, - "CreatedBy": "", - "LastModifiedBy": "", - "Guid": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", - "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", - "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "A potentially malicious URL click was detected", - "DistinguishedName": "CN=A potentially malicious URL click was detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", - "ObjectCategory": null, - "ObjectClass": [ - "msExchUnifiedRule" - ], - "WhenChanged": "/Date(1653992040000)/", - "WhenCreated": "/Date(1554927215000)/", - "WhenChangedUTC": "/Date(1653992040000)/", - "WhenCreatedUTC": "/Date(1554927215000)/", - "ExchangeObjectId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", - "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", - "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", - "OriginatingServer": "", - "ObjectState": "New" + "Filter": "(Click.IsLookBack -eq 1)", + "Operation": null, + "LogicalOperationName": null, + "NotificationEnabled": true, + "NotifyUser": ["TenantAdmins"], + "Severity": "High", + "Threshold": null, + "VolumeThreshold": null, + "ExternalScenarioData": null, + "TimeWindow": null, + "NotifyUserOnFilterMatch": false, + "MergedRuleXml": null, + "StreamType": "None", + "ThreatType": "MaliciousUrlClick", + "PrivacyManagementScopedSensitiveInformationTypes": null, + "PrivacyManagementScopedSensitiveInformationTypesForCounting": null, + "PrivacyManagementScopedSensitiveInformationTypesThreshold": null, + "AlertBy": null, + "AlertFor": null, + "AlertScenario": "MaliciousUrlClick", + "Scenario": "MaliciousUrlClick", + "NotifyUserThrottleThreshold": null, + "NotifyUserThrottleWindow": null, + "NotifyUserSuppressionExpiryDate": null, + "NotificationCulture": null, + "AlertOverrideChangedUtc": null, + "AggregationType": "None", + "Category": "ThreatManagement", + "IsSystemRule": true, + "TagFilter": null, + "UserTags": null, + "RecipientTags": null, + "SenderTags": null, + "CustomProperties": null, + "UseCreatedDateTime": null, + "CorrelationPolicyId": "00000000-0000-0000-0000-000000000000", + "ReadOnly": false, + "ErrorMetadata": null, + "ExternalIdentity": "", + "ImmutableId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", + "Priority": 0, + "Workload": "AuditAlerting", + "Policy": "e9a4983d-9f4e-47b0-80d1-fb2097adb484", + "Comment": "We have detected that one of your users has recently clicked on a link that was found to be malicious. -V1.0.0.5", + "Disabled": false, + "Mode": "Enforce", + "ObjectVersion": "93862b30-0045-4564-44b2-08da42ee4857", + "MaximumBlobRuleLength": 0, + "CreatedBy": "", + "LastModifiedBy": "", + "Guid": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", + "Identity": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", + "Id": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration/A potentially malicious URL click was detected", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "A potentially malicious URL click was detected", + "DistinguishedName": "CN=A potentially malicious URL click was detected,CN=Configuration,CN=f00ed340-8f84-4eb4-83f3-0075a22b262e,OU=Microsoft Exchange Hosted Organizations,DC=FFO,DC=extest,DC=microsoft,DC=com", + "ObjectCategory": null, + "ObjectClass": ["msExchUnifiedRule"], + "WhenChanged": "/Date(1653992040000)/", + "WhenCreated": "/Date(1554927215000)/", + "WhenChangedUTC": "/Date(1653992040000)/", + "WhenCreatedUTC": "/Date(1554927215000)/", + "ExchangeObjectId": "a74bb32a-541b-47fb-adfd-f8c62ce3d59b", + "OrganizationalUnitRoot": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e", + "OrganizationId": "FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e - FFO.extest.microsoft.com/Microsoft Exchange Hosted Organizations/f00ed340-8f84-4eb4-83f3-0075a22b262e/Configuration", + "OriginatingServer": "", + "ObjectState": "New" } -], - "admin_audit_log_config": [ + ], + "admin_audit_log_config": [ { - "AdminAuditLogEnabled": true, - "LogLevel": "None", - "TestCmdletLoggingEnabled": false, - "AdminAuditLogCmdlets": [ - "*" - ], - "AdminAuditLogParameters": [ - "*" - ], - "AdminAuditLogExcludedCmdlets": [ - - ], - "AdminAuditLogAgeLimit": "90.00:00:00", - "LoadBalancerCount": 3, - "RefreshInterval": 10, - "PartitionInfo": [ - - ], - "AdminAuditLogMailbox": "", - "UnifiedAuditLogIngestionEnabled": true, - "UnifiedAuditLogFirstOptInDate": "/Date(1618327011162)/", - "AdminDisplayName": "", - "ExchangeVersion": "0.10 (14.0.100.0)", - "Name": "Admin Audit Log Settings", - "DistinguishedName": "CN=Admin Audit Log Settings,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "Admin Audit Log Settings", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Admin-Audit-Log-Config", - "ObjectClass": [ - "top", - "msExchAdminAuditLogConfig" - ], - "WhenChanged": "/Date(1619484611000)/", - "WhenCreated": "/Date(1619484594000)/", - "WhenChangedUTC": "/Date(1619484611000)/", - "WhenCreatedUTC": "/Date(1619484594000)/", - "ExchangeObjectId": "35b89a9b-b235-4d67-ba7f-7ddeab032801", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "Admin Audit Log Settings", - "Guid": "97423bd9-ae36-4a1f-a225-5e007478854f", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Changed" + "AdminAuditLogEnabled": true, + "LogLevel": "None", + "TestCmdletLoggingEnabled": false, + "AdminAuditLogCmdlets": ["*"], + "AdminAuditLogParameters": ["*"], + "AdminAuditLogExcludedCmdlets": [], + "AdminAuditLogAgeLimit": "90.00:00:00", + "LoadBalancerCount": 3, + "RefreshInterval": 10, + "PartitionInfo": [], + "AdminAuditLogMailbox": "", + "UnifiedAuditLogIngestionEnabled": true, + "UnifiedAuditLogFirstOptInDate": "/Date(1618327011162)/", + "AdminDisplayName": "", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Name": "Admin Audit Log Settings", + "DistinguishedName": "CN=Admin Audit Log Settings,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "Admin Audit Log Settings", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Admin-Audit-Log-Config", + "ObjectClass": ["top", "msExchAdminAuditLogConfig"], + "WhenChanged": "/Date(1619484611000)/", + "WhenCreated": "/Date(1619484594000)/", + "WhenChangedUTC": "/Date(1619484611000)/", + "WhenCreatedUTC": "/Date(1619484594000)/", + "ExchangeObjectId": "35b89a9b-b235-4d67-ba7f-7ddeab032801", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "Admin Audit Log Settings", + "Guid": "97423bd9-ae36-4a1f-a225-5e007478854f", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Changed" } -], - "safe_links_policies": [ + ], + "safe_links_policies": [ { - "EnableSafeLinksForEmail": true, - "EnableSafeLinksForTeams": true, - "EnableSafeLinksForOffice": true, - "TrackClicks": true, - "AllowClickThrough": true, - "ScanUrls": true, - "EnableForInternalSenders": false, - "DeliverMessageAfterScan": true, - "DisableUrlRewrite": true, - "DoNotRewriteUrls": [ - - ], - "AdminDisplayName": "", - "CustomNotificationText": "", - "LocalizedNotificationTextList": [ - - ], - "EnableOrganizationBranding": false, - "RecommendedPolicyType": "Custom", - "IsBuiltInProtection": true, - "Identity": "Built-In Protection Policy", - "Id": "Built-In Protection Policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Built-In Protection Policy", - "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", - "ObjectClass": [ - "top", - "msExchSmartLinksProtectionConfig" - ], - "WhenChanged": "/Date(1659712331000)/", - "WhenCreated": "/Date(1643236367000)/", - "WhenChangedUTC": "/Date(1659712331000)/", - "WhenCreatedUTC": "/Date(1643236367000)/", - "ExchangeObjectId": "ddcb4f6e-396f-4208-a314-17e89fcf481c", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "ddcb4f6e-396f-4208-a314-17e89fcf481c", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "EnableSafeLinksForEmail": true, + "EnableSafeLinksForTeams": true, + "EnableSafeLinksForOffice": true, + "TrackClicks": true, + "AllowClickThrough": true, + "ScanUrls": true, + "EnableForInternalSenders": false, + "DeliverMessageAfterScan": true, + "DisableUrlRewrite": true, + "DoNotRewriteUrls": [], + "AdminDisplayName": "", + "CustomNotificationText": "", + "LocalizedNotificationTextList": [], + "EnableOrganizationBranding": false, + "RecommendedPolicyType": "Custom", + "IsBuiltInProtection": true, + "Identity": "Built-In Protection Policy", + "Id": "Built-In Protection Policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Built-In Protection Policy", + "DistinguishedName": "CN=Built-In Protection Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", + "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], + "WhenChanged": "/Date(1659712331000)/", + "WhenCreated": "/Date(1643236367000)/", + "WhenChangedUTC": "/Date(1659712331000)/", + "WhenCreatedUTC": "/Date(1643236367000)/", + "ExchangeObjectId": "ddcb4f6e-396f-4208-a314-17e89fcf481c", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "ddcb4f6e-396f-4208-a314-17e89fcf481c", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "EnableSafeLinksForEmail": true, - "EnableSafeLinksForTeams": true, - "EnableSafeLinksForOffice": true, - "TrackClicks": true, - "AllowClickThrough": false, - "ScanUrls": true, - "EnableForInternalSenders": true, - "DeliverMessageAfterScan": true, - "DisableUrlRewrite": false, - "DoNotRewriteUrls": [ - - ], - "AdminDisplayName": "", - "CustomNotificationText": "", - "LocalizedNotificationTextList": [ - - ], - "EnableOrganizationBranding": false, - "RecommendedPolicyType": "Strict", - "IsBuiltInProtection": false, - "Identity": "Strict Preset Security Policy1681329959203", - "Id": "Strict Preset Security Policy1681329959203", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Strict Preset Security Policy1681329959203", - "DistinguishedName": "CN=Strict Preset Security Policy1681329959203,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", - "ObjectClass": [ - "top", - "msExchSmartLinksProtectionConfig" - ], - "WhenChanged": "/Date(1681329967000)/", - "WhenCreated": "/Date(1681329959000)/", - "WhenChangedUTC": "/Date(1681329967000)/", - "WhenCreatedUTC": "/Date(1681329959000)/", - "ExchangeObjectId": "27887a2d-22de-4656-a7fd-636c4ed5b765", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "27887a2d-22de-4656-a7fd-636c4ed5b765", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "EnableSafeLinksForEmail": true, + "EnableSafeLinksForTeams": true, + "EnableSafeLinksForOffice": true, + "TrackClicks": true, + "AllowClickThrough": false, + "ScanUrls": true, + "EnableForInternalSenders": true, + "DeliverMessageAfterScan": true, + "DisableUrlRewrite": false, + "DoNotRewriteUrls": [], + "AdminDisplayName": "", + "CustomNotificationText": "", + "LocalizedNotificationTextList": [], + "EnableOrganizationBranding": false, + "RecommendedPolicyType": "Strict", + "IsBuiltInProtection": false, + "Identity": "Strict Preset Security Policy1681329959203", + "Id": "Strict Preset Security Policy1681329959203", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Strict Preset Security Policy1681329959203", + "DistinguishedName": "CN=Strict Preset Security Policy1681329959203,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", + "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], + "WhenChanged": "/Date(1681329967000)/", + "WhenCreated": "/Date(1681329959000)/", + "WhenChangedUTC": "/Date(1681329967000)/", + "WhenCreatedUTC": "/Date(1681329959000)/", + "ExchangeObjectId": "27887a2d-22de-4656-a7fd-636c4ed5b765", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "27887a2d-22de-4656-a7fd-636c4ed5b765", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "EnableSafeLinksForEmail": true, - "EnableSafeLinksForTeams": true, - "EnableSafeLinksForOffice": true, - "TrackClicks": true, - "AllowClickThrough": false, - "ScanUrls": true, - "EnableForInternalSenders": true, - "DeliverMessageAfterScan": true, - "DisableUrlRewrite": false, - "DoNotRewriteUrls": [ - - ], - "AdminDisplayName": "", - "CustomNotificationText": "", - "LocalizedNotificationTextList": [ - - ], - "EnableOrganizationBranding": true, - "RecommendedPolicyType": "Custom", - "IsBuiltInProtection": false, - "Identity": "agency Safe Links Policy", - "Id": "agency Safe Links Policy", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency Safe Links Policy", - "DistinguishedName": "CN=agency Safe Links Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", - "ObjectClass": [ - "top", - "msExchSmartLinksProtectionConfig" - ], - "WhenChanged": "/Date(1651250012000)/", - "WhenCreated": "/Date(1619484593000)/", - "WhenChangedUTC": "/Date(1651250012000)/", - "WhenCreatedUTC": "/Date(1619484593000)/", - "ExchangeObjectId": "df4b69fe-c42a-4458-a3ff-9ee56509724b", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "8b74f795-60d5-4d5d-8d49-acc928045c42", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "EnableSafeLinksForEmail": true, + "EnableSafeLinksForTeams": true, + "EnableSafeLinksForOffice": true, + "TrackClicks": true, + "AllowClickThrough": false, + "ScanUrls": true, + "EnableForInternalSenders": true, + "DeliverMessageAfterScan": true, + "DisableUrlRewrite": false, + "DoNotRewriteUrls": [], + "AdminDisplayName": "", + "CustomNotificationText": "", + "LocalizedNotificationTextList": [], + "EnableOrganizationBranding": true, + "RecommendedPolicyType": "Custom", + "IsBuiltInProtection": false, + "Identity": "agency Safe Links Policy", + "Id": "agency Safe Links Policy", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency Safe Links Policy", + "DistinguishedName": "CN=agency Safe Links Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", + "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], + "WhenChanged": "/Date(1651250012000)/", + "WhenCreated": "/Date(1619484593000)/", + "WhenChangedUTC": "/Date(1651250012000)/", + "WhenCreatedUTC": "/Date(1619484593000)/", + "ExchangeObjectId": "df4b69fe-c42a-4458-a3ff-9ee56509724b", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "8b74f795-60d5-4d5d-8d49-acc928045c42", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "EnableSafeLinksForEmail": true, - "EnableSafeLinksForTeams": true, - "EnableSafeLinksForOffice": true, - "TrackClicks": true, - "AllowClickThrough": false, - "ScanUrls": true, - "EnableForInternalSenders": true, - "DeliverMessageAfterScan": true, - "DisableUrlRewrite": false, - "DoNotRewriteUrls": [ - - ], - "AdminDisplayName": "", - "CustomNotificationText": "", - "LocalizedNotificationTextList": [ - - ], - "EnableOrganizationBranding": false, - "RecommendedPolicyType": "Standard", - "IsBuiltInProtection": false, - "Identity": "Standard Preset Security Policy1659535436756", - "Id": "Standard Preset Security Policy1659535436756", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Standard Preset Security Policy1659535436756", - "DistinguishedName": "CN=Standard Preset Security Policy1659535436756,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", - "ObjectClass": [ - "top", - "msExchSmartLinksProtectionConfig" - ], - "WhenChanged": "/Date(1659535439000)/", - "WhenCreated": "/Date(1659535437000)/", - "WhenChangedUTC": "/Date(1659535439000)/", - "WhenCreatedUTC": "/Date(1659535437000)/", - "ExchangeObjectId": "8c2861f1-a488-4120-8c37-6968f6bddcd3", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "8c2861f1-a488-4120-8c37-6968f6bddcd3", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "EnableSafeLinksForEmail": true, + "EnableSafeLinksForTeams": true, + "EnableSafeLinksForOffice": true, + "TrackClicks": true, + "AllowClickThrough": false, + "ScanUrls": true, + "EnableForInternalSenders": true, + "DeliverMessageAfterScan": true, + "DisableUrlRewrite": false, + "DoNotRewriteUrls": [], + "AdminDisplayName": "", + "CustomNotificationText": "", + "LocalizedNotificationTextList": [], + "EnableOrganizationBranding": false, + "RecommendedPolicyType": "Standard", + "IsBuiltInProtection": false, + "Identity": "Standard Preset Security Policy1659535436756", + "Id": "Standard Preset Security Policy1659535436756", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Standard Preset Security Policy1659535436756", + "DistinguishedName": "CN=Standard Preset Security Policy1659535436756,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config", + "ObjectClass": ["top", "msExchSmartLinksProtectionConfig"], + "WhenChanged": "/Date(1659535439000)/", + "WhenCreated": "/Date(1659535437000)/", + "WhenChangedUTC": "/Date(1659535439000)/", + "WhenCreatedUTC": "/Date(1659535437000)/", + "ExchangeObjectId": "8c2861f1-a488-4120-8c37-6968f6bddcd3", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "8c2861f1-a488-4120-8c37-6968f6bddcd3", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" } -], - "safe_links_rules": [ + ], + "safe_links_rules": [ { - "SafeLinksPolicy": "agency Safe Links Policy", - "State": "Enabled", - "Priority": 0, - "Comments": null, - "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027 or u0027dhs.agency.govu0027rnTake the following actions:rntApply safe links policy 'agency Safe Links Policy'.rn", - "RuleVersion": { - "Major": 15, - "Minor": 0, - "Build": 5, - "Revision": 2, - "MajorRevision": 0, - "MinorRevision": 2 - }, - "SentTo": null, - "SentToMemberOf": null, - "RecipientDomainIs": [ - "agency.onmicrosoft.com", - "agency.mail.onmicrosoft.com", - "test365.agency.dhs.gov", - "dhs.agency.gov" - ], - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfRecipientDomainIs": null, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" - ], - "Exceptions": null, - "Identity": "agency Safe Links Policy", - "DistinguishedName": "CN=agency Safe Links Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", - "ImmutableId": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "agency Safe Links Policy", - "IsValid": true, - "WhenChanged": "/Date(1664811214000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "SafeLinksPolicy": "agency Safe Links Policy", + "State": "Enabled", + "Priority": 0, + "Comments": null, + "Description": "If the message:rntrecipientsu0027s address domain portion belongs to any of these domains: u0027agency.onmicrosoft.comu0027 or u0027agency.mail.onmicrosoft.comu0027 or u0027test365.agency.dhs.govu0027 or u0027dhs.agency.govu0027rnTake the following actions:rntApply safe links policy 'agency Safe Links Policy'.rn", + "RuleVersion": { + "Major": 15, + "Minor": 0, + "Build": 5, + "Revision": 2, + "MajorRevision": 0, + "MinorRevision": 2 + }, + "SentTo": null, + "SentToMemberOf": null, + "RecipientDomainIs": [ + "agency.onmicrosoft.com", + "agency.mail.onmicrosoft.com", + "test365.agency.dhs.gov", + "dhs.agency.gov" + ], + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfRecipientDomainIs": null, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RecipientDomainIsPredicate" + ], + "Exceptions": null, + "Identity": "agency Safe Links Policy", + "DistinguishedName": "CN=agency Safe Links Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", + "ImmutableId": "74daf27b-c2ba-4556-b5f1-7db4a6fb57e2", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "agency Safe Links Policy", + "IsValid": true, + "WhenChanged": "/Date(1664811214000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" } -], - "atp_policy_for_o365": [ + ], + "atp_policy_for_o365": [ { - "AdminDisplayName": "", - "EnableATPForSPOTeamsODB": true, - "EnableSafeDocs": true, - "AllowSafeDocsOpen": false, - "Identity": "Default", - "Id": "Default", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Default", - "DistinguishedName": "CN=Default,CN=Atp Policy For O365,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1626469554000)/", - "WhenCreated": "/Date(1626469503000)/", - "WhenChangedUTC": "/Date(1626469554000)/", - "WhenCreatedUTC": "/Date(1626469503000)/", - "ExchangeObjectId": "2aaee10f-6955-4976-be8b-ac1952fcb627", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "2aaee10f-6955-4976-be8b-ac1952fcb627", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "AdminDisplayName": "", + "EnableATPForSPOTeamsODB": true, + "EnableSafeDocs": true, + "AllowSafeDocsOpen": false, + "Identity": "Default", + "Id": "Default", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Default", + "DistinguishedName": "CN=Default,CN=Atp Policy For O365,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1626469554000)/", + "WhenCreated": "/Date(1626469503000)/", + "WhenChangedUTC": "/Date(1626469554000)/", + "WhenCreatedUTC": "/Date(1626469503000)/", + "ExchangeObjectId": "2aaee10f-6955-4976-be8b-ac1952fcb627", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "2aaee10f-6955-4976-be8b-ac1952fcb627", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" } -], - "defender_license": true, - "defender_successful_commands": [ + ], + "defender_license": true, + "defender_successful_commands": [ "Get-AdminAuditLogConfig", "Get-EOPProtectionPolicyRule", "Get-MalwareFilterPolicy", @@ -19108,1184 +15901,1123 @@ "Get-DlpCompliancePolicy", "Get-ProtectionAlert", "Get-DlpComplianceRule" -], - "defender_unsuccessful_commands": [ - -], "remote_domains": [ + ], + "defender_unsuccessful_commands": [], + "remote_domains": [ { - "DomainName": "*", - "IsInternal": false, - "TargetDeliveryDomain": false, - "ByteEncoderTypeFor7BitCharsets": "Undefined", - "CharacterSet": "iso-8859-1", - "NonMimeCharacterSet": "iso-8859-1", - "AllowedOOFType": "External", - "SmtpDaneMandatoryModeEnabled": false, - "AutoReplyEnabled": true, - "AutoForwardEnabled": false, - "DeliveryReportEnabled": false, - "NDREnabled": true, - "MeetingForwardNotificationEnabled": true, - "ContentType": "MimeHtmlText", - "DisplaySenderName": true, - "PreferredInternetCodePageForShiftJis": "Undefined", - "RequiredCharsetCoverage": null, - "TNEFEnabled": false, - "LineWrapSize": "Unlimited", - "TrustedMailOutboundEnabled": false, - "TrustedMailInboundEnabled": false, - "UseSimpleDisplayName": false, - "NDRDiagnosticInfoEnabled": true, - "MessageCountThreshold": 2147483647, - "AdminDisplayName": "", - "ExchangeVersion": "0.1 (8.0.535.0)", - "Name": "Default", - "DistinguishedName": "CN=Default,CN=Internet Message Formats,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "Default", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Domain-Content-Config", - "ObjectClass": [ - "top", - "msExchDomainContentConfig" - ], - "WhenChanged": "/Date(1652740539000)/", - "WhenCreated": "/Date(1619484412000)/", - "WhenChangedUTC": "/Date(1652740539000)/", - "WhenCreatedUTC": "/Date(1619484412000)/", - "ExchangeObjectId": "2042facf-0e9e-4738-ad60-56d6c5d43b5d", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "Default", - "Guid": "5c597b00-69f6-44cf-b30b-474fb38a1e0a", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "DomainName": "*", + "IsInternal": false, + "TargetDeliveryDomain": false, + "ByteEncoderTypeFor7BitCharsets": "Undefined", + "CharacterSet": "iso-8859-1", + "NonMimeCharacterSet": "iso-8859-1", + "AllowedOOFType": "External", + "SmtpDaneMandatoryModeEnabled": false, + "AutoReplyEnabled": true, + "AutoForwardEnabled": false, + "DeliveryReportEnabled": false, + "NDREnabled": true, + "MeetingForwardNotificationEnabled": true, + "ContentType": "MimeHtmlText", + "DisplaySenderName": true, + "PreferredInternetCodePageForShiftJis": "Undefined", + "RequiredCharsetCoverage": null, + "TNEFEnabled": false, + "LineWrapSize": "Unlimited", + "TrustedMailOutboundEnabled": false, + "TrustedMailInboundEnabled": false, + "UseSimpleDisplayName": false, + "NDRDiagnosticInfoEnabled": true, + "MessageCountThreshold": 2147483647, + "AdminDisplayName": "", + "ExchangeVersion": "0.1 (8.0.535.0)", + "Name": "Default", + "DistinguishedName": "CN=Default,CN=Internet Message Formats,CN=Global Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "Default", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Domain-Content-Config", + "ObjectClass": ["top", "msExchDomainContentConfig"], + "WhenChanged": "/Date(1652740539000)/", + "WhenCreated": "/Date(1619484412000)/", + "WhenChangedUTC": "/Date(1652740539000)/", + "WhenCreatedUTC": "/Date(1619484412000)/", + "ExchangeObjectId": "2042facf-0e9e-4738-ad60-56d6c5d43b5d", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "Default", + "Guid": "5c597b00-69f6-44cf-b30b-474fb38a1e0a", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" } -], - "spf_records": [ + ], + "spf_records": [ { - "domain": "dhs.agency.gov", - "rdata": [ - "v=spf1 include:spf.protection.outlook.com -all" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 1 txt records", - "query_name": "dhs.agency.gov" - } - ] + "domain": "dhs.agency.gov", + "rdata": ["v=spf1 include:spf.protection.outlook.com -all"], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 1 txt records", + "query_name": "dhs.agency.gov" + } + ] }, { - "domain": "test365.agency.dhs.gov", - "rdata": [ - "v=spf1 include:spf.protection.outlook.com -all" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 1 txt records", - "query_name": "test365.agency.dhs.gov" - } - ] + "domain": "test365.agency.dhs.gov", + "rdata": ["v=spf1 include:spf.protection.outlook.com -all"], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 1 txt records", + "query_name": "test365.agency.dhs.gov" + } + ] }, { - "domain": "agency.mail.onmicrosoft.com", - "rdata": [ - "v=spf1 include:outlook.com -all" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 1 txt records", - "query_name": "agency.mail.onmicrosoft.com" - } - ] + "domain": "agency.mail.onmicrosoft.com", + "rdata": ["v=spf1 include:outlook.com -all"], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 1 txt records", + "query_name": "agency.mail.onmicrosoft.com" + } + ] }, { - "domain": "agency.onmicrosoft.com", - "rdata": [ - "v=spf1 include:spf.protection.outlook.com -all", - "mscid=d/1e071KOhkmP8Aanr5sNgUqyTBrvrMx5nKSswPxu5ZsqL0bdAgVo3m7f5VYu+inbKA5YviUPzz/SxNS0ploJQ==" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 2 txt records", - "query_name": "agency.onmicrosoft.com" - } - ] + "domain": "agency.onmicrosoft.com", + "rdata": [ + "v=spf1 include:spf.protection.outlook.com -all", + "checkov:skip=CKV_SECRET_3:This is not an Azure Storage Account access key.", + "mscid=d/1e071KOhkmP8Aanr5sNgUqyTBrvrMx5nKSswPxu5ZsqL0bdAgVo3m7f5VYu+inbKA5YviUPzz/SxNS0ploJQ==" + ], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 2 txt records", + "query_name": "agency.onmicrosoft.com" + } + ] } -], - "dkim_config": [ - { - "Domain": "dhs.agency.gov", - "AdminDisplayName": "", - "Selector1KeySize": 2048, - "Selector1CNAME": "selector1-dhs-agency-gov._domainkey.agency.onmicrosoft.com", - "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lftsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;", - "Selector2KeySize": 2048, - "Selector2CNAME": "selector2-dhs-agency-gov._domainkey.agency.onmicrosoft.com", - "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmn5LZHYWK9CebUh/P+sris0fCvFhbwTQCGv9U/0QMtDygpX6AG8PUI4wAUURCQ3jESsh7OKARvukQ7T5E30FOA9GrEkRgLgQt//7KftdvWSakpCcNUUQ7IJllUEOKgxo04wZDY8gC66nMy7KvM63ja6+YhxbVJDbqextHYH5gTGGVQbM93Txt8WNQ0ws/IZljDlPv4/Cp+jPf1cnmdCngEWadlm8vT1gsD/eR1GcLL+VsnD1NoyRYwEPTsWTHEJVwki1KADdv1VvrUUWcZ6ofFoElbLydUCeDtDoELeqhUqvG8vFGce2cjGd+WkJ9l0YXeIsU9eY1HS+Dmq0A0gKhQIDAQAB;", - "Enabled": true, - "IsDefault": false, - "HeaderCanonicalization": "Relaxed", - "BodyCanonicalization": "Relaxed", - "Algorithm": "RsaSHA256", - "NumberOfBytesToSign": "All", - "IncludeSignatureCreationTime": true, - "IncludeKeyExpiration": false, - "KeyCreationTime": "/Date(1626472130517)/", - "LastChecked": "/Date(1626472130517)/", - "RotateOnDate": "/Date(1626817730517)/", - "SelectorBeforeRotateOnDate": "selector1", - "SelectorAfterRotateOnDate": "selector2", - "Status": "Valid", - "Identity": "dhs.agency.gov", - "Id": "dhs.agency.gov", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "dhs.agency.gov", - "DistinguishedName": "CN=dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1626472136000)/", - "WhenCreated": "/Date(1626471047000)/", - "WhenChangedUTC": "/Date(1626472136000)/", - "WhenCreatedUTC": "/Date(1626471047000)/", - "ExchangeObjectId": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" - }, + ], + "dkim_config": [ { - "Domain": "associates.dhs.agency.gov", - "AdminDisplayName": "", - "Selector1KeySize": 2048, - "Selector1CNAME": "selector1-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", - "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiJqFoGnKm/i107OGE0xPgaozjujMVN6EAqaJ4RqCqDaHoErrFbuev5u2D1ZlDAAn3aEJ2KvObey6sLl/OcsULS2rO9ooUAOL0tMUR+1bfFiNz8ypH3eJfL7UN5v2bS+xcauTMusMw9lq88mrC1loS78K1sYiqjnUiEIvExO6wEEKXO0mFPpJRkG4pN+TmiByAAabzx+XxnmYdu1ZbRkAlxNxUAcPykhdIJ0UuQmFeQwYBmOhhu8dTaS51bt+SkxQMq9fm1UYcAGaHKKMceGD+agOgI7lPLBoByK/3PwnxGUptJQmZnk6TJ9a1kMbLzllXSneqRkLCv0SCa6SXa2/QIDAQAB;", - "Selector2KeySize": 2048, - "Selector2CNAME": "selector2-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", - "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA05Me3QPcAtSW6CMtxZq7y89zmpvq8QY/4srelDXznTvo/wpMPLLsrsd+lDsbKjX8t7KE+AhNBByRBogbJe9UPAIC2qqAQRgW3cEO89Vt9IJbYxIfzvLEZCiJlo+ixw+K7WvsMlC2M7pwfgWB5YHTcDjkN6Ix8q4FDFNWjReCqJpuaAgeC+2dqprKYVF2XgDk17+4JxuPBQqje8T/9mixIxKEnBHF+LHXDYJaTYZBZbfEwbg7s7ArqqqBYxToPrkbUJbpsF7c/xS+S12uUtxw7sHR5jXU4V15yJT9ed61flsDKTG/nQlSOpyfYgtlfXUm7SfUD532PoIxnuWvv1TJEQIDAQAB;", - "Enabled": true, - "IsDefault": false, - "HeaderCanonicalization": "Relaxed", - "BodyCanonicalization": "Relaxed", - "Algorithm": "RsaSHA256", - "NumberOfBytesToSign": "All", - "IncludeSignatureCreationTime": true, - "IncludeKeyExpiration": false, - "KeyCreationTime": "/Date(1651609815797)/", - "LastChecked": "/Date(1651609815797)/", - "RotateOnDate": "/Date(1651955415797)/", - "SelectorBeforeRotateOnDate": "selector2", - "SelectorAfterRotateOnDate": "selector1", - "Status": "Valid", - "Identity": "associates.dhs.agency.gov", - "Id": "associates.dhs.agency.gov", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "associates.dhs.agency.gov", - "DistinguishedName": "CN=associates.dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1651609818000)/", - "WhenCreated": "/Date(1626471070000)/", - "WhenChangedUTC": "/Date(1651609818000)/", - "WhenCreatedUTC": "/Date(1626471070000)/", - "ExchangeObjectId": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Domain": "dhs.agency.gov", + "AdminDisplayName": "", + "Selector1KeySize": 2048, + "Selector1CNAME": "selector1-dhs-agency-gov._domainkey.agency.onmicrosoft.com", + "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lftsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;", + "Selector2KeySize": 2048, + "Selector2CNAME": "selector2-dhs-agency-gov._domainkey.agency.onmicrosoft.com", + "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmn5LZHYWK9CebUh/P+sris0fCvFhbwTQCGv9U/0QMtDygpX6AG8PUI4wAUURCQ3jESsh7OKARvukQ7T5E30FOA9GrEkRgLgQt//7KftdvWSakpCcNUUQ7IJllUEOKgxo04wZDY8gC66nMy7KvM63ja6+YhxbVJDbqextHYH5gTGGVQbM93Txt8WNQ0ws/IZljDlPv4/Cp+jPf1cnmdCngEWadlm8vT1gsD/eR1GcLL+VsnD1NoyRYwEPTsWTHEJVwki1KADdv1VvrUUWcZ6ofFoElbLydUCeDtDoELeqhUqvG8vFGce2cjGd+WkJ9l0YXeIsU9eY1HS+Dmq0A0gKhQIDAQAB;", + "Enabled": true, + "IsDefault": false, + "HeaderCanonicalization": "Relaxed", + "BodyCanonicalization": "Relaxed", + "Algorithm": "RsaSHA256", + "NumberOfBytesToSign": "All", + "IncludeSignatureCreationTime": true, + "IncludeKeyExpiration": false, + "KeyCreationTime": "/Date(1626472130517)/", + "LastChecked": "/Date(1626472130517)/", + "RotateOnDate": "/Date(1626817730517)/", + "SelectorBeforeRotateOnDate": "selector1", + "SelectorAfterRotateOnDate": "selector2", + "Status": "Valid", + "Identity": "dhs.agency.gov", + "Id": "dhs.agency.gov", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "dhs.agency.gov", + "DistinguishedName": "CN=dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1626472136000)/", + "WhenCreated": "/Date(1626471047000)/", + "WhenChangedUTC": "/Date(1626472136000)/", + "WhenCreatedUTC": "/Date(1626471047000)/", + "ExchangeObjectId": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "7218f0b3-d9ad-4964-be49-b7b1c0b635e4", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Domain": "test365.agency.dhs.gov", - "AdminDisplayName": "", - "Selector1KeySize": 2048, - "Selector1CNAME": "selector1-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", - "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5C8aVe0pDvH1I6/e4sC1IJhNu/OdO9TANT6YG5Q61XQrc4hSyJsW75f3qENcXZAMmsCUZhn7hYdtTv6tcpP/cebcFzmoEatBaVoVWl6R+Gy9/6uPjIrg8s/83le+KXK+TFgR5fighyMlwM937FS9Ii8HQVVzoFU08w6lfDjewLXCwBIk0Y5P0NjW510iaWxTMsnjZ/hrL/REnRRsYB2x8Ll/SHC9nltlGIP3IgcmGPS4DWSdNXTGu10Hz3zML9tRruU96K0TTWs2lRoQoNAn0eu2YLQ5RR8JaLiQ5EYn5lY3ZhDK/4FlAG52AdvkrdbQelwlJiZpBbTUjMk5PvtNUQIDAQAB;", - "Selector2KeySize": 2048, - "Selector2CNAME": "selector2-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", - "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vogy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;", - "Enabled": true, - "IsDefault": false, - "HeaderCanonicalization": "Relaxed", - "BodyCanonicalization": "Relaxed", - "Algorithm": "RsaSHA256", - "NumberOfBytesToSign": "All", - "IncludeSignatureCreationTime": true, - "IncludeKeyExpiration": false, - "KeyCreationTime": "/Date(1653603314013)/", - "LastChecked": "/Date(1653603314013)/", - "RotateOnDate": "/Date(1653948914013)/", - "SelectorBeforeRotateOnDate": "selector1", - "SelectorAfterRotateOnDate": "selector2", - "Status": "Valid", - "Identity": "test365.agency.dhs.gov", - "Id": "test365.agency.dhs.gov", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "test365.agency.dhs.gov", - "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1653603321000)/", - "WhenCreated": "/Date(1651689371000)/", - "WhenChangedUTC": "/Date(1653603321000)/", - "WhenCreatedUTC": "/Date(1651689371000)/", - "ExchangeObjectId": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Domain": "associates.dhs.agency.gov", + "AdminDisplayName": "", + "Selector1KeySize": 2048, + "Selector1CNAME": "selector1-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", + "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiJqFoGnKm/i107OGE0xPgaozjujMVN6EAqaJ4RqCqDaHoErrFbuev5u2D1ZlDAAn3aEJ2KvObey6sLl/OcsULS2rO9ooUAOL0tMUR+1bfFiNz8ypH3eJfL7UN5v2bS+xcauTMusMw9lq88mrC1loS78K1sYiqjnUiEIvExO6wEEKXO0mFPpJRkG4pN+TmiByAAabzx+XxnmYdu1ZbRkAlxNxUAcPykhdIJ0UuQmFeQwYBmOhhu8dTaS51bt+SkxQMq9fm1UYcAGaHKKMceGD+agOgI7lPLBoByK/3PwnxGUptJQmZnk6TJ9a1kMbLzllXSneqRkLCv0SCa6SXa2/QIDAQAB;", + "Selector2KeySize": 2048, + "Selector2CNAME": "selector2-associates-dhs-agency-gov._domainkey.agency.onmicrosoft.com", + "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA05Me3QPcAtSW6CMtxZq7y89zmpvq8QY/4srelDXznTvo/wpMPLLsrsd+lDsbKjX8t7KE+AhNBByRBogbJe9UPAIC2qqAQRgW3cEO89Vt9IJbYxIfzvLEZCiJlo+ixw+K7WvsMlC2M7pwfgWB5YHTcDjkN6Ix8q4FDFNWjReCqJpuaAgeC+2dqprKYVF2XgDk17+4JxuPBQqje8T/9mixIxKEnBHF+LHXDYJaTYZBZbfEwbg7s7ArqqqBYxToPrkbUJbpsF7c/xS+S12uUtxw7sHR5jXU4V15yJT9ed61flsDKTG/nQlSOpyfYgtlfXUm7SfUD532PoIxnuWvv1TJEQIDAQAB;", + "Enabled": true, + "IsDefault": false, + "HeaderCanonicalization": "Relaxed", + "BodyCanonicalization": "Relaxed", + "Algorithm": "RsaSHA256", + "NumberOfBytesToSign": "All", + "IncludeSignatureCreationTime": true, + "IncludeKeyExpiration": false, + "KeyCreationTime": "/Date(1651609815797)/", + "LastChecked": "/Date(1651609815797)/", + "RotateOnDate": "/Date(1651955415797)/", + "SelectorBeforeRotateOnDate": "selector2", + "SelectorAfterRotateOnDate": "selector1", + "Status": "Valid", + "Identity": "associates.dhs.agency.gov", + "Id": "associates.dhs.agency.gov", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "associates.dhs.agency.gov", + "DistinguishedName": "CN=associates.dhs.agency.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1651609818000)/", + "WhenCreated": "/Date(1626471070000)/", + "WhenChangedUTC": "/Date(1651609818000)/", + "WhenCreatedUTC": "/Date(1626471070000)/", + "ExchangeObjectId": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "5c088a4c-3ef4-4413-8095-c8e15d2e9e48", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Domain": "agency.onmicrosoft.com", - "AdminDisplayName": "", - "Selector1KeySize": 2048, - "Selector1CNAME": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", - "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNXqII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;", - "Selector2KeySize": 2048, - "Selector2CNAME": "selector2-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", - "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0N9/MWtBA7REPZSGKz9hfYIgF5jm5uri7RVSkaptlnvK0AI6jmJ4TvZ4beFzrfJDh6cIt5gX0UqnTzF9/0UZeyfRuUQAUew/sXU8FZXEnt+Bxr9k8PkAaqr2ksYhY/n46DxrWu1X/Cz7tye5FBnsTbyI6PnaBCfcgzwFnULaojUtdqSQGF7dt4HcyZGnUX1YLNwhp4Lyi9g1bZF6EdNMYHuKXFIsRo5qmEMagIsi557jGlGNTqTKJ9aZWGiCgjFJ14mTUN/itKXb5RqBAfG9KeZQXk6hWGTe7H9lVOshMZgV4t0FyaisrGg5GselbKZukxcA8xsOnCLpjSRUJiUmAQIDAQAB;", - "Enabled": true, - "IsDefault": true, - "HeaderCanonicalization": "Relaxed", - "BodyCanonicalization": "Relaxed", - "Algorithm": "RsaSHA256", - "NumberOfBytesToSign": "All", - "IncludeSignatureCreationTime": true, - "IncludeKeyExpiration": false, - "KeyCreationTime": "/Date(1653603718610)/", - "LastChecked": "/Date(1653603718610)/", - "RotateOnDate": "/Date(1653949318610)/", - "SelectorBeforeRotateOnDate": "selector1", - "SelectorAfterRotateOnDate": "selector2", - "Status": "Valid", - "Identity": "agency.onmicrosoft.com", - "Id": "agency.onmicrosoft.com", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency.onmicrosoft.com", - "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1653603723000)/", - "WhenCreated": "/Date(1619484596000)/", - "WhenChangedUTC": "/Date(1653603723000)/", - "WhenCreatedUTC": "/Date(1619484596000)/", - "ExchangeObjectId": "ea1866b3-b7fa-4dbe-b9c9-48087391a536", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "476371c0-bf15-4101-84a7-a3a03b4266f1", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "Domain": "test365.agency.dhs.gov", + "AdminDisplayName": "", + "Selector1KeySize": 2048, + "Selector1CNAME": "selector1-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", + "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5C8aVe0pDvH1I6/e4sC1IJhNu/OdO9TANT6YG5Q61XQrc4hSyJsW75f3qENcXZAMmsCUZhn7hYdtTv6tcpP/cebcFzmoEatBaVoVWl6R+Gy9/6uPjIrg8s/83le+KXK+TFgR5fighyMlwM937FS9Ii8HQVVzoFU08w6lfDjewLXCwBIk0Y5P0NjW510iaWxTMsnjZ/hrL/REnRRsYB2x8Ll/SHC9nltlGIP3IgcmGPS4DWSdNXTGu10Hz3zML9tRruU96K0TTWs2lRoQoNAn0eu2YLQ5RR8JaLiQ5EYn5lY3ZhDK/4FlAG52AdvkrdbQelwlJiZpBbTUjMk5PvtNUQIDAQAB;", + "Selector2KeySize": 2048, + "Selector2CNAME": "selector2-test365-agency-dhs-gov._domainkey.agency.onmicrosoft.com", + "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vogy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;", + "Enabled": true, + "IsDefault": false, + "HeaderCanonicalization": "Relaxed", + "BodyCanonicalization": "Relaxed", + "Algorithm": "RsaSHA256", + "NumberOfBytesToSign": "All", + "IncludeSignatureCreationTime": true, + "IncludeKeyExpiration": false, + "KeyCreationTime": "/Date(1653603314013)/", + "LastChecked": "/Date(1653603314013)/", + "RotateOnDate": "/Date(1653948914013)/", + "SelectorBeforeRotateOnDate": "selector1", + "SelectorAfterRotateOnDate": "selector2", + "Status": "Valid", + "Identity": "test365.agency.dhs.gov", + "Id": "test365.agency.dhs.gov", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "test365.agency.dhs.gov", + "DistinguishedName": "CN=test365.agency.dhs.gov,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1653603321000)/", + "WhenCreated": "/Date(1651689371000)/", + "WhenChangedUTC": "/Date(1653603321000)/", + "WhenCreatedUTC": "/Date(1651689371000)/", + "ExchangeObjectId": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "e64ef9c1-9920-474d-aad3-b3d1b7cd606e", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, { - "Domain": "agency.net", - "AdminDisplayName": "", - "Selector1KeySize": 2048, - "Selector1CNAME": "selector1-agency-net._domainkey.agency.onmicrosoft.com", - "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxV9ibpvnJt6CCoHMtsiGp1D0JPqsPMjI5aP+vDzVtrRSz34yMTvVXQ0UhCjVLoOJL9SSWobjhFnK+26+sOMSbWf1ARUhcVItUjOutZ/8RBW/LYyCTrPVZBsFcgjfK+ugBx7ygPWyvLsAryNL4aMGOe1YKHTvTaPoXImUtq4FyjUNkzVL+N1m2nkpj2PtRja8iHVvXe0v59KhJeFpEI7XHsNYk14RZHflP5zpUi8wqER9RokPpWVRJRwqPBqh4krm0WWmlfGksUzJI2MqmE1rOzTKedri6F2o0vZY1m6XCPi3StTXVFXH09NgxlLbI3i+98qGGvkJPaKwLGP+ajjYpQIDAQAB;", - "Selector2KeySize": 2048, - "Selector2CNAME": "selector2-agency-net._domainkey.agency.onmicrosoft.com", - "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtoKjm+o74krUkXM2gDW7kLHVA29qVN2pX3gTWS8ahdOahUphlg2EYS4nuIeiGljPbBWJpyRXLIxWsd9FctUgw75fj7MCa1jZz/rHqiHOnT0kNOLkMadSk6aTJvgPVpknV4T0TLhrz9rdIsOX6TjyB0n1MIpKNZTVrwDpGRfO2x/KkzaAvqevGu8i0NBj9dyFk2i7rmpV4SYt5j3QyONuW5M+s+XzkNmPUZuFt/9qP1Jm7A11Wnu9z/9WuiAPJsVCNZh2ZizXE6IQzBMrb1qJtbnjqqnOeJUJ057lcUzwjADV3JJi9Oj7GPN+AChlbiFx+82F9Fwf4md2N7UlrzbZgQIDAQAB;", - "Enabled": true, - "IsDefault": false, - "HeaderCanonicalization": "Relaxed", - "BodyCanonicalization": "Relaxed", - "Algorithm": "RsaSHA256", - "NumberOfBytesToSign": "All", - "IncludeSignatureCreationTime": true, - "IncludeKeyExpiration": false, - "KeyCreationTime": "/Date(1618337906904)/", - "LastChecked": "/Date(1618339026879)/", - "RotateOnDate": "/Date(1618337906904)/", - "SelectorBeforeRotateOnDate": "selector2", - "SelectorAfterRotateOnDate": "selector1", - "Status": "Valid", - "Identity": "agency.net", - "Id": "agency.net", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "agency.net", - "DistinguishedName": "CN=agency.net,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", - "ObjectClass": [ - "top", - "msExchHostedContentFilterConfig" - ], - "WhenChanged": "/Date(1619484611000)/", - "WhenCreated": "/Date(1619484597000)/", - "WhenChangedUTC": "/Date(1619484611000)/", - "WhenCreatedUTC": "/Date(1619484597000)/", - "ExchangeObjectId": "28c37edc-ac62-41ce-933e-0f02f1af767c", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "8e977acc-dd79-4c83-be46-f792a515ab97", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" - } -], - "dkim_records": [ - { - "domain": "dhs.agency.gov", - "rdata": [ - "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lf", - "tsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 2 txt records", - "query_name": "selector1._domainkey.dhs.agency.gov" - } - ] + "Domain": "agency.onmicrosoft.com", + "AdminDisplayName": "", + "Selector1KeySize": 2048, + "Selector1CNAME": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", + "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNXqII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;", + "Selector2KeySize": 2048, + "Selector2CNAME": "selector2-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com", + "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0N9/MWtBA7REPZSGKz9hfYIgF5jm5uri7RVSkaptlnvK0AI6jmJ4TvZ4beFzrfJDh6cIt5gX0UqnTzF9/0UZeyfRuUQAUew/sXU8FZXEnt+Bxr9k8PkAaqr2ksYhY/n46DxrWu1X/Cz7tye5FBnsTbyI6PnaBCfcgzwFnULaojUtdqSQGF7dt4HcyZGnUX1YLNwhp4Lyi9g1bZF6EdNMYHuKXFIsRo5qmEMagIsi557jGlGNTqTKJ9aZWGiCgjFJ14mTUN/itKXb5RqBAfG9KeZQXk6hWGTe7H9lVOshMZgV4t0FyaisrGg5GselbKZukxcA8xsOnCLpjSRUJiUmAQIDAQAB;", + "Enabled": true, + "IsDefault": true, + "HeaderCanonicalization": "Relaxed", + "BodyCanonicalization": "Relaxed", + "Algorithm": "RsaSHA256", + "NumberOfBytesToSign": "All", + "IncludeSignatureCreationTime": true, + "IncludeKeyExpiration": false, + "KeyCreationTime": "/Date(1653603718610)/", + "LastChecked": "/Date(1653603718610)/", + "RotateOnDate": "/Date(1653949318610)/", + "SelectorBeforeRotateOnDate": "selector1", + "SelectorAfterRotateOnDate": "selector2", + "Status": "Valid", + "Identity": "agency.onmicrosoft.com", + "Id": "agency.onmicrosoft.com", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency.onmicrosoft.com", + "DistinguishedName": "CN=agency.onmicrosoft.com,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1653603723000)/", + "WhenCreated": "/Date(1619484596000)/", + "WhenChangedUTC": "/Date(1653603723000)/", + "WhenCreatedUTC": "/Date(1619484596000)/", + "ExchangeObjectId": "ea1866b3-b7fa-4dbe-b9c9-48087391a536", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "476371c0-bf15-4101-84a7-a3a03b4266f1", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" }, - { - "domain": "test365.agency.dhs.gov", - "rdata": [ - "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vo", - "gy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.test365.agency.dhs.gov" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.test365.agency.dhs.gov" - }, - { - "query_method": "traditional", - "query_result": "Query returned 2 txt records", - "query_name": "selector2._domainkey.test365.agency.dhs.gov" - } - ] + { + "Domain": "agency.net", + "AdminDisplayName": "", + "Selector1KeySize": 2048, + "Selector1CNAME": "selector1-agency-net._domainkey.agency.onmicrosoft.com", + "Selector1PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxV9ibpvnJt6CCoHMtsiGp1D0JPqsPMjI5aP+vDzVtrRSz34yMTvVXQ0UhCjVLoOJL9SSWobjhFnK+26+sOMSbWf1ARUhcVItUjOutZ/8RBW/LYyCTrPVZBsFcgjfK+ugBx7ygPWyvLsAryNL4aMGOe1YKHTvTaPoXImUtq4FyjUNkzVL+N1m2nkpj2PtRja8iHVvXe0v59KhJeFpEI7XHsNYk14RZHflP5zpUi8wqER9RokPpWVRJRwqPBqh4krm0WWmlfGksUzJI2MqmE1rOzTKedri6F2o0vZY1m6XCPi3StTXVFXH09NgxlLbI3i+98qGGvkJPaKwLGP+ajjYpQIDAQAB;", + "Selector2KeySize": 2048, + "Selector2CNAME": "selector2-agency-net._domainkey.agency.onmicrosoft.com", + "Selector2PublicKey": "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtoKjm+o74krUkXM2gDW7kLHVA29qVN2pX3gTWS8ahdOahUphlg2EYS4nuIeiGljPbBWJpyRXLIxWsd9FctUgw75fj7MCa1jZz/rHqiHOnT0kNOLkMadSk6aTJvgPVpknV4T0TLhrz9rdIsOX6TjyB0n1MIpKNZTVrwDpGRfO2x/KkzaAvqevGu8i0NBj9dyFk2i7rmpV4SYt5j3QyONuW5M+s+XzkNmPUZuFt/9qP1Jm7A11Wnu9z/9WuiAPJsVCNZh2ZizXE6IQzBMrb1qJtbnjqqnOeJUJ057lcUzwjADV3JJi9Oj7GPN+AChlbiFx+82F9Fwf4md2N7UlrzbZgQIDAQAB;", + "Enabled": true, + "IsDefault": false, + "HeaderCanonicalization": "Relaxed", + "BodyCanonicalization": "Relaxed", + "Algorithm": "RsaSHA256", + "NumberOfBytesToSign": "All", + "IncludeSignatureCreationTime": true, + "IncludeKeyExpiration": false, + "KeyCreationTime": "/Date(1618337906904)/", + "LastChecked": "/Date(1618339026879)/", + "RotateOnDate": "/Date(1618337906904)/", + "SelectorBeforeRotateOnDate": "selector2", + "SelectorAfterRotateOnDate": "selector1", + "Status": "Valid", + "Identity": "agency.net", + "Id": "agency.net", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "agency.net", + "DistinguishedName": "CN=agency.net,CN=Dkim Signing config,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Content-Filter-Config", + "ObjectClass": ["top", "msExchHostedContentFilterConfig"], + "WhenChanged": "/Date(1619484611000)/", + "WhenCreated": "/Date(1619484597000)/", + "WhenChangedUTC": "/Date(1619484611000)/", + "WhenCreatedUTC": "/Date(1619484597000)/", + "ExchangeObjectId": "28c37edc-ac62-41ce-933e-0f02f1af767c", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "8e977acc-dd79-4c83-be46-f792a515ab97", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" + } + ], + "dkim_records": [ + { + "domain": "dhs.agency.gov", + "rdata": [ + "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwFSu1nMh65jJ8aErOaJVvpebHMom45tQKfNK6/nQUgCg9ne8qFE0DyA0SdqtT3r4/uOzhFVxEYFT6rxqcD54BWVQ1hhdEeNbOhHiOjn+W8rLbNnejVUbk5tpjF9yHBkqrpRuJJKTOQTl+6Myqx2IqYA1PTM9Md94iOZNmxKyFlYzLr8QITRXtyQjtOlBE+7lf", + "tsNTAQwnl34zfPZZPAhczn0UfeAYW4hcYO6BP0OHlcwyLOXRcHIdKZ6mNOog0wExCK98ryPQuNFqzDxSMOg3vjmrQiTJzDOgKBqZ3+/Zjvhfyh0iLxWIDxeUNBgbMEx5tCuyUuO2JI+vK/VeG1mGQIDAQAB;" + ], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 2 txt records", + "query_name": "selector1._domainkey.dhs.agency.gov" + } + ] }, { - "domain": "agency.mail.onmicrosoft.com", - "rdata": [ - - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" - } - ] + "domain": "test365.agency.dhs.gov", + "rdata": [ + "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwVCM2ZRZbi+HfMpoGMmEuv+0x+Fc7++ObO11SXDvyrm5OhMGDzyR6lMJPRhovYu4y4WxgKvYtalHtORzIzbcs5+m07uee/bmz6vZJqsSc/52O0UJGHYpBAPWktBb5Trjaj4Hr26FkTIJCPxy4z8m4Wsx9/+jimn5cdb4zbQhnwccBii6wptEekvATQu6cX8vo", + "gy8NDFr6wcSxcM923EQSUout2OrUGmkJnQvrkKvCCj4Gjt8ZNoGGaLpd+vzKVbvyHaLOMbVreIWTm6fg5vM0DDmhVwIAfHUhoOlLOQ5GiGM4pK+z6MMzvAJE3bTLEvuoAji96GDSlLU+Kj+6rOWMQIDAQAB;" + ], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.test365.agency.dhs.gov" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.test365.agency.dhs.gov" + }, + { + "query_method": "traditional", + "query_result": "Query returned 2 txt records", + "query_name": "selector2._domainkey.test365.agency.dhs.gov" + } + ] }, { - "domain": "agency.onmicrosoft.com", - "rdata": [ - "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNX", - "qII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.agency.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector1._domainkey.agency.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "selector2._domainkey.agency.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "selector2._domainkey.agency.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned 2 txt records", - "query_name": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com" - } - ] + "domain": "agency.mail.onmicrosoft.com", + "rdata": [], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector2._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector1-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector2-agency-mail-onmicrosoft-com._domainkey.agency.mail.onmicrosoft.com" + } + ] + }, + { + "domain": "agency.onmicrosoft.com", + "rdata": [ + "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAohoPDhGToRO8y7acaWL2w15wsCmwabxgTwODro2c1BeRYXfnUMStICo3w4ZrYDtGZDSA7hm0x7OHujF1CoQnXiBmrQ154wtomPyx3Op/VC6+b9di4z15XBvhXh/fLBUdEJ6wsybMLmQ+WPQA6vsM3UN5Cv5rl2SylFoM//eLmw5R6NmMIj3GQg9b+vQl2cKNX", + "qII2gZrB07P6xt2wW1VA/LPjdRFUEys9YzBgOqM53VaODWDXDIvUH/nPRVAtOEsV19u66jyzZnzcz9a7ATxizix7DnySzI3koVlOGi/+dLx8FYIAZ/75wkH1O/gH8/n4C66uwRm/PMW+4JzVwLY+QIDAQAB;" + ], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.agency.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector1._domainkey.agency.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "selector2._domainkey.agency.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "selector2._domainkey.agency.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned 2 txt records", + "query_name": "selector1-agency-onmicrosoft-com._domainkey.agency.onmicrosoft.com" + } + ] } -], - "dmarc_records": [ + ], + "dmarc_records": [ { - "domain": "dhs.agency.gov", - "rdata": [ - "v=DMARC1; p=reject; sp=none;" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned 1 txt records", - "query_name": "_dmarc.dhs.agency.gov" - } - ] + "domain": "dhs.agency.gov", + "rdata": ["v=DMARC1; p=reject; sp=none;"], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned 1 txt records", + "query_name": "_dmarc.dhs.agency.gov" + } + ] }, { - "domain": "test365.agency.dhs.gov", - "rdata": [ - "v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov" - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.test365.agency.dhs.gov" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.test365.agency.dhs.gov" - }, - { - "query_method": "traditional", - "query_result": "Query returned 1 txt records", - "query_name": "_dmarc.dhs.gov" - } - ] + "domain": "test365.agency.dhs.gov", + "rdata": [ + "v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov" + ], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.test365.agency.dhs.gov" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.test365.agency.dhs.gov" + }, + { + "query_method": "traditional", + "query_result": "Query returned 1 txt records", + "query_name": "_dmarc.dhs.gov" + } + ] }, { - "domain": "agency.mail.onmicrosoft.com", - "rdata": [ - - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.agency.mail.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.agency.mail.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.onmicrosoft.com" - } - ] + "domain": "agency.mail.onmicrosoft.com", + "rdata": [], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.agency.mail.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.agency.mail.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.onmicrosoft.com" + } + ] }, { - "domain": "agency.onmicrosoft.com", - "rdata": [ - - ], - "log": [ - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.agency.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.agency.onmicrosoft.com" - }, - { - "query_method": "traditional", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.onmicrosoft.com" - }, - { - "query_method": "DoH", - "query_result": "Query returned NXDomain", - "query_name": "_dmarc.onmicrosoft.com" - } - ] + "domain": "agency.onmicrosoft.com", + "rdata": [], + "log": [ + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.agency.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.agency.onmicrosoft.com" + }, + { + "query_method": "traditional", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.onmicrosoft.com" + }, + { + "query_method": "DoH", + "query_result": "Query returned NXDomain", + "query_name": "_dmarc.onmicrosoft.com" + } + ] } -], - "transport_config": [ + ], + "transport_config": [ { - "Name": "Transport Settings", - "TLSReceiveDomainSecureList": [ - - ], - "TLSSendDomainSecureList": [ - - ], - "GenerateCopyOfDSNFor": [ - - ], - "InternalSMTPServers": [ - - ], - "JournalingReportNdrTo": "u003cu003e", - "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@agency.onmicrosoft.com", - "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", - "MaxDumpsterTime": "7.00:00:00", - "VerifySecureSubmitEnabled": false, - "ClearCategories": true, - "AddressBookPolicyRoutingEnabled": false, - "ConvertDisclaimerWrapperToEml": false, - "PreserveReportBodypart": true, - "ConvertReportToMessage": false, - "DSNConversionMode": "PreserveDSNBody", - "VoicemailJournalingEnabled": true, - "HeaderPromotionModeSetting": "NoCreate", - "Xexch50Enabled": true, - "Rfc2231EncodingEnabled": false, - "OpenDomainRoutingEnabled": false, - "MaxReceiveSize": "Unlimited", - "MaxRecipientEnvelopeLimit": "Unlimited", - "MaxSendSize": "Unlimited", - "ExternalDelayDsnEnabled": true, - "ExternalDsnDefaultLanguage": null, - "ExternalDsnLanguageDetectionEnabled": true, - "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", - "ExternalDsnReportingAuthority": null, - "ExternalDsnSendHtml": true, - "ExternalPostmasterAddress": null, - "InternalDelayDsnEnabled": true, - "InternalDsnDefaultLanguage": null, - "InternalDsnLanguageDetectionEnabled": true, - "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", - "InternalDsnReportingAuthority": null, - "InternalDsnSendHtml": true, - "SupervisionTags": [ - "Reject", - "Allow" - ], - "HygieneSuite": "Premium", - "MigrationEnabled": true, - "LegacyJournalingMigrationEnabled": false, - "LegacyArchiveJournalingEnabled": false, - "RedirectDLMessagesForLegacyArchiveJournaling": false, - "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, - "LegacyArchiveLiveJournalingEnabled": false, - "JournalArchivingEnabled": false, - "SafetyNetHoldTime": "7.00:00:00", - "TransportRuleConfig": [ - "TransportRuleMinProductVersion:14.0.0.0", - "TransportRuleRegexValidationTimeout:00:00:00.3000000", - "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", - "TransportRuleSizeLimit:8 KB (8,192 bytes)", - "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", - "TransportRuleLimit:300", - "TransportRuleCollectionAddedRecipientsLimit:100" - ], - "TransportRuleCollectionAddedRecipientsLimit": 100, - "TransportRuleLimit": 300, - "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", - "TransportRuleSizeLimit": "8 KB (8,192 bytes)", - "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", - "TransportRuleRegexValidationTimeout": "00:00:00.3000000", - "TransportRuleMinProductVersion": { - "Major": 14, - "Minor": 0, - "Build": 0, - "Revision": 0, - "MajorRevision": 0, - "MinorRevision": 0 - }, - "AnonymousSenderToRecipientRatePerHour": 1800, - "QueueDiagnosticsAggregationInterval": "00:01:00", - "JournalReportDLMemberSubstitutionEnabled": false, - "DiagnosticsAggregationServicePort": 9710, - "TransportSystemState": "", - "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, - "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, - "MaxAllowedAgentGeneratedMessageDepth": 3, - "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, - "AttributionRejectConsumerMessages": false, - "AttributionRejectBeforeMServRequest": false, - "SmtpClientAuthenticationDisabled": true, - "JournalMessageExpirationDays": 0, - "ReplyAllStormProtectionEnabled": true, - "ReplyAllStormDetectionMinimumRecipients": 2500, - "ReplyAllStormDetectionMinimumReplies": 10, - "AllowLegacyTLSClients": null, - "ReplyAllStormBlockDurationHours": 6, - "MessageExpiration": "1.00:00:00", - "EnableExternalHTTPMailDelivery": false, - "CurrentTransportSystemState": "Green", - "OtherWellKnownObjects": [ - - ], - "AdminDisplayName": "", - "ExchangeVersion": "0.1 (8.0.535.0)", - "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "Transport Settings", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", - "ObjectClass": [ - "top", - "container", - "msExchTransportSettings" - ], - "WhenChanged": "/Date(1654713404000)/", - "WhenCreated": "/Date(1619484398000)/", - "WhenChangedUTC": "/Date(1654713404000)/", - "WhenCreatedUTC": "/Date(1619484398000)/", - "ExchangeObjectId": "7ef195bd-4f88-46bc-97e6-db6c7665321b", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "Transport Settings", - "Guid": "01d25010-40a8-4d0a-9419-fb1d775b4d16", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Unchanged" + "Name": "Transport Settings", + "TLSReceiveDomainSecureList": [], + "TLSSendDomainSecureList": [], + "GenerateCopyOfDSNFor": [], + "InternalSMTPServers": [], + "JournalingReportNdrTo": "u003cu003e", + "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@agency.onmicrosoft.com", + "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", + "MaxDumpsterTime": "7.00:00:00", + "VerifySecureSubmitEnabled": false, + "ClearCategories": true, + "AddressBookPolicyRoutingEnabled": false, + "ConvertDisclaimerWrapperToEml": false, + "PreserveReportBodypart": true, + "ConvertReportToMessage": false, + "DSNConversionMode": "PreserveDSNBody", + "VoicemailJournalingEnabled": true, + "HeaderPromotionModeSetting": "NoCreate", + "Xexch50Enabled": true, + "Rfc2231EncodingEnabled": false, + "OpenDomainRoutingEnabled": false, + "MaxReceiveSize": "Unlimited", + "MaxRecipientEnvelopeLimit": "Unlimited", + "MaxSendSize": "Unlimited", + "ExternalDelayDsnEnabled": true, + "ExternalDsnDefaultLanguage": null, + "ExternalDsnLanguageDetectionEnabled": true, + "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "ExternalDsnReportingAuthority": null, + "ExternalDsnSendHtml": true, + "ExternalPostmasterAddress": null, + "InternalDelayDsnEnabled": true, + "InternalDsnDefaultLanguage": null, + "InternalDsnLanguageDetectionEnabled": true, + "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "InternalDsnReportingAuthority": null, + "InternalDsnSendHtml": true, + "SupervisionTags": ["Reject", "Allow"], + "HygieneSuite": "Premium", + "MigrationEnabled": true, + "LegacyJournalingMigrationEnabled": false, + "LegacyArchiveJournalingEnabled": false, + "RedirectDLMessagesForLegacyArchiveJournaling": false, + "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, + "LegacyArchiveLiveJournalingEnabled": false, + "JournalArchivingEnabled": false, + "SafetyNetHoldTime": "7.00:00:00", + "TransportRuleConfig": [ + "TransportRuleMinProductVersion:14.0.0.0", + "TransportRuleRegexValidationTimeout:00:00:00.3000000", + "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", + "TransportRuleSizeLimit:8 KB (8,192 bytes)", + "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", + "TransportRuleLimit:300", + "TransportRuleCollectionAddedRecipientsLimit:100" + ], + "TransportRuleCollectionAddedRecipientsLimit": 100, + "TransportRuleLimit": 300, + "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", + "TransportRuleSizeLimit": "8 KB (8,192 bytes)", + "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", + "TransportRuleRegexValidationTimeout": "00:00:00.3000000", + "TransportRuleMinProductVersion": { + "Major": 14, + "Minor": 0, + "Build": 0, + "Revision": 0, + "MajorRevision": 0, + "MinorRevision": 0 + }, + "AnonymousSenderToRecipientRatePerHour": 1800, + "QueueDiagnosticsAggregationInterval": "00:01:00", + "JournalReportDLMemberSubstitutionEnabled": false, + "DiagnosticsAggregationServicePort": 9710, + "TransportSystemState": "", + "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, + "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, + "MaxAllowedAgentGeneratedMessageDepth": 3, + "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, + "AttributionRejectConsumerMessages": false, + "AttributionRejectBeforeMServRequest": false, + "SmtpClientAuthenticationDisabled": true, + "JournalMessageExpirationDays": 0, + "ReplyAllStormProtectionEnabled": true, + "ReplyAllStormDetectionMinimumRecipients": 2500, + "ReplyAllStormDetectionMinimumReplies": 10, + "AllowLegacyTLSClients": null, + "ReplyAllStormBlockDurationHours": 6, + "MessageExpiration": "1.00:00:00", + "EnableExternalHTTPMailDelivery": false, + "CurrentTransportSystemState": "Green", + "OtherWellKnownObjects": [], + "AdminDisplayName": "", + "ExchangeVersion": "0.1 (8.0.535.0)", + "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "Transport Settings", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", + "ObjectClass": ["top", "container", "msExchTransportSettings"], + "WhenChanged": "/Date(1654713404000)/", + "WhenCreated": "/Date(1619484398000)/", + "WhenChangedUTC": "/Date(1654713404000)/", + "WhenCreatedUTC": "/Date(1619484398000)/", + "ExchangeObjectId": "7ef195bd-4f88-46bc-97e6-db6c7665321b", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "Transport Settings", + "Guid": "01d25010-40a8-4d0a-9419-fb1d775b4d16", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Unchanged" } -], - "sharing_policy": [ + ], + "sharing_policy": [ { - "Domains": [ - "Anonymous:0" - ], - "Enabled": false, - "Default": true, - "AdminDisplayName": "", - "ExchangeVersion": "0.10 (14.0.100.0)", - "Name": "Default Sharing Policy", - "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Identity": "Default Sharing Policy", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", - "ObjectClass": [ - "top", - "msExchSharingPolicy" - ], - "WhenChanged": "/Date(1691164284000)/", - "WhenCreated": "/Date(1619484547000)/", - "WhenChangedUTC": "/Date(1691164284000)/", - "WhenCreatedUTC": "/Date(1619484547000)/", - "ExchangeObjectId": "2d52a1ae-4c17-42e0-925e-919b2bf68a18", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Id": "Default Sharing Policy", - "Guid": "137df5c0-4fe4-49bb-923c-e2bdfd89f448", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "IsValid": true, - "ObjectState": "Changed" + "Domains": ["Anonymous:0"], + "Enabled": false, + "Default": true, + "AdminDisplayName": "", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Name": "Default Sharing Policy", + "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Identity": "Default Sharing Policy", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", + "ObjectClass": ["top", "msExchSharingPolicy"], + "WhenChanged": "/Date(1691164284000)/", + "WhenCreated": "/Date(1619484547000)/", + "WhenChangedUTC": "/Date(1691164284000)/", + "WhenCreatedUTC": "/Date(1619484547000)/", + "ExchangeObjectId": "2d52a1ae-4c17-42e0-925e-919b2bf68a18", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Id": "Default Sharing Policy", + "Guid": "137df5c0-4fe4-49bb-923c-e2bdfd89f448", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "IsValid": true, + "ObjectState": "Changed" } -], - "transport_rule": [ + ], + "transport_rule": [ { - "Priority": 0, - "DlpPolicy": null, - "DlpPolicyId": "00000000-0000-0000-0000-000000000000", - "Comments": null, - "CreatedBy": "Grant Brown - CTR", - "LastModifiedBy": "Addam Schroll", - "ManuallyModified": false, - "ActivationDate": null, - "ExpiryDate": null, - "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", - "RuleVersion": { - "Major": 14, - "Minor": 0, - "Build": 0, - "Revision": 0, - "MajorRevision": 0, - "MinorRevision": 0 - }, - "Size": 398, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" - ], - "Exceptions": null, - "Actions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" - ], - "State": "Disabled", - "Mode": "Enforce", - "IsRuleConfigurationSupported": true, - "RuleConfigurationUnsupportedReason": "", - "RuleErrorAction": "Ignore", - "SenderAddressLocation": "Header", - "RecipientAddressType": "Resolved", - "RuleSubType": "None", - "RegexSize": 0, - "UseLegacyRegex": false, - "From": null, - "FromMemberOf": null, - "FromScope": "NotInOrganization", - "SentTo": null, - "SentToMemberOf": null, - "SentToScope": null, - "BetweenMemberOf1": null, - "BetweenMemberOf2": null, - "ManagerAddresses": null, - "ManagerForEvaluatedUser": null, - "SenderManagementRelationship": null, - "ADComparisonAttribute": null, - "ADComparisonOperator": null, - "SenderADAttributeContainsWords": null, - "SenderADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "AnyOfToHeader": null, - "AnyOfToHeaderMemberOf": null, - "AnyOfCcHeader": null, - "AnyOfCcHeaderMemberOf": null, - "AnyOfToCcHeader": null, - "AnyOfToCcHeaderMemberOf": null, - "HasClassification": null, - "HasNoClassification": false, - "SubjectContainsWords": null, - "SubjectOrBodyContainsWords": null, - "HeaderContainsMessageHeader": null, - "HeaderContainsWords": null, - "FromAddressContainsWords": null, - "SenderDomainIs": null, - "RecipientDomainIs": null, - "SubjectMatchesPatterns": null, - "SubjectOrBodyMatchesPatterns": null, - "HeaderMatchesMessageHeader": null, - "HeaderMatchesPatterns": null, - "FromAddressMatchesPatterns": null, - "AttachmentNameMatchesPatterns": null, - "AttachmentExtensionMatchesWords": null, - "AttachmentPropertyContainsWords": null, - "ContentCharacterSetContainsWords": null, - "HasSenderOverride": false, - "MessageContainsDataClassifications": null, - "MessageContainsAllDataClassifications": null, - "SenderIpRanges": null, - "SCLOver": null, - "AttachmentSizeOver": null, - "MessageSizeOver": null, - "WithImportance": null, - "MessageTypeMatches": null, - "RecipientAddressContainsWords": null, - "RecipientAddressMatchesPatterns": null, - "SenderInRecipientList": null, - "RecipientInSenderList": null, - "AttachmentContainsWords": null, - "AttachmentMatchesPatterns": null, - "AttachmentIsUnsupported": false, - "AttachmentProcessingLimitExceeded": false, - "AttachmentHasExecutableContent": false, - "AttachmentIsPasswordProtected": false, - "AnyOfRecipientAddressContainsWords": null, - "AnyOfRecipientAddressMatchesPatterns": null, - "ExceptIfFrom": null, - "ExceptIfFromMemberOf": null, - "ExceptIfFromScope": null, - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfSentToScope": null, - "ExceptIfBetweenMemberOf1": null, - "ExceptIfBetweenMemberOf2": null, - "ExceptIfManagerAddresses": null, - "ExceptIfManagerForEvaluatedUser": null, - "ExceptIfSenderManagementRelationship": null, - "ExceptIfADComparisonAttribute": null, - "ExceptIfADComparisonOperator": null, - "ExceptIfSenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "ExceptIfAnyOfToHeader": null, - "ExceptIfAnyOfToHeaderMemberOf": null, - "ExceptIfAnyOfCcHeader": null, - "ExceptIfAnyOfCcHeaderMemberOf": null, - "ExceptIfAnyOfToCcHeader": null, - "ExceptIfAnyOfToCcHeaderMemberOf": null, - "ExceptIfHasClassification": null, - "ExceptIfHasNoClassification": false, - "ExceptIfSubjectContainsWords": null, - "ExceptIfSubjectOrBodyContainsWords": null, - "ExceptIfHeaderContainsMessageHeader": null, - "ExceptIfHeaderContainsWords": null, - "ExceptIfFromAddressContainsWords": null, - "ExceptIfSenderDomainIs": null, - "ExceptIfRecipientDomainIs": null, - "ExceptIfSubjectMatchesPatterns": null, - "ExceptIfSubjectOrBodyMatchesPatterns": null, - "ExceptIfHeaderMatchesMessageHeader": null, - "ExceptIfHeaderMatchesPatterns": null, - "ExceptIfFromAddressMatchesPatterns": null, - "ExceptIfAttachmentNameMatchesPatterns": null, - "ExceptIfAttachmentExtensionMatchesWords": null, - "ExceptIfAttachmentPropertyContainsWords": null, - "ExceptIfContentCharacterSetContainsWords": null, - "ExceptIfSCLOver": null, - "ExceptIfAttachmentSizeOver": null, - "ExceptIfMessageSizeOver": null, - "ExceptIfWithImportance": null, - "ExceptIfMessageTypeMatches": null, - "ExceptIfRecipientAddressContainsWords": null, - "ExceptIfRecipientAddressMatchesPatterns": null, - "ExceptIfSenderInRecipientList": null, - "ExceptIfRecipientInSenderList": null, - "ExceptIfAttachmentContainsWords": null, - "ExceptIfAttachmentMatchesPatterns": null, - "ExceptIfAttachmentIsUnsupported": false, - "ExceptIfAttachmentProcessingLimitExceeded": false, - "ExceptIfAttachmentHasExecutableContent": false, - "ExceptIfAttachmentIsPasswordProtected": false, - "ExceptIfAnyOfRecipientAddressContainsWords": null, - "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, - "ExceptIfHasSenderOverride": false, - "ExceptIfMessageContainsDataClassifications": null, - "ExceptIfMessageContainsAllDataClassifications": null, - "ExceptIfSenderIpRanges": null, - "PrependSubject": "[External]", - "SetAuditSeverity": null, - "ApplyClassification": null, - "ApplyHtmlDisclaimerLocation": null, - "ApplyHtmlDisclaimerText": null, - "ApplyHtmlDisclaimerFallbackAction": null, - "ApplyRightsProtectionTemplate": null, - "ApplyRightsProtectionCustomizationTemplate": null, - "SetSCL": null, - "SetHeaderName": null, - "SetHeaderValue": null, - "RemoveHeader": null, - "AddToRecipients": null, - "CopyTo": null, - "BlindCopyTo": null, - "AddManagerAsRecipientType": null, - "ModerateMessageByUser": null, - "ModerateMessageByManager": false, - "RedirectMessageTo": null, - "RejectMessageEnhancedStatusCode": null, - "RejectMessageReasonText": null, - "DeleteMessage": false, - "Disconnect": false, - "Quarantine": false, - "SmtpRejectMessageRejectText": null, - "SmtpRejectMessageRejectStatusCode": null, - "LogEventText": null, - "StopRuleProcessing": false, - "SenderNotificationType": null, - "GenerateIncidentReport": null, - "IncidentReportContent": null, - "RouteMessageOutboundConnector": null, - "RouteMessageOutboundRequireTls": false, - "ApplyOME": false, - "RemoveOME": false, - "RemoveOMEv2": false, - "RemoveRMSAttachmentEncryption": false, - "GenerateNotification": null, - "Identity": "Sender is located outside the organization prepend '[External]'", - "DistinguishedName": "CN=Sender is located outside the organization prepend '[External]',CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", - "ImmutableId": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "Sender is located outside the organization prepend '[External]'", - "IsValid": true, - "WhenChanged": "/Date(1675365355000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "Priority": 0, + "DlpPolicy": null, + "DlpPolicyId": "00000000-0000-0000-0000-000000000000", + "Comments": null, + "CreatedBy": "Grant Brown - CTR", + "LastModifiedBy": "Addam Schroll", + "ManuallyModified": false, + "ActivationDate": null, + "ExpiryDate": null, + "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", + "RuleVersion": { + "Major": 14, + "Minor": 0, + "Build": 0, + "Revision": 0, + "MajorRevision": 0, + "MinorRevision": 0 + }, + "Size": 398, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" + ], + "Exceptions": null, + "Actions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" + ], + "State": "Disabled", + "Mode": "Enforce", + "IsRuleConfigurationSupported": true, + "RuleConfigurationUnsupportedReason": "", + "RuleErrorAction": "Ignore", + "SenderAddressLocation": "Header", + "RecipientAddressType": "Resolved", + "RuleSubType": "None", + "RegexSize": 0, + "UseLegacyRegex": false, + "From": null, + "FromMemberOf": null, + "FromScope": "NotInOrganization", + "SentTo": null, + "SentToMemberOf": null, + "SentToScope": null, + "BetweenMemberOf1": null, + "BetweenMemberOf2": null, + "ManagerAddresses": null, + "ManagerForEvaluatedUser": null, + "SenderManagementRelationship": null, + "ADComparisonAttribute": null, + "ADComparisonOperator": null, + "SenderADAttributeContainsWords": null, + "SenderADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "AnyOfToHeader": null, + "AnyOfToHeaderMemberOf": null, + "AnyOfCcHeader": null, + "AnyOfCcHeaderMemberOf": null, + "AnyOfToCcHeader": null, + "AnyOfToCcHeaderMemberOf": null, + "HasClassification": null, + "HasNoClassification": false, + "SubjectContainsWords": null, + "SubjectOrBodyContainsWords": null, + "HeaderContainsMessageHeader": null, + "HeaderContainsWords": null, + "FromAddressContainsWords": null, + "SenderDomainIs": null, + "RecipientDomainIs": null, + "SubjectMatchesPatterns": null, + "SubjectOrBodyMatchesPatterns": null, + "HeaderMatchesMessageHeader": null, + "HeaderMatchesPatterns": null, + "FromAddressMatchesPatterns": null, + "AttachmentNameMatchesPatterns": null, + "AttachmentExtensionMatchesWords": null, + "AttachmentPropertyContainsWords": null, + "ContentCharacterSetContainsWords": null, + "HasSenderOverride": false, + "MessageContainsDataClassifications": null, + "MessageContainsAllDataClassifications": null, + "SenderIpRanges": null, + "SCLOver": null, + "AttachmentSizeOver": null, + "MessageSizeOver": null, + "WithImportance": null, + "MessageTypeMatches": null, + "RecipientAddressContainsWords": null, + "RecipientAddressMatchesPatterns": null, + "SenderInRecipientList": null, + "RecipientInSenderList": null, + "AttachmentContainsWords": null, + "AttachmentMatchesPatterns": null, + "AttachmentIsUnsupported": false, + "AttachmentProcessingLimitExceeded": false, + "AttachmentHasExecutableContent": false, + "AttachmentIsPasswordProtected": false, + "AnyOfRecipientAddressContainsWords": null, + "AnyOfRecipientAddressMatchesPatterns": null, + "ExceptIfFrom": null, + "ExceptIfFromMemberOf": null, + "ExceptIfFromScope": null, + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfSentToScope": null, + "ExceptIfBetweenMemberOf1": null, + "ExceptIfBetweenMemberOf2": null, + "ExceptIfManagerAddresses": null, + "ExceptIfManagerForEvaluatedUser": null, + "ExceptIfSenderManagementRelationship": null, + "ExceptIfADComparisonAttribute": null, + "ExceptIfADComparisonOperator": null, + "ExceptIfSenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "ExceptIfAnyOfToHeader": null, + "ExceptIfAnyOfToHeaderMemberOf": null, + "ExceptIfAnyOfCcHeader": null, + "ExceptIfAnyOfCcHeaderMemberOf": null, + "ExceptIfAnyOfToCcHeader": null, + "ExceptIfAnyOfToCcHeaderMemberOf": null, + "ExceptIfHasClassification": null, + "ExceptIfHasNoClassification": false, + "ExceptIfSubjectContainsWords": null, + "ExceptIfSubjectOrBodyContainsWords": null, + "ExceptIfHeaderContainsMessageHeader": null, + "ExceptIfHeaderContainsWords": null, + "ExceptIfFromAddressContainsWords": null, + "ExceptIfSenderDomainIs": null, + "ExceptIfRecipientDomainIs": null, + "ExceptIfSubjectMatchesPatterns": null, + "ExceptIfSubjectOrBodyMatchesPatterns": null, + "ExceptIfHeaderMatchesMessageHeader": null, + "ExceptIfHeaderMatchesPatterns": null, + "ExceptIfFromAddressMatchesPatterns": null, + "ExceptIfAttachmentNameMatchesPatterns": null, + "ExceptIfAttachmentExtensionMatchesWords": null, + "ExceptIfAttachmentPropertyContainsWords": null, + "ExceptIfContentCharacterSetContainsWords": null, + "ExceptIfSCLOver": null, + "ExceptIfAttachmentSizeOver": null, + "ExceptIfMessageSizeOver": null, + "ExceptIfWithImportance": null, + "ExceptIfMessageTypeMatches": null, + "ExceptIfRecipientAddressContainsWords": null, + "ExceptIfRecipientAddressMatchesPatterns": null, + "ExceptIfSenderInRecipientList": null, + "ExceptIfRecipientInSenderList": null, + "ExceptIfAttachmentContainsWords": null, + "ExceptIfAttachmentMatchesPatterns": null, + "ExceptIfAttachmentIsUnsupported": false, + "ExceptIfAttachmentProcessingLimitExceeded": false, + "ExceptIfAttachmentHasExecutableContent": false, + "ExceptIfAttachmentIsPasswordProtected": false, + "ExceptIfAnyOfRecipientAddressContainsWords": null, + "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, + "ExceptIfHasSenderOverride": false, + "ExceptIfMessageContainsDataClassifications": null, + "ExceptIfMessageContainsAllDataClassifications": null, + "ExceptIfSenderIpRanges": null, + "PrependSubject": "[External]", + "SetAuditSeverity": null, + "ApplyClassification": null, + "ApplyHtmlDisclaimerLocation": null, + "ApplyHtmlDisclaimerText": null, + "ApplyHtmlDisclaimerFallbackAction": null, + "ApplyRightsProtectionTemplate": null, + "ApplyRightsProtectionCustomizationTemplate": null, + "SetSCL": null, + "SetHeaderName": null, + "SetHeaderValue": null, + "RemoveHeader": null, + "AddToRecipients": null, + "CopyTo": null, + "BlindCopyTo": null, + "AddManagerAsRecipientType": null, + "ModerateMessageByUser": null, + "ModerateMessageByManager": false, + "RedirectMessageTo": null, + "RejectMessageEnhancedStatusCode": null, + "RejectMessageReasonText": null, + "DeleteMessage": false, + "Disconnect": false, + "Quarantine": false, + "SmtpRejectMessageRejectText": null, + "SmtpRejectMessageRejectStatusCode": null, + "LogEventText": null, + "StopRuleProcessing": false, + "SenderNotificationType": null, + "GenerateIncidentReport": null, + "IncidentReportContent": null, + "RouteMessageOutboundConnector": null, + "RouteMessageOutboundRequireTls": false, + "ApplyOME": false, + "RemoveOME": false, + "RemoveOMEv2": false, + "RemoveRMSAttachmentEncryption": false, + "GenerateNotification": null, + "Identity": "Sender is located outside the organization prepend '[External]'", + "DistinguishedName": "CN=Sender is located outside the organization prepend '[External]',CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", + "ImmutableId": "d60d0c37-4f9d-4bcb-8b5e-2c91edfd4cbb", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "Sender is located outside the organization prepend '[External]'", + "IsValid": true, + "WhenChanged": "/Date(1675365355000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" }, { - "Priority": 1, - "DlpPolicy": null, - "DlpPolicyId": "00000000-0000-0000-0000-000000000000", - "Comments": null, - "CreatedBy": "Addam Schroll", - "LastModifiedBy": "Addam Schroll", - "ManuallyModified": false, - "ActivationDate": null, - "ExpiryDate": null, - "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", - "RuleVersion": { - "Major": 14, - "Minor": 0, - "Build": 0, - "Revision": 0, - "MajorRevision": 0, - "MinorRevision": 0 - }, - "Size": 327, - "Conditions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" - ], - "Exceptions": null, - "Actions": [ - "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" - ], - "State": "Enabled", - "Mode": "Enforce", - "IsRuleConfigurationSupported": true, - "RuleConfigurationUnsupportedReason": "", - "RuleErrorAction": "Ignore", - "SenderAddressLocation": "Header", - "RecipientAddressType": "Resolved", - "RuleSubType": "None", - "RegexSize": 0, - "UseLegacyRegex": false, - "From": null, - "FromMemberOf": null, - "FromScope": "NotInOrganization", - "SentTo": null, - "SentToMemberOf": null, - "SentToScope": null, - "BetweenMemberOf1": null, - "BetweenMemberOf2": null, - "ManagerAddresses": null, - "ManagerForEvaluatedUser": null, - "SenderManagementRelationship": null, - "ADComparisonAttribute": null, - "ADComparisonOperator": null, - "SenderADAttributeContainsWords": null, - "SenderADAttributeMatchesPatterns": null, - "RecipientADAttributeContainsWords": null, - "RecipientADAttributeMatchesPatterns": null, - "AnyOfToHeader": null, - "AnyOfToHeaderMemberOf": null, - "AnyOfCcHeader": null, - "AnyOfCcHeaderMemberOf": null, - "AnyOfToCcHeader": null, - "AnyOfToCcHeaderMemberOf": null, - "HasClassification": null, - "HasNoClassification": false, - "SubjectContainsWords": null, - "SubjectOrBodyContainsWords": null, - "HeaderContainsMessageHeader": null, - "HeaderContainsWords": null, - "FromAddressContainsWords": null, - "SenderDomainIs": null, - "RecipientDomainIs": null, - "SubjectMatchesPatterns": null, - "SubjectOrBodyMatchesPatterns": null, - "HeaderMatchesMessageHeader": null, - "HeaderMatchesPatterns": null, - "FromAddressMatchesPatterns": null, - "AttachmentNameMatchesPatterns": null, - "AttachmentExtensionMatchesWords": null, - "AttachmentPropertyContainsWords": null, - "ContentCharacterSetContainsWords": null, - "HasSenderOverride": false, - "MessageContainsDataClassifications": null, - "MessageContainsAllDataClassifications": null, - "SenderIpRanges": null, - "SCLOver": null, - "AttachmentSizeOver": null, - "MessageSizeOver": null, - "WithImportance": null, - "MessageTypeMatches": null, - "RecipientAddressContainsWords": null, - "RecipientAddressMatchesPatterns": null, - "SenderInRecipientList": null, - "RecipientInSenderList": null, - "AttachmentContainsWords": null, - "AttachmentMatchesPatterns": null, - "AttachmentIsUnsupported": false, - "AttachmentProcessingLimitExceeded": false, - "AttachmentHasExecutableContent": false, - "AttachmentIsPasswordProtected": false, - "AnyOfRecipientAddressContainsWords": null, - "AnyOfRecipientAddressMatchesPatterns": null, - "ExceptIfFrom": null, - "ExceptIfFromMemberOf": null, - "ExceptIfFromScope": null, - "ExceptIfSentTo": null, - "ExceptIfSentToMemberOf": null, - "ExceptIfSentToScope": null, - "ExceptIfBetweenMemberOf1": null, - "ExceptIfBetweenMemberOf2": null, - "ExceptIfManagerAddresses": null, - "ExceptIfManagerForEvaluatedUser": null, - "ExceptIfSenderManagementRelationship": null, - "ExceptIfADComparisonAttribute": null, - "ExceptIfADComparisonOperator": null, - "ExceptIfSenderADAttributeContainsWords": null, - "ExceptIfSenderADAttributeMatchesPatterns": null, - "ExceptIfRecipientADAttributeContainsWords": null, - "ExceptIfRecipientADAttributeMatchesPatterns": null, - "ExceptIfAnyOfToHeader": null, - "ExceptIfAnyOfToHeaderMemberOf": null, - "ExceptIfAnyOfCcHeader": null, - "ExceptIfAnyOfCcHeaderMemberOf": null, - "ExceptIfAnyOfToCcHeader": null, - "ExceptIfAnyOfToCcHeaderMemberOf": null, - "ExceptIfHasClassification": null, - "ExceptIfHasNoClassification": false, - "ExceptIfSubjectContainsWords": null, - "ExceptIfSubjectOrBodyContainsWords": null, - "ExceptIfHeaderContainsMessageHeader": null, - "ExceptIfHeaderContainsWords": null, - "ExceptIfFromAddressContainsWords": null, - "ExceptIfSenderDomainIs": null, - "ExceptIfRecipientDomainIs": null, - "ExceptIfSubjectMatchesPatterns": null, - "ExceptIfSubjectOrBodyMatchesPatterns": null, - "ExceptIfHeaderMatchesMessageHeader": null, - "ExceptIfHeaderMatchesPatterns": null, - "ExceptIfFromAddressMatchesPatterns": null, - "ExceptIfAttachmentNameMatchesPatterns": null, - "ExceptIfAttachmentExtensionMatchesWords": null, - "ExceptIfAttachmentPropertyContainsWords": null, - "ExceptIfContentCharacterSetContainsWords": null, - "ExceptIfSCLOver": null, - "ExceptIfAttachmentSizeOver": null, - "ExceptIfMessageSizeOver": null, - "ExceptIfWithImportance": null, - "ExceptIfMessageTypeMatches": null, - "ExceptIfRecipientAddressContainsWords": null, - "ExceptIfRecipientAddressMatchesPatterns": null, - "ExceptIfSenderInRecipientList": null, - "ExceptIfRecipientInSenderList": null, - "ExceptIfAttachmentContainsWords": null, - "ExceptIfAttachmentMatchesPatterns": null, - "ExceptIfAttachmentIsUnsupported": false, - "ExceptIfAttachmentProcessingLimitExceeded": false, - "ExceptIfAttachmentHasExecutableContent": false, - "ExceptIfAttachmentIsPasswordProtected": false, - "ExceptIfAnyOfRecipientAddressContainsWords": null, - "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, - "ExceptIfHasSenderOverride": false, - "ExceptIfMessageContainsDataClassifications": null, - "ExceptIfMessageContainsAllDataClassifications": null, - "ExceptIfSenderIpRanges": null, - "PrependSubject": "[External]", - "SetAuditSeverity": null, - "ApplyClassification": null, - "ApplyHtmlDisclaimerLocation": null, - "ApplyHtmlDisclaimerText": null, - "ApplyHtmlDisclaimerFallbackAction": null, - "ApplyRightsProtectionTemplate": null, - "ApplyRightsProtectionCustomizationTemplate": null, - "SetSCL": null, - "SetHeaderName": null, - "SetHeaderValue": null, - "RemoveHeader": null, - "AddToRecipients": null, - "CopyTo": null, - "BlindCopyTo": null, - "AddManagerAsRecipientType": null, - "ModerateMessageByUser": null, - "ModerateMessageByManager": false, - "RedirectMessageTo": null, - "RejectMessageEnhancedStatusCode": null, - "RejectMessageReasonText": null, - "DeleteMessage": false, - "Disconnect": false, - "Quarantine": false, - "SmtpRejectMessageRejectText": null, - "SmtpRejectMessageRejectStatusCode": null, - "LogEventText": null, - "StopRuleProcessing": false, - "SenderNotificationType": null, - "GenerateIncidentReport": null, - "IncidentReportContent": null, - "RouteMessageOutboundConnector": null, - "RouteMessageOutboundRequireTls": false, - "ApplyOME": false, - "RemoveOME": false, - "RemoveOMEv2": false, - "RemoveRMSAttachmentEncryption": false, - "GenerateNotification": null, - "Identity": "ALS Sender Warning", - "DistinguishedName": "CN=ALS Sender Warning,CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "Guid": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", - "ImmutableId": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Name": "ALS Sender Warning", - "IsValid": true, - "WhenChanged": "/Date(1691002182000)/", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ObjectState": "Unchanged" + "Priority": 1, + "DlpPolicy": null, + "DlpPolicyId": "00000000-0000-0000-0000-000000000000", + "Comments": null, + "CreatedBy": "Addam Schroll", + "LastModifiedBy": "Addam Schroll", + "ManuallyModified": false, + "ActivationDate": null, + "ExpiryDate": null, + "Description": "If the message:rntIs received from u0027Outside the organizationu0027rnTake the following actions:rntPrepend the subject with u0027[External]u0027rn", + "RuleVersion": { + "Major": 14, + "Minor": 0, + "Build": 0, + "Revision": 0, + "MajorRevision": 0, + "MinorRevision": 0 + }, + "Size": 327, + "Conditions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate" + ], + "Exceptions": null, + "Actions": [ + "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.PrependSubjectAction" + ], + "State": "Enabled", + "Mode": "Enforce", + "IsRuleConfigurationSupported": true, + "RuleConfigurationUnsupportedReason": "", + "RuleErrorAction": "Ignore", + "SenderAddressLocation": "Header", + "RecipientAddressType": "Resolved", + "RuleSubType": "None", + "RegexSize": 0, + "UseLegacyRegex": false, + "From": null, + "FromMemberOf": null, + "FromScope": "NotInOrganization", + "SentTo": null, + "SentToMemberOf": null, + "SentToScope": null, + "BetweenMemberOf1": null, + "BetweenMemberOf2": null, + "ManagerAddresses": null, + "ManagerForEvaluatedUser": null, + "SenderManagementRelationship": null, + "ADComparisonAttribute": null, + "ADComparisonOperator": null, + "SenderADAttributeContainsWords": null, + "SenderADAttributeMatchesPatterns": null, + "RecipientADAttributeContainsWords": null, + "RecipientADAttributeMatchesPatterns": null, + "AnyOfToHeader": null, + "AnyOfToHeaderMemberOf": null, + "AnyOfCcHeader": null, + "AnyOfCcHeaderMemberOf": null, + "AnyOfToCcHeader": null, + "AnyOfToCcHeaderMemberOf": null, + "HasClassification": null, + "HasNoClassification": false, + "SubjectContainsWords": null, + "SubjectOrBodyContainsWords": null, + "HeaderContainsMessageHeader": null, + "HeaderContainsWords": null, + "FromAddressContainsWords": null, + "SenderDomainIs": null, + "RecipientDomainIs": null, + "SubjectMatchesPatterns": null, + "SubjectOrBodyMatchesPatterns": null, + "HeaderMatchesMessageHeader": null, + "HeaderMatchesPatterns": null, + "FromAddressMatchesPatterns": null, + "AttachmentNameMatchesPatterns": null, + "AttachmentExtensionMatchesWords": null, + "AttachmentPropertyContainsWords": null, + "ContentCharacterSetContainsWords": null, + "HasSenderOverride": false, + "MessageContainsDataClassifications": null, + "MessageContainsAllDataClassifications": null, + "SenderIpRanges": null, + "SCLOver": null, + "AttachmentSizeOver": null, + "MessageSizeOver": null, + "WithImportance": null, + "MessageTypeMatches": null, + "RecipientAddressContainsWords": null, + "RecipientAddressMatchesPatterns": null, + "SenderInRecipientList": null, + "RecipientInSenderList": null, + "AttachmentContainsWords": null, + "AttachmentMatchesPatterns": null, + "AttachmentIsUnsupported": false, + "AttachmentProcessingLimitExceeded": false, + "AttachmentHasExecutableContent": false, + "AttachmentIsPasswordProtected": false, + "AnyOfRecipientAddressContainsWords": null, + "AnyOfRecipientAddressMatchesPatterns": null, + "ExceptIfFrom": null, + "ExceptIfFromMemberOf": null, + "ExceptIfFromScope": null, + "ExceptIfSentTo": null, + "ExceptIfSentToMemberOf": null, + "ExceptIfSentToScope": null, + "ExceptIfBetweenMemberOf1": null, + "ExceptIfBetweenMemberOf2": null, + "ExceptIfManagerAddresses": null, + "ExceptIfManagerForEvaluatedUser": null, + "ExceptIfSenderManagementRelationship": null, + "ExceptIfADComparisonAttribute": null, + "ExceptIfADComparisonOperator": null, + "ExceptIfSenderADAttributeContainsWords": null, + "ExceptIfSenderADAttributeMatchesPatterns": null, + "ExceptIfRecipientADAttributeContainsWords": null, + "ExceptIfRecipientADAttributeMatchesPatterns": null, + "ExceptIfAnyOfToHeader": null, + "ExceptIfAnyOfToHeaderMemberOf": null, + "ExceptIfAnyOfCcHeader": null, + "ExceptIfAnyOfCcHeaderMemberOf": null, + "ExceptIfAnyOfToCcHeader": null, + "ExceptIfAnyOfToCcHeaderMemberOf": null, + "ExceptIfHasClassification": null, + "ExceptIfHasNoClassification": false, + "ExceptIfSubjectContainsWords": null, + "ExceptIfSubjectOrBodyContainsWords": null, + "ExceptIfHeaderContainsMessageHeader": null, + "ExceptIfHeaderContainsWords": null, + "ExceptIfFromAddressContainsWords": null, + "ExceptIfSenderDomainIs": null, + "ExceptIfRecipientDomainIs": null, + "ExceptIfSubjectMatchesPatterns": null, + "ExceptIfSubjectOrBodyMatchesPatterns": null, + "ExceptIfHeaderMatchesMessageHeader": null, + "ExceptIfHeaderMatchesPatterns": null, + "ExceptIfFromAddressMatchesPatterns": null, + "ExceptIfAttachmentNameMatchesPatterns": null, + "ExceptIfAttachmentExtensionMatchesWords": null, + "ExceptIfAttachmentPropertyContainsWords": null, + "ExceptIfContentCharacterSetContainsWords": null, + "ExceptIfSCLOver": null, + "ExceptIfAttachmentSizeOver": null, + "ExceptIfMessageSizeOver": null, + "ExceptIfWithImportance": null, + "ExceptIfMessageTypeMatches": null, + "ExceptIfRecipientAddressContainsWords": null, + "ExceptIfRecipientAddressMatchesPatterns": null, + "ExceptIfSenderInRecipientList": null, + "ExceptIfRecipientInSenderList": null, + "ExceptIfAttachmentContainsWords": null, + "ExceptIfAttachmentMatchesPatterns": null, + "ExceptIfAttachmentIsUnsupported": false, + "ExceptIfAttachmentProcessingLimitExceeded": false, + "ExceptIfAttachmentHasExecutableContent": false, + "ExceptIfAttachmentIsPasswordProtected": false, + "ExceptIfAnyOfRecipientAddressContainsWords": null, + "ExceptIfAnyOfRecipientAddressMatchesPatterns": null, + "ExceptIfHasSenderOverride": false, + "ExceptIfMessageContainsDataClassifications": null, + "ExceptIfMessageContainsAllDataClassifications": null, + "ExceptIfSenderIpRanges": null, + "PrependSubject": "[External]", + "SetAuditSeverity": null, + "ApplyClassification": null, + "ApplyHtmlDisclaimerLocation": null, + "ApplyHtmlDisclaimerText": null, + "ApplyHtmlDisclaimerFallbackAction": null, + "ApplyRightsProtectionTemplate": null, + "ApplyRightsProtectionCustomizationTemplate": null, + "SetSCL": null, + "SetHeaderName": null, + "SetHeaderValue": null, + "RemoveHeader": null, + "AddToRecipients": null, + "CopyTo": null, + "BlindCopyTo": null, + "AddManagerAsRecipientType": null, + "ModerateMessageByUser": null, + "ModerateMessageByManager": false, + "RedirectMessageTo": null, + "RejectMessageEnhancedStatusCode": null, + "RejectMessageReasonText": null, + "DeleteMessage": false, + "Disconnect": false, + "Quarantine": false, + "SmtpRejectMessageRejectText": null, + "SmtpRejectMessageRejectStatusCode": null, + "LogEventText": null, + "StopRuleProcessing": false, + "SenderNotificationType": null, + "GenerateIncidentReport": null, + "IncidentReportContent": null, + "RouteMessageOutboundConnector": null, + "RouteMessageOutboundRequireTls": false, + "ApplyOME": false, + "RemoveOME": false, + "RemoveOMEv2": false, + "RemoveRMSAttachmentEncryption": false, + "GenerateNotification": null, + "Identity": "ALS Sender Warning", + "DistinguishedName": "CN=ALS Sender Warning,CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "Guid": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", + "ImmutableId": "dbc63ee9-ad16-4faf-81c9-55ae2881e3ed", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Name": "ALS Sender Warning", + "IsValid": true, + "WhenChanged": "/Date(1691002182000)/", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ObjectState": "Unchanged" } -], - "conn_filter": [ + ], + "conn_filter": [ { - "AdminDisplayName": "", - "IsDefault": true, - "IPAllowList": [ - - ], - "IPBlockList": [ - - ], - "EnableSafeList": false, - "DirectoryBasedEdgeBlockMode": "Default", - "Identity": "Default", - "Id": "Default", - "IsValid": true, - "ExchangeVersion": "0.20 (15.0.0.0)", - "Name": "Default", - "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", - "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", - "ObjectClass": [ - "top", - "msExchHostedConnectionFilterPolicy" - ], - "WhenChanged": "/Date(1619484593000)/", - "WhenCreated": "/Date(1619484586000)/", - "WhenChangedUTC": "/Date(1619484593000)/", - "WhenCreatedUTC": "/Date(1619484586000)/", - "ExchangeObjectId": "7021b7cf-b9fa-4280-94ff-fba468dbb0ab", - "OrganizationalUnitRoot": "agency.onmicrosoft.com", - "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", - "Guid": "ddb99cb3-211b-47ee-bc9c-86e6c8d0e692", - "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", - "ObjectState": "Unchanged" + "AdminDisplayName": "", + "IsDefault": true, + "IPAllowList": [], + "IPBlockList": [], + "EnableSafeList": false, + "DirectoryBasedEdgeBlockMode": "Default", + "Identity": "Default", + "Id": "Default", + "IsValid": true, + "ExchangeVersion": "0.20 (15.0.0.0)", + "Name": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=agency.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR09A006,DC=PROD,DC=OUTLOOK,DC=COM", + "ObjectCategory": "NAMPR09A006.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", + "ObjectClass": ["top", "msExchHostedConnectionFilterPolicy"], + "WhenChanged": "/Date(1619484593000)/", + "WhenCreated": "/Date(1619484586000)/", + "WhenChangedUTC": "/Date(1619484593000)/", + "WhenCreatedUTC": "/Date(1619484586000)/", + "ExchangeObjectId": "7021b7cf-b9fa-4280-94ff-fba468dbb0ab", + "OrganizationalUnitRoot": "agency.onmicrosoft.com", + "OrganizationId": "NAMPR09A006.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/agency.onmicrosoft.com - NAMPR09A006.PROD.OUTLOOK.COM/ConfigurationUnits/agency.onmicrosoft.com/Configuration", + "Guid": "ddb99cb3-211b-47ee-bc9c-86e6c8d0e692", + "OriginatingServer": "MWHPR09A006DC07.NAMPR09A006.PROD.OUTLOOK.COM", + "ObjectState": "Unchanged" } -], - "org_config": [ + ], + "org_config": [ { - "Name": "agency.onmicrosoft.com", - "DisplayName": "Cybersecurity and Infrastructure Security Agency", - "AuditDisabled": false + "Name": "agency.onmicrosoft.com", + "DisplayName": "Cybersecurity and Infrastructure Security Agency", + "AuditDisabled": false } -], - "exo_successful_commands": [ + ], + "exo_successful_commands": [ "Get-RemoteDomain", "Get-AcceptedDomain", "Get-ScubaSpfRecords", @@ -20297,2188 +17029,2152 @@ "Get-TransportRule", "Get-HostedConnectionFilterPolicy", "Get-OrganizationConfig" -], - "exo_unsuccessful_commands": [ - -], "tenant_id": "3c19c757-3b55-411f-b03f-2bcc514a598d", - "environment_creation": [ + ], + "exo_unsuccessful_commands": [], + "tenant_id": "3c19c757-3b55-411f-b03f-2bcc514a598d", + "environment_creation": [ { - "walkMeOptOut": false, - "disableNPSCommentsReachout": false, - "disableNewsletterSendout": false, - "disableEnvironmentCreationByNonAdminUsers": true, - "disablePortalsCreationByNonAdminUsers": true, - "disableSurveyFeedback": false, - "disableTrialEnvironmentCreationByNonAdminUsers": true, - "disableCapacityAllocationByEnvironmentAdmins": false, - "disableSupportTicketsVisibleByAllUsers": false, - "powerPlatform": { - "search": "@{disableDocsSearch=True; disableCommunitySearch=False; disableBingVideoSearch=False}", - "teamsIntegration": "@{shareWithColleaguesUserLimit=10000}", - "powerApps": "@{disableShareWithEveryone=False; enableGuestsToMake=False; disableMembersIndicator=False; disableMakerMatch=False; disableUnusedLicenseAssignment=False; disableCreateFromImage=False; disableCreateFromFigma=False}", - "powerAutomate": "@{disableCopilot=False}", - "environments": "@{disablePreferredDataLocationForTeamsEnvironment=False}", - "governance": "@{disableAdminDigest=False; disableDeveloperEnvironmentCreationByNonAdminUsers=False; enableDefaultEnvironmentRouting=False; policy=}", - "licensing": "@{disableBillingPolicyCreationByNonAdminUsers=False; enableTenantCapacityReportForEnvironmentAdmins=False; storageCapacityConsumptionWarningThreshold=85; enableTenantLicensingReportForEnvironmentAdmins=False}", - "powerPages": "", - "champions": "@{disableChampionsInvitationReachout=False; disableSkillsMatchInvitationReachout=False}", - "intelligence": "@{disableCopilot=False; enableOpenAiBotPublishing=True}", - "modelExperimentation": "@{enableModelDataSharing=False; disableDataLogging=False}", - "catalogSettings": "@{powerCatalogAudienceSetting=All}" - } + "walkMeOptOut": false, + "disableNPSCommentsReachout": false, + "disableNewsletterSendout": false, + "disableEnvironmentCreationByNonAdminUsers": true, + "disablePortalsCreationByNonAdminUsers": true, + "disableSurveyFeedback": false, + "disableTrialEnvironmentCreationByNonAdminUsers": true, + "disableCapacityAllocationByEnvironmentAdmins": false, + "disableSupportTicketsVisibleByAllUsers": false, + "powerPlatform": { + "search": "@{disableDocsSearch=True; disableCommunitySearch=False; disableBingVideoSearch=False}", + "teamsIntegration": "@{shareWithColleaguesUserLimit=10000}", + "powerApps": "@{disableShareWithEveryone=False; enableGuestsToMake=False; disableMembersIndicator=False; disableMakerMatch=False; disableUnusedLicenseAssignment=False; disableCreateFromImage=False; disableCreateFromFigma=False}", + "powerAutomate": "@{disableCopilot=False}", + "environments": "@{disablePreferredDataLocationForTeamsEnvironment=False}", + "governance": "@{disableAdminDigest=False; disableDeveloperEnvironmentCreationByNonAdminUsers=False; enableDefaultEnvironmentRouting=False; policy=}", + "licensing": "@{disableBillingPolicyCreationByNonAdminUsers=False; enableTenantCapacityReportForEnvironmentAdmins=False; storageCapacityConsumptionWarningThreshold=85; enableTenantLicensingReportForEnvironmentAdmins=False}", + "powerPages": "", + "champions": "@{disableChampionsInvitationReachout=False; disableSkillsMatchInvitationReachout=False}", + "intelligence": "@{disableCopilot=False; enableOpenAiBotPublishing=True}", + "modelExperimentation": "@{enableModelDataSharing=False; disableDataLogging=False}", + "catalogSettings": "@{powerCatalogAudienceSetting=All}" + } } -], - "dlp_policies": [ + ], + "dlp_policies": [ { - "value": [ - { - "name": "981a935c-8c66-4d97-a1f6-b3c314ee07ef", - "displayName": "DefaultEnvironmentPolicy", - "defaultConnectorsClassification": "General", - "connectorGroups": [ - { - "classification": "Confidential", - "connectors": [ - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sharepointonline", - "name": "SharePoint", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_onedriveforbusiness", - "name": "OneDrive for Business", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_approvals", - "name": "Approvals", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_arcgis", - "name": "ArcGIS", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_arcgispaas", - "name": "ArcGIS PaaS", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_commondataservice", - "name": "Microsoft Dataverse (legacy)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps", - "name": "Microsoft Dataverse", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_excelonlinebusiness", - "name": "Excel Online (Business)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftformspro", - "name": "Dynamics 365 Customer Voice", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_office365", - "name": "Office 365 Outlook", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_office365groups", - "name": "Office 365 Groups", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_office365users", - "name": "Office 365 Users", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_onenote", - "name": "OneNote (Business)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_planner", - "name": "Planner", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotification", - "name": "Power Apps Notification", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerbi", - "name": "Power BI", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_shifts", - "name": "Shifts for Microsoft Teams", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_teams", - "name": "Microsoft Teams", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_todo", - "name": "Microsoft To-Do (Business)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_yammer", - "name": "Yammer", - "type": "Microsoft.PowerApps/apis" - } - ] - }, - { - "classification": "General", - "connectors": [ - - ] - }, - { - "classification": "Blocked", - "connectors": [ - { - "id": "/providers/Microsoft.PowerApps/apis/shared_salesforce", - "name": "Salesforce", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_onedrive", - "name": "OneDrive", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sql", - "name": "SQL Server", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_dropbox", - "name": "Dropbox", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_aci", - "name": "Azure Container Instance", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_adobepdftools", - "name": "Adobe PDF Services", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_adobesign", - "name": "Adobe Sign", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_applicationinsights", - "name": "Azure Application Insights", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_arm", - "name": "Azure Resource Manager", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_asiteusgov", - "name": "Asite (US Gov.)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_avepointcloudgovernance", - "name": "AvePoint Cloud Governance", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azuread", - "name": "Azure AD", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureappservice", - "name": "Azure App Service", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureautomation", - "name": "Azure Automation", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureblob", - "name": "Azure Blob Storage", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azuredatafactory", - "name": "Azure Data Factory", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgrid", - "name": "Azure Event Grid", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgridpublish", - "name": "Azure Event Grid Publish", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azurefile", - "name": "Azure File Storage", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azureloganalyticsdatacollector", - "name": "Azure Log Analytics Data Collector", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azurequeues", - "name": "Azure Queues", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azuretables", - "name": "Azure Table Storage", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_azurevm", - "name": "Azure VM", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_bingmaps", - "name": "Bing Maps", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_bingsearch", - "name": "Bing Search", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_bitly", - "name": "Bitly", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_bizzy", - "name": "AtBot Logic", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_blockchaincorda", - "name": "Corda Blockchain", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_blockchainethereum", - "name": "Ethereum Blockchain", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_box", - "name": "Box", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_civicplustransform", - "name": "CivicPlus Transform", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cloudappsecurity", - "name": "Defender for Cloud Apps", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cloudmersive", - "name": "Cloudmersive Virus Scan", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescomputervision", - "name": "Computer Vision API", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescontentmoderator", - "name": "Content Moderator", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescustomvision", - "name": "Custom Vision", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicesqnamaker", - "name": "QnA Maker", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicestextanalytics", - "name": "Azure Cognitive Service for Language", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_cognitoforms", - "name": "Cognito Forms", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_customerinsights", - "name": "Dynamics 365 Customer Insights", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_dataflows", - "name": "Power Query Dataflows", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_db2", - "name": "DB2", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_documentdb", - "name": "Azure Cosmos DB", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_docusign", - "name": "DocuSign", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_docusigndemo", - "name": "DocuSign Demo", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicsax", - "name": "Fin u0026 Ops Apps (Dynamics 365)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbonprem", - "name": "Business Central (on-premises)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbsaas", - "name": "Business Central", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_easyvista", - "name": "EasyVista Service Manager", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_encodiandocumentmanager", - "name": "Encodian", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_eventhubs", - "name": "Event Hubs", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_excel", - "name": "Excel", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_excelonline", - "name": "Excel Online (OneDrive)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_faceapi", - "name": "Face API", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_facebook", - "name": "Facebook", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_filesystem", - "name": "File System", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_flowmanagement", - "name": "Power Automate Management", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_formstackforms", - "name": "Formstack Forms", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_freshdesk", - "name": "Freshdesk", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_ftp", - "name": "FTP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_github", - "name": "GitHub", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_gmail", - "name": "Gmail", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_googlecalendar", - "name": "Google Calendar", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_googledrive", - "name": "Google Drive", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_googlesheet", - "name": "Google Sheets", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_googletasks", - "name": "Google Tasks", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_instagram", - "name": "Instagram", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_instapaper", - "name": "Instapaper", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_jira", - "name": "JIRA", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_jotform", - "name": "JotForm", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_jotformenterprise", - "name": "JotForm Enterprise", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_keyvault", - "name": "Azure Key Vault", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_kusto", - "name": "Azure Data Explorer", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_linkedinv2", - "name": "LinkedIn V2", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_lms365", - "name": "LMS365", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_luis", - "name": "LUIS", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_m365messagecenter", - "name": "Microsoft 365 message center", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_mailchimp", - "name": "MailChimp", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsoft365compliance", - "name": "Microsoft 365 compliance", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftflowforadmins", - "name": "Power Automate for Admins", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftforms", - "name": "Microsoft Forms", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftgraphsecurity", - "name": "Microsoft Graph Security", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_microsofttranslator", - "name": "Microsoft Translator", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_msnweather", - "name": "MSN Weather", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_muhimbi", - "name": "Muhimbi PDF", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_mysql", - "name": "MySQL", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_office365groupsmail", - "name": "Office 365 Groups Mail", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_oracle", - "name": "Oracle Database", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_outlook", - "name": "Outlook.com", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_outlooktasks", - "name": "Outlook Tasks", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_pagerduty", - "name": "PagerDuty", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_plumsail", - "name": "Plumsail Documents", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailforms", - "name": "Plumsail Forms", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailhelpdesk", - "name": "Plumsail HelpDesk", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailsp", - "name": "Plumsail SP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_postgresql", - "name": "PostgreSQL", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforadmins", - "name": "Power Apps for Admins", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforappmakers", - "name": "Power Apps for Makers", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotificationv2", - "name": "Power Apps Notification V2", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powerplatformforadmins", - "name": "Power Platform for Admins", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_powervirtualagents", - "name": "Power Virtual Agents", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_projectonline", - "name": "Project Online", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_projectroadmap", - "name": "Project Roadmap", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_rss", - "name": "RSS", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_saperp", - "name": "SAP ERP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sendgrid", - "name": "SendGrid", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sendmail", - "name": "Mail", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_servicebus", - "name": "Service Bus", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_service-now", - "name": "ServiceNow", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sftp", - "name": "SFTP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sftpwithssh", - "name": "SFTP - SSH", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_slack", - "name": "Slack", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_smartsheet", - "name": "Smartsheet", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_smtp", - "name": "SMTP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_sqldw", - "name": "Azure SQL Data Warehouse", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_survey123", - "name": "Survey123", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_surveymonkey", - "name": "SurveyMonkey", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_teradata", - "name": "Teradata", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_translatorv2", - "name": "Microsoft Translator V2", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_trello", - "name": "Trello", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_twilio", - "name": "Twilio", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_twitter", - "name": "Twitter", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_typeform", - "name": "Typeform", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_uiflow", - "name": "Desktop flows", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_videoindexer-v2", - "name": "Video Indexer (V2)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_visualstudioteamservices", - "name": "Azure DevOps", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_wdatp", - "name": "Microsoft Defender ATP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_webcontents", - "name": "HTTP with Azure AD", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_webmerge", - "name": "Formstack Documents", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_wordonlinebusiness", - "name": "Word Online (Business)", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_wordpress", - "name": "WordPress", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_youtube", - "name": "YouTube", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "/providers/Microsoft.PowerApps/apis/shared_zendesk", - "name": "Zendesk", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "Http", - "name": "HTTP", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "HttpRequestReceived", - "name": "When a HTTP request is received", - "type": "Microsoft.PowerApps/apis" - }, - { - "id": "HttpWebhook", - "name": "HTTP Webhook", - "type": "Microsoft.PowerApps/apis" - } - ] - } - ], - "environmentType": "OnlyEnvironments", - "environments": [ - { - "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", - "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", - "type": "Microsoft.BusinessAppPlatform/scopes/environments" - } - ], - "createdBy": { - "displayName": "David Bui - CTR" - }, - "createdTime": "2022-05-09T22:15:45.3391351Z", - "lastModifiedBy": { - "displayName": "David Bui - CTR" - }, - "lastModifiedTime": "2022-05-31T17:03:57.6942145Z", - "etag": "cf928b78-e411-4341-96df-9a6570fc52eb", - "isLegacySchemaVersion": false - } - ] + "value": [ + { + "name": "981a935c-8c66-4d97-a1f6-b3c314ee07ef", + "displayName": "DefaultEnvironmentPolicy", + "defaultConnectorsClassification": "General", + "connectorGroups": [ + { + "classification": "Confidential", + "connectors": [ + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sharepointonline", + "name": "SharePoint", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_onedriveforbusiness", + "name": "OneDrive for Business", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_approvals", + "name": "Approvals", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_arcgis", + "name": "ArcGIS", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_arcgispaas", + "name": "ArcGIS PaaS", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_commondataservice", + "name": "Microsoft Dataverse (legacy)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps", + "name": "Microsoft Dataverse", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_excelonlinebusiness", + "name": "Excel Online (Business)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftformspro", + "name": "Dynamics 365 Customer Voice", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_office365", + "name": "Office 365 Outlook", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_office365groups", + "name": "Office 365 Groups", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_office365users", + "name": "Office 365 Users", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_onenote", + "name": "OneNote (Business)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_planner", + "name": "Planner", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotification", + "name": "Power Apps Notification", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerbi", + "name": "Power BI", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_shifts", + "name": "Shifts for Microsoft Teams", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_teams", + "name": "Microsoft Teams", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_todo", + "name": "Microsoft To-Do (Business)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_yammer", + "name": "Yammer", + "type": "Microsoft.PowerApps/apis" + } + ] + }, + { + "classification": "General", + "connectors": [] + }, + { + "classification": "Blocked", + "connectors": [ + { + "id": "/providers/Microsoft.PowerApps/apis/shared_salesforce", + "name": "Salesforce", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_onedrive", + "name": "OneDrive", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sql", + "name": "SQL Server", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_dropbox", + "name": "Dropbox", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_aci", + "name": "Azure Container Instance", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_adobepdftools", + "name": "Adobe PDF Services", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_adobesign", + "name": "Adobe Sign", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_applicationinsights", + "name": "Azure Application Insights", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_arm", + "name": "Azure Resource Manager", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_asiteusgov", + "name": "Asite (US Gov.)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_avepointcloudgovernance", + "name": "AvePoint Cloud Governance", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azuread", + "name": "Azure AD", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureappservice", + "name": "Azure App Service", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureautomation", + "name": "Azure Automation", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureblob", + "name": "Azure Blob Storage", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azuredatafactory", + "name": "Azure Data Factory", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgrid", + "name": "Azure Event Grid", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureeventgridpublish", + "name": "Azure Event Grid Publish", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azurefile", + "name": "Azure File Storage", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azureloganalyticsdatacollector", + "name": "Azure Log Analytics Data Collector", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azurequeues", + "name": "Azure Queues", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azuretables", + "name": "Azure Table Storage", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_azurevm", + "name": "Azure VM", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_bingmaps", + "name": "Bing Maps", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_bingsearch", + "name": "Bing Search", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_bitly", + "name": "Bitly", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_bizzy", + "name": "AtBot Logic", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_blockchaincorda", + "name": "Corda Blockchain", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_blockchainethereum", + "name": "Ethereum Blockchain", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_box", + "name": "Box", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_civicplustransform", + "name": "CivicPlus Transform", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cloudappsecurity", + "name": "Defender for Cloud Apps", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cloudmersive", + "name": "Cloudmersive Virus Scan", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescomputervision", + "name": "Computer Vision API", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescontentmoderator", + "name": "Content Moderator", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicescustomvision", + "name": "Custom Vision", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicesqnamaker", + "name": "QnA Maker", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitiveservicestextanalytics", + "name": "Azure Cognitive Service for Language", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_cognitoforms", + "name": "Cognito Forms", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_customerinsights", + "name": "Dynamics 365 Customer Insights", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_dataflows", + "name": "Power Query Dataflows", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_db2", + "name": "DB2", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_documentdb", + "name": "Azure Cosmos DB", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_docusign", + "name": "DocuSign", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_docusigndemo", + "name": "DocuSign Demo", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicsax", + "name": "Fin u0026 Ops Apps (Dynamics 365)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbonprem", + "name": "Business Central (on-premises)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_dynamicssmbsaas", + "name": "Business Central", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_easyvista", + "name": "EasyVista Service Manager", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_encodiandocumentmanager", + "name": "Encodian", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_eventhubs", + "name": "Event Hubs", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_excel", + "name": "Excel", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_excelonline", + "name": "Excel Online (OneDrive)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_faceapi", + "name": "Face API", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_facebook", + "name": "Facebook", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_filesystem", + "name": "File System", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_flowmanagement", + "name": "Power Automate Management", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_formstackforms", + "name": "Formstack Forms", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_freshdesk", + "name": "Freshdesk", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_ftp", + "name": "FTP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_github", + "name": "GitHub", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_gmail", + "name": "Gmail", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_googlecalendar", + "name": "Google Calendar", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_googledrive", + "name": "Google Drive", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_googlesheet", + "name": "Google Sheets", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_googletasks", + "name": "Google Tasks", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_instagram", + "name": "Instagram", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_instapaper", + "name": "Instapaper", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_jira", + "name": "JIRA", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_jotform", + "name": "JotForm", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_jotformenterprise", + "name": "JotForm Enterprise", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_keyvault", + "name": "Azure Key Vault", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_kusto", + "name": "Azure Data Explorer", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_linkedinv2", + "name": "LinkedIn V2", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_lms365", + "name": "LMS365", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_luis", + "name": "LUIS", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_m365messagecenter", + "name": "Microsoft 365 message center", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_mailchimp", + "name": "MailChimp", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsoft365compliance", + "name": "Microsoft 365 compliance", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftflowforadmins", + "name": "Power Automate for Admins", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftforms", + "name": "Microsoft Forms", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsoftgraphsecurity", + "name": "Microsoft Graph Security", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_microsofttranslator", + "name": "Microsoft Translator", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_msnweather", + "name": "MSN Weather", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_muhimbi", + "name": "Muhimbi PDF", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_mysql", + "name": "MySQL", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_office365groupsmail", + "name": "Office 365 Groups Mail", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_oracle", + "name": "Oracle Database", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_outlook", + "name": "Outlook.com", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_outlooktasks", + "name": "Outlook Tasks", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_pagerduty", + "name": "PagerDuty", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_plumsail", + "name": "Plumsail Documents", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailforms", + "name": "Plumsail Forms", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailhelpdesk", + "name": "Plumsail HelpDesk", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_plumsailsp", + "name": "Plumsail SP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_postgresql", + "name": "PostgreSQL", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforadmins", + "name": "Power Apps for Admins", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsforappmakers", + "name": "Power Apps for Makers", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerappsnotificationv2", + "name": "Power Apps Notification V2", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powerplatformforadmins", + "name": "Power Platform for Admins", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_powervirtualagents", + "name": "Power Virtual Agents", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_projectonline", + "name": "Project Online", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_projectroadmap", + "name": "Project Roadmap", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_rss", + "name": "RSS", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_saperp", + "name": "SAP ERP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sendgrid", + "name": "SendGrid", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sendmail", + "name": "Mail", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_servicebus", + "name": "Service Bus", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_service-now", + "name": "ServiceNow", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sftp", + "name": "SFTP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sftpwithssh", + "name": "SFTP - SSH", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_slack", + "name": "Slack", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_smartsheet", + "name": "Smartsheet", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_smtp", + "name": "SMTP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_sqldw", + "name": "Azure SQL Data Warehouse", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_survey123", + "name": "Survey123", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_surveymonkey", + "name": "SurveyMonkey", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_teradata", + "name": "Teradata", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_translatorv2", + "name": "Microsoft Translator V2", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_trello", + "name": "Trello", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_twilio", + "name": "Twilio", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_twitter", + "name": "Twitter", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_typeform", + "name": "Typeform", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_uiflow", + "name": "Desktop flows", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_videoindexer-v2", + "name": "Video Indexer (V2)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_visualstudioteamservices", + "name": "Azure DevOps", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_wdatp", + "name": "Microsoft Defender ATP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_webcontents", + "name": "HTTP with Azure AD", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_webmerge", + "name": "Formstack Documents", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_wordonlinebusiness", + "name": "Word Online (Business)", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_wordpress", + "name": "WordPress", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_youtube", + "name": "YouTube", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "/providers/Microsoft.PowerApps/apis/shared_zendesk", + "name": "Zendesk", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "Http", + "name": "HTTP", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "HttpRequestReceived", + "name": "When a HTTP request is received", + "type": "Microsoft.PowerApps/apis" + }, + { + "id": "HttpWebhook", + "name": "HTTP Webhook", + "type": "Microsoft.PowerApps/apis" + } + ] + } + ], + "environmentType": "OnlyEnvironments", + "environments": [ + { + "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", + "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", + "type": "Microsoft.BusinessAppPlatform/scopes/environments" + } + ], + "createdBy": { + "displayName": "David Bui - CTR" + }, + "createdTime": "2022-05-09T22:15:45.3391351Z", + "lastModifiedBy": { + "displayName": "David Bui - CTR" + }, + "lastModifiedTime": "2022-05-31T17:03:57.6942145Z", + "etag": "cf928b78-e411-4341-96df-9a6570fc52eb", + "isLegacySchemaVersion": false + } + ] } -], - "tenant_isolation": [ + ], + "tenant_isolation": [ { - "properties": { - "tenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", - "isDisabled": true, - "allowedTenants": "" - } + "properties": { + "tenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", + "isDisabled": true, + "allowedTenants": "" + } } -], - "environment_list": [ + ], + "environment_list": [ { - "EnvironmentName": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", - "DisplayName": "Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc)", - "Description": null, - "IsDefault": true, - "Location": "usgov", - "CreatedTime": "2021-12-13T20:40:14.1749137Z", - "CreatedBy": { - "id": "SYSTEM", - "displayName": "SYSTEM", - "type": "NotSpecified" - }, - "LastModifiedTime": null, - "LastModifiedBy": null, - "CreationType": "DefaultTenant", - "EnvironmentType": "Default", - "CommonDataServiceDatabaseProvisioningState": "Succeeded", - "CommonDataServiceDatabaseType": "Common Data Service for Apps", - "Internal": { - "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", - "type": "Microsoft.BusinessAppPlatform/scopes/environments", - "location": "usgov", - "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", - "properties": "@{tenantId=3c19c757-3b55-411f-b03f-2bcc514a598d; azureRegionHint=usgovtexas; displayName=Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc); createdTime=2021-12-13T20:40:14.1749137Z; createdBy=; provisioningState=Succeeded; creationType=DefaultTenant; environmentSku=Default; environmentType=Production; isDefault=True; permissions=; runtimeEndpoints=; linkedEnvironmentMetadata=; trialScenarioType=None; retentionPeriod=P7D; states=; updateCadence=; retentionDetails=; protectionStatus=; cluster=; connectedGroups=System.Object[]; lifecycleOperationsEnforcement=; governanceConfiguration=}" - }, - "InternalCds": null, - "OrganizationId": "ff4adc41-8f11-42a1-9e5a-d208f91a6db4", - "RetentionPeriod": 7 + "EnvironmentName": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", + "DisplayName": "Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc)", + "Description": null, + "IsDefault": true, + "Location": "usgov", + "CreatedTime": "2021-12-13T20:40:14.1749137Z", + "CreatedBy": { + "id": "SYSTEM", + "displayName": "SYSTEM", + "type": "NotSpecified" + }, + "LastModifiedTime": null, + "LastModifiedBy": null, + "CreationType": "DefaultTenant", + "EnvironmentType": "Default", + "CommonDataServiceDatabaseProvisioningState": "Succeeded", + "CommonDataServiceDatabaseType": "Common Data Service for Apps", + "Internal": { + "id": "/providers/Microsoft.BusinessAppPlatform/scopes/admin/environments/Default-3c19c757-3b55-411f-b03f-2bcc514a598d", + "type": "Microsoft.BusinessAppPlatform/scopes/environments", + "location": "usgov", + "name": "Default-3c19c757-3b55-411f-b03f-2bcc514a598d", + "properties": "@{tenantId=3c19c757-3b55-411f-b03f-2bcc514a598d; azureRegionHint=usgovtexas; displayName=Cybersecurity and Infrastructure Security Agency (default) (org8537b7dc); createdTime=2021-12-13T20:40:14.1749137Z; createdBy=; provisioningState=Succeeded; creationType=DefaultTenant; environmentSku=Default; environmentType=Production; isDefault=True; permissions=; runtimeEndpoints=; linkedEnvironmentMetadata=; trialScenarioType=None; retentionPeriod=P7D; states=; updateCadence=; retentionDetails=; protectionStatus=; cluster=; connectedGroups=System.Object[]; lifecycleOperationsEnforcement=; governanceConfiguration=}" + }, + "InternalCds": null, + "OrganizationId": "ff4adc41-8f11-42a1-9e5a-d208f91a6db4", + "RetentionPeriod": 7 } -], - "powerplatform_successful_commands": [ + ], + "powerplatform_successful_commands": [ "Get-TenantDetailsFromGraph", "Get-TenantSettings", "Get-AdminPowerAppEnvironment", "Get-DlpPolicy", "Get-PowerAppTenantIsolationPolicy" -], - "powerplatform_unsuccessful_commands": [ - -], "SPO_tenant": [ + ], + "powerplatform_unsuccessful_commands": [], + "SPO_tenant": [ { - "StorageQuota": 1355776, - "StorageQuotaAllocated": 0, - "ResourceQuota": 0, - "ResourceQuotaAllocated": 0, - "OneDriveStorageQuota": 1048576, - "CompatibilityRange": "15,15", - "ExternalServicesEnabled": true, - "NoAccessRedirectUrl": null, - "ArchiveRedirectUrl": null, - "SharingCapability": 2, - "DisplayStartASiteOption": true, - "StartASiteFormUrl": null, - "ShowEveryoneClaim": false, - "ShowAllUsersClaim": false, - "OfficeClientADALDisabled": false, - "LegacyAuthProtocolsEnabled": false, - "DisableCustomAppAuthentication": true, - "SiteOwnerManageLegacyServicePrincipalEnabled": true, - "ShowEveryoneExceptExternalUsersClaim": true, - "AllowEveryoneExceptExternalUsersClaimInPrivateSite": true, - "SearchResolveExactEmailOrUPN": false, - "RequireAcceptingAccountMatchInvitedAccount": true, - "ProvisionSharedWithEveryoneFolder": false, - "SignInAccelerationDomain": "", - "EnableGuestSignInAcceleration": false, - "UsePersistentCookiesForExplorerView": false, - "ContentTypeSyncSiteTemplatesList": [ - - ], - "BccExternalSharingInvitations": false, - "BccExternalSharingInvitationsList": null, - "UserVoiceForFeedbackEnabled": true, - "PublicCdnEnabled": false, - "PublicCdnAllowedFileTypes": "CSS,EOT,GIF,ICO,JPEG,JPG,JS,MAP,PNG,SVG,TTF,WOFF", - "PublicCdnOrigins": [ - - ], - "RequireAnonymousLinksExpireInDays": -1, - "SharingAllowedDomainList": "agency.onmicrosoft.com yahoo.com", - "SharingBlockedDomainList": null, - "SharingDomainRestrictionMode": 1, - "OneDriveForGuestsEnabled": false, - "IPAddressEnforcement": false, - "IPAddressAllowList": "", - "IPAddressWACTokenLifetime": 15, - "EnablePromotedFileHandlers": true, - "UseFindPeopleInPeoplePicker": false, - "DefaultSharingLinkType": 2, - "ODBMembersCanShare": 0, - "ODBAccessRequests": 0, - "PreventExternalUsersFromResharing": true, - "ShowPeoplePickerSuggestionsForGuestUsers": false, - "FileAnonymousLinkType": 2, - "FolderAnonymousLinkType": 2, - "NotifyOwnersWhenItemsReshared": true, - "NotifyOwnersWhenInvitationsAccepted": true, - "NotificationsInOneDriveForBusinessEnabled": true, - "NotificationsInSharePointEnabled": true, - "SpecialCharactersStateInFileFolderNames": 1, - "OwnerAnonymousNotification": true, - "CommentsOnSitePagesDisabled": false, - "CommentsOnFilesDisabled": false, - "CommentsOnListItemsDisabled": false, - "ViewersCanCommentOnMediaDisabled": false, - "SocialBarOnSitePagesDisabled": false, - "OrphanedPersonalSitesRetentionPeriod": 90, - "PermissiveBrowserFileHandlingOverride": false, - "DisallowInfectedFileDownload": false, - "DefaultLinkPermission": 2, - "CustomizedExternalSharingServiceUrl": "", - "ConditionalAccessPolicy": 0, - "AllowDownloadingNonWebViewableFiles": true, - "LimitedAccessFileType": 1, - "AllowEditing": true, - "ApplyAppEnforcedRestrictionsToAdHocRecipients": true, - "FilePickerExternalImageSearchEnabled": true, - "EmailAttestationRequired": true, - "EmailAttestationReAuthDays": 100, - "DisabledWebPartIds": null, - "EnableMinimumVersionRequirement": true, - "MarkNewFilesSensitiveByDefault": 0, - "EnableAIPIntegration": false, - "AllowCommentsTextOnEmailEnabled": true, - "ConditionalAccessPolicyErrorHelpLink": "", - "EnableAzureADB2BIntegration": false, - "IncludeAtAGlanceInShareEmails": true, - "ExternalUserExpirationRequired": true, - "ExternalUserExpireInDays": 100, - "BlockDownloadLinksFileType": 1, - "AnyoneLinkTrackUsers": false, - "OneDriveLoopDefaultSharingLinkScope": -1, - "OneDriveLoopDefaultSharingLinkRole": 0, - "OneDriveRequestFilesLinkEnabled": true, - "OneDriveRequestFilesLinkExpirationInDays": 1, - "OneDriveSharingCapability": 2, - "OneDriveDefaultShareLinkScope": -1, - "OneDriveDefaultShareLinkRole": 0, - "OneDriveDefaultLinkToExistingAccess": false, - "OneDriveBlockGuestsAsSiteAdmin": 0, - "CoreLoopDefaultSharingLinkScope": -1, - "CoreLoopDefaultSharingLinkRole": 0, - "CoreSharingCapability": 3, - "CoreRequestFilesLinkEnabled": true, - "CoreRequestFilesLinkExpirationInDays": 10, - "CoreDefaultShareLinkScope": -1, - "CoreDefaultShareLinkRole": 0, - "CoreDefaultLinkToExistingAccess": false, - "CoreBlockGuestsAsSiteAdmin": 0, - "BlockAppAccessWithAuthenticationContext": false, - "ContainerSharingCapability": 2, - "ContainerDefaultShareLinkScope": -1, - "ContainerDefaultShareLinkRole": 0, - "ContainerDefaultLinkToExistingAccess": false, - "ContainerLoopDefaultShareLinkScope": -1, - "ContainerLoopDefaultShareLinkRole": 0, - "AllowAnonymousMeetingParticipantsToAccessWhiteboards": 0, - "Workflows2013State": 2, - "IsFluidEnabled": true, - "IsWBFluidEnabled": true, - "IsCollabMeetingNotesFluidEnabled": true, - "IsLoopEnabled": true, - "DisableDocumentLibraryDefaultLabeling": false, - "EnableSensitivityLabelForPDF": false, - "BlockSendLabelMismatchEmail": false, - "LabelMismatchEmailHelpLink": null, - "DisableAddShortcutsToOneDrive": false, - "EnableAutoNewsDigest": true, - "Workflow2010Disabled": true, - "StopNew2010Workflows": false, - "StopNew2013Workflows": false, - "DisableBackToClassic": false, - "BlockUserInfoVisibility": "", - "BlockUserInfoVisibilityInOneDrive": 0, - "BlockUserInfoVisibilityInSharePoint": 0, - "AllowOverrideForBlockUserInfoVisibility": false, - "InformationBarriersSuspension": true, - "IBImplicitGroupBased": false, - "AppBypassInformationBarriers": false, - "DefaultOneDriveInformationBarrierMode": "Explicit", - "DisablePersonalListCreation": false, - "DisableListSync": false, - "DisabledModernListTemplateIds": [ - - ], - "DisableSpacesActivation": false, - "DisableVivaConnectionsAnalytics": false, - "HideSyncButtonOnTeamSite": false, - "AllowGuestUserShareToUsersNotInSiteCollection": false, - "DisableOutlookPSTVersionTrimming": false, - "EnableAutoExpirationVersionTrim": false, - "ExpireVersionsAfterDays": 0, - "MajorVersionLimit": 500, - "StreamLaunchConfig": 0, - "MediaTranscription": 0, - "MediaTranscriptionAutomaticFeatures": 0, - "ViewInFileExplorerEnabled": false, - "AuthContextResilienceMode": 0, - "ReduceTempTokenLifetimeEnabled": false, - "ReduceTempTokenLifetimeValue": 15, - "ShowOpenInDesktopOptionForSyncedFiles": false, - "ShowPeoplePickerGroupSuggestionsForIB": false, - "EnableRestrictedAccessControl": false, - "BlockDownloadFileTypePolicy": false, - "BlockDownloadFileTypeIds": [ - - ], - "ExcludedBlockDownloadGroupIds": [ - - ], - "TlsTokenBindingPolicyValue": 0, - "LegacyBrowserAuthProtocolsEnabled": true, - "RecycleBinRetentionPeriod": 93, - "IsEnableAppAuthPopUpEnabled": false, - "MassDeleteNotificationDisabled": false + "StorageQuota": 1355776, + "StorageQuotaAllocated": 0, + "ResourceQuota": 0, + "ResourceQuotaAllocated": 0, + "OneDriveStorageQuota": 1048576, + "CompatibilityRange": "15,15", + "ExternalServicesEnabled": true, + "NoAccessRedirectUrl": null, + "ArchiveRedirectUrl": null, + "SharingCapability": 2, + "DisplayStartASiteOption": true, + "StartASiteFormUrl": null, + "ShowEveryoneClaim": false, + "ShowAllUsersClaim": false, + "OfficeClientADALDisabled": false, + "LegacyAuthProtocolsEnabled": false, + "DisableCustomAppAuthentication": true, + "SiteOwnerManageLegacyServicePrincipalEnabled": true, + "ShowEveryoneExceptExternalUsersClaim": true, + "AllowEveryoneExceptExternalUsersClaimInPrivateSite": true, + "SearchResolveExactEmailOrUPN": false, + "RequireAcceptingAccountMatchInvitedAccount": true, + "ProvisionSharedWithEveryoneFolder": false, + "SignInAccelerationDomain": "", + "EnableGuestSignInAcceleration": false, + "UsePersistentCookiesForExplorerView": false, + "ContentTypeSyncSiteTemplatesList": [], + "BccExternalSharingInvitations": false, + "BccExternalSharingInvitationsList": null, + "UserVoiceForFeedbackEnabled": true, + "PublicCdnEnabled": false, + "PublicCdnAllowedFileTypes": "CSS,EOT,GIF,ICO,JPEG,JPG,JS,MAP,PNG,SVG,TTF,WOFF", + "PublicCdnOrigins": [], + "RequireAnonymousLinksExpireInDays": -1, + "SharingAllowedDomainList": "agency.onmicrosoft.com yahoo.com", + "SharingBlockedDomainList": null, + "SharingDomainRestrictionMode": 1, + "OneDriveForGuestsEnabled": false, + "IPAddressEnforcement": false, + "IPAddressAllowList": "", + "IPAddressWACTokenLifetime": 15, + "EnablePromotedFileHandlers": true, + "UseFindPeopleInPeoplePicker": false, + "DefaultSharingLinkType": 2, + "ODBMembersCanShare": 0, + "ODBAccessRequests": 0, + "PreventExternalUsersFromResharing": true, + "ShowPeoplePickerSuggestionsForGuestUsers": false, + "FileAnonymousLinkType": 2, + "FolderAnonymousLinkType": 2, + "NotifyOwnersWhenItemsReshared": true, + "NotifyOwnersWhenInvitationsAccepted": true, + "NotificationsInOneDriveForBusinessEnabled": true, + "NotificationsInSharePointEnabled": true, + "SpecialCharactersStateInFileFolderNames": 1, + "OwnerAnonymousNotification": true, + "CommentsOnSitePagesDisabled": false, + "CommentsOnFilesDisabled": false, + "CommentsOnListItemsDisabled": false, + "ViewersCanCommentOnMediaDisabled": false, + "SocialBarOnSitePagesDisabled": false, + "OrphanedPersonalSitesRetentionPeriod": 90, + "PermissiveBrowserFileHandlingOverride": false, + "DisallowInfectedFileDownload": false, + "DefaultLinkPermission": 2, + "CustomizedExternalSharingServiceUrl": "", + "ConditionalAccessPolicy": 0, + "AllowDownloadingNonWebViewableFiles": true, + "LimitedAccessFileType": 1, + "AllowEditing": true, + "ApplyAppEnforcedRestrictionsToAdHocRecipients": true, + "FilePickerExternalImageSearchEnabled": true, + "EmailAttestationRequired": true, + "EmailAttestationReAuthDays": 100, + "DisabledWebPartIds": null, + "EnableMinimumVersionRequirement": true, + "MarkNewFilesSensitiveByDefault": 0, + "EnableAIPIntegration": false, + "AllowCommentsTextOnEmailEnabled": true, + "ConditionalAccessPolicyErrorHelpLink": "", + "EnableAzureADB2BIntegration": false, + "IncludeAtAGlanceInShareEmails": true, + "ExternalUserExpirationRequired": true, + "ExternalUserExpireInDays": 100, + "BlockDownloadLinksFileType": 1, + "AnyoneLinkTrackUsers": false, + "OneDriveLoopDefaultSharingLinkScope": -1, + "OneDriveLoopDefaultSharingLinkRole": 0, + "OneDriveRequestFilesLinkEnabled": true, + "OneDriveRequestFilesLinkExpirationInDays": 1, + "OneDriveSharingCapability": 2, + "OneDriveDefaultShareLinkScope": -1, + "OneDriveDefaultShareLinkRole": 0, + "OneDriveDefaultLinkToExistingAccess": false, + "OneDriveBlockGuestsAsSiteAdmin": 0, + "CoreLoopDefaultSharingLinkScope": -1, + "CoreLoopDefaultSharingLinkRole": 0, + "CoreSharingCapability": 3, + "CoreRequestFilesLinkEnabled": true, + "CoreRequestFilesLinkExpirationInDays": 10, + "CoreDefaultShareLinkScope": -1, + "CoreDefaultShareLinkRole": 0, + "CoreDefaultLinkToExistingAccess": false, + "CoreBlockGuestsAsSiteAdmin": 0, + "BlockAppAccessWithAuthenticationContext": false, + "ContainerSharingCapability": 2, + "ContainerDefaultShareLinkScope": -1, + "ContainerDefaultShareLinkRole": 0, + "ContainerDefaultLinkToExistingAccess": false, + "ContainerLoopDefaultShareLinkScope": -1, + "ContainerLoopDefaultShareLinkRole": 0, + "AllowAnonymousMeetingParticipantsToAccessWhiteboards": 0, + "Workflows2013State": 2, + "IsFluidEnabled": true, + "IsWBFluidEnabled": true, + "IsCollabMeetingNotesFluidEnabled": true, + "IsLoopEnabled": true, + "DisableDocumentLibraryDefaultLabeling": false, + "EnableSensitivityLabelForPDF": false, + "BlockSendLabelMismatchEmail": false, + "LabelMismatchEmailHelpLink": null, + "DisableAddShortcutsToOneDrive": false, + "EnableAutoNewsDigest": true, + "Workflow2010Disabled": true, + "StopNew2010Workflows": false, + "StopNew2013Workflows": false, + "DisableBackToClassic": false, + "BlockUserInfoVisibility": "", + "BlockUserInfoVisibilityInOneDrive": 0, + "BlockUserInfoVisibilityInSharePoint": 0, + "AllowOverrideForBlockUserInfoVisibility": false, + "InformationBarriersSuspension": true, + "IBImplicitGroupBased": false, + "AppBypassInformationBarriers": false, + "DefaultOneDriveInformationBarrierMode": "Explicit", + "DisablePersonalListCreation": false, + "DisableListSync": false, + "DisabledModernListTemplateIds": [], + "DisableSpacesActivation": false, + "DisableVivaConnectionsAnalytics": false, + "HideSyncButtonOnTeamSite": false, + "AllowGuestUserShareToUsersNotInSiteCollection": false, + "DisableOutlookPSTVersionTrimming": false, + "EnableAutoExpirationVersionTrim": false, + "ExpireVersionsAfterDays": 0, + "MajorVersionLimit": 500, + "StreamLaunchConfig": 0, + "MediaTranscription": 0, + "MediaTranscriptionAutomaticFeatures": 0, + "ViewInFileExplorerEnabled": false, + "AuthContextResilienceMode": 0, + "ReduceTempTokenLifetimeEnabled": false, + "ReduceTempTokenLifetimeValue": 15, + "ShowOpenInDesktopOptionForSyncedFiles": false, + "ShowPeoplePickerGroupSuggestionsForIB": false, + "EnableRestrictedAccessControl": false, + "BlockDownloadFileTypePolicy": false, + "BlockDownloadFileTypeIds": [], + "ExcludedBlockDownloadGroupIds": [], + "TlsTokenBindingPolicyValue": 0, + "LegacyBrowserAuthProtocolsEnabled": true, + "RecycleBinRetentionPeriod": 93, + "IsEnableAppAuthPopUpEnabled": false, + "MassDeleteNotificationDisabled": false } -], - "SPO_site": [ + ], + "SPO_site": [ { - "LastContentModifiedDate": "/Date(1692410434457)/", - "Status": "Active", - "ArchiveStatus": null, - "ResourceUsageCurrent": 0, - "ResourceUsageAverage": 0, - "StorageUsageCurrent": 1, - "LockIssue": null, - "WebsCount": 1, - "CompatibilityLevel": 15, - "DisableSharingForNonOwnersStatus": null, - "HubSiteId": "00000000-0000-0000-0000-000000000000", - "IsHubSite": false, - "RelatedGroupId": "00000000-0000-0000-0000-000000000000", - "GroupId": "00000000-0000-0000-0000-000000000000", - "Url": "https://agency.sharepoint.com/", - "LocaleId": 1033, - "LockState": "Unlock", - "Owner": "c64580cf-5b99-4c0a-b15b-db035c63e177", - "StorageQuota": 26214400, - "StorageQuotaWarningLevel": 25574400, - "ResourceQuota": 300, - "ResourceQuotaWarningLevel": 255, - "Template": "SITEPAGEPUBLISHING#0", - "Title": "Communication site", - "AllowSelfServiceUpgrade": true, - "DenyAddAndCustomizePages": 2, - "PWAEnabled": 1, - "SharingCapability": 3, - "SiteDefinedSharingCapability": 2, - "SandboxedCodeActivationCapability": 2, - "DisableCompanyWideSharingLinks": 2, - "DisableAppViews": 2, - "DisableFlows": 2, - "AuthenticationContextName": null, - "StorageQuotaType": null, - "RestrictedToGeo": 3, - "ShowPeoplePickerSuggestionsForGuestUsers": false, - "SharingDomainRestrictionMode": 0, - "SharingAllowedDomainList": "", - "SharingBlockedDomainList": "", - "ConditionalAccessPolicy": 0, - "AllowDownloadingNonWebViewableFiles": false, - "LimitedAccessFileType": 1, - "AllowEditing": true, - "SensitivityLabel": null, - "CommentsOnSitePagesDisabled": false, - "SocialBarOnSitePagesDisabled": false, - "DefaultSharingLinkType": 0, - "DefaultLinkPermission": 0, - "DefaultLinkToExistingAccess": false, - "AnonymousLinkExpirationInDays": 30, - "OverrideTenantAnonymousLinkExpirationPolicy": true, - "ExternalUserExpirationInDays": 0, - "OverrideTenantExternalUserExpirationPolicy": false, - "SharingLockDownEnabled": false, - "SharingLockDownCanBeCleared": true, - "InformationSegment": [ - - ], - "InformationBarriersMode": "", - "BlockDownloadLinksFileType": 1, - "OverrideBlockUserInfoVisibility": 0, - "IsTeamsConnected": false, - "IsTeamsChannelConnected": false, - "TeamsChannelType": 0, - "MediaTranscription": 0, - "ExcludedBlockDownloadGroupIds": [ - - ], - "ExcludeBlockDownloadPolicySiteOwners": false, - "ReadOnlyForBlockDownloadPolicy": false, - "ExcludeBlockDownloadSharePointGroups": null, - "BlockDownloadPolicy": false, - "LoopDefaultSharingLinkScope": -1, - "LoopDefaultSharingLinkRole": 0, - "RequestFilesLinkEnabled": true, - "RequestFilesLinkExpirationInDays": 10, - "OverrideSharingCapability": false, - "DefaultShareLinkScope": -1, - "DefaultShareLinkRole": 0, - "BlockGuestsAsSiteAdmin": 0, - "ReadOnlyForUnmanagedDevices": false, - "RestrictedAccessControl": false, - "AuthenticationContextLimitedAccess": false, - "RestrictedAccessControlGroups": [ - - ], - "ListsShowHeaderAndNavigation": false + "LastContentModifiedDate": "/Date(1692410434457)/", + "Status": "Active", + "ArchiveStatus": null, + "ResourceUsageCurrent": 0, + "ResourceUsageAverage": 0, + "StorageUsageCurrent": 1, + "LockIssue": null, + "WebsCount": 1, + "CompatibilityLevel": 15, + "DisableSharingForNonOwnersStatus": null, + "HubSiteId": "00000000-0000-0000-0000-000000000000", + "IsHubSite": false, + "RelatedGroupId": "00000000-0000-0000-0000-000000000000", + "GroupId": "00000000-0000-0000-0000-000000000000", + "Url": "https://agency.sharepoint.com/", + "LocaleId": 1033, + "LockState": "Unlock", + "Owner": "c64580cf-5b99-4c0a-b15b-db035c63e177", + "StorageQuota": 26214400, + "StorageQuotaWarningLevel": 25574400, + "ResourceQuota": 300, + "ResourceQuotaWarningLevel": 255, + "Template": "SITEPAGEPUBLISHING#0", + "Title": "Communication site", + "AllowSelfServiceUpgrade": true, + "DenyAddAndCustomizePages": 2, + "PWAEnabled": 1, + "SharingCapability": 3, + "SiteDefinedSharingCapability": 2, + "SandboxedCodeActivationCapability": 2, + "DisableCompanyWideSharingLinks": 2, + "DisableAppViews": 2, + "DisableFlows": 2, + "AuthenticationContextName": null, + "StorageQuotaType": null, + "RestrictedToGeo": 3, + "ShowPeoplePickerSuggestionsForGuestUsers": false, + "SharingDomainRestrictionMode": 0, + "SharingAllowedDomainList": "", + "SharingBlockedDomainList": "", + "ConditionalAccessPolicy": 0, + "AllowDownloadingNonWebViewableFiles": false, + "LimitedAccessFileType": 1, + "AllowEditing": true, + "SensitivityLabel": null, + "CommentsOnSitePagesDisabled": false, + "SocialBarOnSitePagesDisabled": false, + "DefaultSharingLinkType": 0, + "DefaultLinkPermission": 0, + "DefaultLinkToExistingAccess": false, + "AnonymousLinkExpirationInDays": 30, + "OverrideTenantAnonymousLinkExpirationPolicy": true, + "ExternalUserExpirationInDays": 0, + "OverrideTenantExternalUserExpirationPolicy": false, + "SharingLockDownEnabled": false, + "SharingLockDownCanBeCleared": true, + "InformationSegment": [], + "InformationBarriersMode": "", + "BlockDownloadLinksFileType": 1, + "OverrideBlockUserInfoVisibility": 0, + "IsTeamsConnected": false, + "IsTeamsChannelConnected": false, + "TeamsChannelType": 0, + "MediaTranscription": 0, + "ExcludedBlockDownloadGroupIds": [], + "ExcludeBlockDownloadPolicySiteOwners": false, + "ReadOnlyForBlockDownloadPolicy": false, + "ExcludeBlockDownloadSharePointGroups": null, + "BlockDownloadPolicy": false, + "LoopDefaultSharingLinkScope": -1, + "LoopDefaultSharingLinkRole": 0, + "RequestFilesLinkEnabled": true, + "RequestFilesLinkExpirationInDays": 10, + "OverrideSharingCapability": false, + "DefaultShareLinkScope": -1, + "DefaultShareLinkRole": 0, + "BlockGuestsAsSiteAdmin": 0, + "ReadOnlyForUnmanagedDevices": false, + "RestrictedAccessControl": false, + "AuthenticationContextLimitedAccess": false, + "RestrictedAccessControlGroups": [], + "ListsShowHeaderAndNavigation": false } -], - "OneDrive_PnP_Flag": false, - "SharePoint_successful_commands": [ + ], + "OneDrive_PnP_Flag": false, + "SharePoint_successful_commands": [ "Get-MgBetaOrganization", "Get-SPOTenant", "Get-SPOSite", "Get-PnPTenant", "Get-PnPTenantSite" -], - "SharePoint_unsuccessful_commands": [ - -], "teams_tenant_info": [ + ], + "SharePoint_unsuccessful_commands": [], + "teams_tenant_info": [ { - "AnnouncementsDisabled": null, - "AssignedPlan": [ - "MCOEV", - "Teams_GCC", - "MCOProfessional", - "MCOMEETADD" - ], - "City": "Washington", - "CompanyPartnership": [ - "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.CompanyPartnership" - ], - "CompanyTags": [ - "servicescope.microsoft.com/ServiceScope=GCC", - "o365.microsoft.com/startdate=637492760673881089", - "o365.microsoft.com/version=15" - ], - "Country": null, - "CountryAbbreviation": "US", - "DefaultPoolFqdn": null, - "DirSyncEnabled": true, - "DisplayName": "Cybersecurity and Infrastructure Security Agency", - "LastSyncTimeStamp": "/Date(1692396091546)/", - "NameRecordingDisabled": null, - "Pools": null, - "PostalCode": "20528-0380", - "PreferredLanguage": "en", - "ProvisionedPlan": [ - "exchange", - "RMSOnline", - "RMSOnline", - "RMSOnline", - "exchange", - "Adallom", - "RMSOnline", - "RMSOnline", - "exchange", - "exchange", - "exchange", - "exchange", - "SCO", - "SharePoint", - "SharePoint", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "exchange", - "MicrosoftCommunicationsOnline", - "MicrosoftCommunicationsOnline", - "MicrosoftCommunicationsOnline", - "ProjectWorkManagement", - "Adallom", - "RMSOnline", - "SCO" - ], - "ServiceInfo": "[{}]", - "ServiceInstance": "MicrosoftCommunicationsOnline/GOV-1B-G6", - "ServiceNumberCount": null, - "SipDomain": [ - "agency.onmicrosoft.com", - "dhs.agency.gov", - "test365.agency.dhs.gov" - ], - "StateOrProvince": "DC", - "Street": "245 Murray Lane", - "SubscriberNumberCount": null, - "SyncInLyncAdInfo": { - "IsSyncDisabledAtTenantCreation": null, - "IsUserSyncDisabled": true, - "IsUserSyncStateChanging": null, - "StopSyncRevertCompleteTimestamp": null, - "StopSyncRevertTimestamp": null, - "StopSyncTimestamp": "/Date(1675422759251)/" - }, - "TeamsUpgradeEffectiveMode": "TeamsOnly", - "TeamsUpgradeNotificationsEnabled": false, - "TeamsUpgradeOverridePolicy": "ProvisionedAsTeams", - "TeamsUpgradePolicyIsReadOnly": "ModeAndNotifications", - "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", - "TnmAccountId": null, - "VerifiedDomains": [ - "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", - "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", - "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", - "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain" - ], - "WhenChanged": "/Date(1692188532143)/", - "WhenCreated": "/Date(-62135596800000)/", - "LastProvisionTimeStamps": { - "TenantSipDomains": "2023-08-16T12:21:39.4275558+00:00", - "TenantRegistrarPool": "2023-08-16T12:21:39.5213122+00:00", - "ConfigDistributionStatus": "2023-08-16T12:22:12.1434748+00:00" - }, - "LastPublishTimeStamps": { - "ProvisionedPlanPublishAuthoredProps": "2023-08-16T12:21:47.569208+00:00", - "ProvisionCpcTenantConfigProcessor": "2023-08-16T12:21:44.5681938+00:00", - "PublishProvisionedPlanProcessor": "2022-10-20T21:16:44.2365367+00:00", - "UpdateBvdTenantProcessor": "2023-08-16T12:21:45.0863487+00:00" - } + "AnnouncementsDisabled": null, + "AssignedPlan": ["MCOEV", "Teams_GCC", "MCOProfessional", "MCOMEETADD"], + "City": "Washington", + "CompanyPartnership": [ + "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.CompanyPartnership" + ], + "CompanyTags": [ + "servicescope.microsoft.com/ServiceScope=GCC", + "o365.microsoft.com/startdate=637492760673881089", + "o365.microsoft.com/version=15" + ], + "Country": null, + "CountryAbbreviation": "US", + "DefaultPoolFqdn": null, + "DirSyncEnabled": true, + "DisplayName": "Cybersecurity and Infrastructure Security Agency", + "LastSyncTimeStamp": "/Date(1692396091546)/", + "NameRecordingDisabled": null, + "Pools": null, + "PostalCode": "20528-0380", + "PreferredLanguage": "en", + "ProvisionedPlan": [ + "exchange", + "RMSOnline", + "RMSOnline", + "RMSOnline", + "exchange", + "Adallom", + "RMSOnline", + "RMSOnline", + "exchange", + "exchange", + "exchange", + "exchange", + "SCO", + "SharePoint", + "SharePoint", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "exchange", + "MicrosoftCommunicationsOnline", + "MicrosoftCommunicationsOnline", + "MicrosoftCommunicationsOnline", + "ProjectWorkManagement", + "Adallom", + "RMSOnline", + "SCO" + ], + "ServiceInfo": "[{}]", + "ServiceInstance": "MicrosoftCommunicationsOnline/GOV-1B-G6", + "ServiceNumberCount": null, + "SipDomain": [ + "agency.onmicrosoft.com", + "dhs.agency.gov", + "test365.agency.dhs.gov" + ], + "StateOrProvince": "DC", + "Street": "245 Murray Lane", + "SubscriberNumberCount": null, + "SyncInLyncAdInfo": { + "IsSyncDisabledAtTenantCreation": null, + "IsUserSyncDisabled": true, + "IsUserSyncStateChanging": null, + "StopSyncRevertCompleteTimestamp": null, + "StopSyncRevertTimestamp": null, + "StopSyncTimestamp": "/Date(1675422759251)/" + }, + "TeamsUpgradeEffectiveMode": "TeamsOnly", + "TeamsUpgradeNotificationsEnabled": false, + "TeamsUpgradeOverridePolicy": "ProvisionedAsTeams", + "TeamsUpgradePolicyIsReadOnly": "ModeAndNotifications", + "TenantId": "3c19c757-3b55-411f-b03f-2bcc514a598d", + "TnmAccountId": null, + "VerifiedDomains": [ + "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", + "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", + "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain", + "Microsoft.Teams.ConfigAPI.Cmdlets.Generated.Models.TenantVerifiedSipDomain" + ], + "WhenChanged": "/Date(1692188532143)/", + "WhenCreated": "/Date(-62135596800000)/", + "LastProvisionTimeStamps": { + "TenantSipDomains": "2023-08-16T12:21:39.4275558+00:00", + "TenantRegistrarPool": "2023-08-16T12:21:39.5213122+00:00", + "ConfigDistributionStatus": "2023-08-16T12:22:12.1434748+00:00" + }, + "LastPublishTimeStamps": { + "ProvisionedPlanPublishAuthoredProps": "2023-08-16T12:21:47.569208+00:00", + "ProvisionCpcTenantConfigProcessor": "2023-08-16T12:21:44.5681938+00:00", + "PublishProvisionedPlanProcessor": "2022-10-20T21:16:44.2365367+00:00", + "UpdateBvdTenantProcessor": "2023-08-16T12:21:45.0863487+00:00" + } } -], - "meeting_policies": [ + ], + "meeting_policies": [ { - "Identity": "Global", - "Description": null, - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "DisabledUserOverride", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInCompanyExcludingGuests", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Global", + "Description": null, + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "DisabledUserOverride", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInCompanyExcludingGuests", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:Custom Policy 1", - "Description": "Used to test multiple Teams policy baselines", - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "DisabledUserOverride", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": false, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInSameAndFederatedCompany", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": true, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:Custom Policy 1", + "Description": "Used to test multiple Teams policy baselines", + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "DisabledUserOverride", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": false, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInSameAndFederatedCompany", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": true, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:NKK-Temp", - "Description": null, - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "DisabledUserOverride", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": "", - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "Everyone", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": true, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": "", - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:NKK-Temp", + "Description": null, + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "DisabledUserOverride", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": "", + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "Everyone", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": true, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": "", + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:AllOn", - "Description": "Do not assign. This policy is same as global defaults and would be deprecated", - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "DisabledUserOverride", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:AllOn", + "Description": "Do not assign. This policy is same as global defaults and would be deprecated", + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "DisabledUserOverride", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:RestrictedAnonymousAccess", - "Description": "Do not assign. This policy is same as global defaults and would be deprecated", - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "Disabled", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:RestrictedAnonymousAccess", + "Description": "Do not assign. This policy is same as global defaults and would be deprecated", + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "Disabled", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:AllOff", - "Description": null, - "AllowChannelMeetingScheduling": false, - "AllowMeetNow": false, - "AllowPrivateMeetNow": false, - "MeetingChatEnabledType": "Disabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "Disabled", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": false, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": false, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": false, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": false, - "AllowPowerPointSharing": false, - "AllowParticipantGiveRequestControl": false, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": false, - "AllowWhiteboard": false, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "Disabled", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:AllOff", + "Description": null, + "AllowChannelMeetingScheduling": false, + "AllowMeetNow": false, + "AllowPrivateMeetNow": false, + "MeetingChatEnabledType": "Disabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "Disabled", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": false, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": false, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": false, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": false, + "AllowPowerPointSharing": false, + "AllowParticipantGiveRequestControl": false, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": false, + "AllowWhiteboard": false, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "Disabled", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:RestrictedAnonymousNoRecording", - "Description": "Do not assign. This policy is similar to global defaults and would be deprecated", - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "Disabled", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": false, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:RestrictedAnonymousNoRecording", + "Description": "Do not assign. This policy is similar to global defaults and would be deprecated", + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "Disabled", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": false, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:Default", - "Description": null, - "AllowChannelMeetingScheduling": true, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "DisabledUserOverride", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": true, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": true, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": true, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:Default", + "Description": null, + "AllowChannelMeetingScheduling": true, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "DisabledUserOverride", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": true, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": true, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": true, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" }, { - "Identity": "Tag:Kiosk", - "Description": null, - "AllowChannelMeetingScheduling": false, - "AllowMeetNow": true, - "AllowPrivateMeetNow": true, - "MeetingChatEnabledType": "Enabled", - "AllowExternalNonTrustedMeetingChat": true, - "LiveCaptionsEnabledType": "Disabled", - "DesignatedPresenterRoleMode": "EveryoneUserOverride", - "AllowIPAudio": true, - "AllowIPVideo": true, - "AllowEngagementReport": "Enabled", - "AllowTrackingInReport": "EnabledUserOverride", - "IPAudioMode": "EnabledOutgoingIncoming", - "IPVideoMode": "EnabledOutgoingIncoming", - "AllowAnonymousUsersToDialOut": false, - "AllowAnonymousUsersToStartMeeting": false, - "AllowAnonymousUsersToJoinMeeting": true, - "BlockedAnonymousJoinClientTypes": null, - "AllowedStreamingMediaInput": null, - "ExplicitRecordingConsent": "Disabled", - "AllowLocalRecording": false, - "AllowPrivateMeetingScheduling": false, - "AutoAdmittedUsers": "EveryoneInCompany", - "AllowCloudRecording": false, - "AllowRecordingStorageOutsideRegion": false, - "RecordingStorageMode": "OneDriveForBusiness", - "AllowOutlookAddIn": false, - "AllowPowerPointSharing": true, - "AllowParticipantGiveRequestControl": true, - "AllowExternalParticipantGiveRequestControl": false, - "AllowSharedNotes": true, - "AllowWhiteboard": true, - "AllowTranscription": false, - "AllowNetworkConfigurationSettingsLookup": false, - "MediaBitRateKb": 50000, - "ScreenSharingMode": "EntireScreen", - "VideoFiltersMode": "AllFilters", - "AllowPSTNUsersToBypassLobby": false, - "AllowOrganizersToOverrideLobbySettings": false, - "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", - "AllowNDIStreaming": false, - "AllowUserToJoinExternalMeeting": "Disabled", - "SpeakerAttributionMode": "EnabledUserOverride", - "EnrollUserOverride": "Disabled", - "RoomAttributeUserOverride": "Off", - "StreamingAttendeeMode": "Disabled", - "AttendeeIdentityMasking": "DisabledUserOverride", - "AllowBreakoutRooms": true, - "TeamsCameraFarEndPTZMode": "Disabled", - "AllowMeetingReactions": true, - "AllowMeetingRegistration": true, - "WhoCanRegister": "Everyone", - "AllowScreenContentDigitization": "Enabled", - "AllowCarbonSummary": true, - "RoomPeopleNameUserOverride": "Off", - "AllowMeetingCoach": true, - "NewMeetingRecordingExpirationDays": 120, - "LiveStreamingMode": "Disabled", - "MeetingInviteLanguages": null, - "ChannelRecordingDownload": "Allow", - "AllowCartCaptionsScheduling": "DisabledUserOverride", - "AllowTasksFromTranscript": "Enabled", - "InfoShownInReportMode": "FullInformation", - "LiveInterpretationEnabledType": "DisabledUserOverride", - "QnAEngagementMode": "Enabled", - "AllowImmersiveView": true, - "AllowAvatarsInGallery": true, - "AllowAnnotations": true, - "AllowDocumentCollaboration": "Enabled", - "AllowWatermarkForScreenSharing": false, - "AllowWatermarkForCameraVideo": false, - "AllowWatermarkCustomizationForCameraVideo": true, - "WatermarkForCameraVideoOpacity": 30, - "WatermarkForCameraVideoPattern": "Tiled", - "AllowWatermarkCustomizationForScreenSharing": true, - "WatermarkForScreenSharingOpacity": 30, - "WatermarkForScreenSharingPattern": "Tiled", - "AudibleRecordingNotification": "PstnOnly", - "ConnectToMeetingControls": "Enabled" + "Identity": "Tag:Kiosk", + "Description": null, + "AllowChannelMeetingScheduling": false, + "AllowMeetNow": true, + "AllowPrivateMeetNow": true, + "MeetingChatEnabledType": "Enabled", + "AllowExternalNonTrustedMeetingChat": true, + "LiveCaptionsEnabledType": "Disabled", + "DesignatedPresenterRoleMode": "EveryoneUserOverride", + "AllowIPAudio": true, + "AllowIPVideo": true, + "AllowEngagementReport": "Enabled", + "AllowTrackingInReport": "EnabledUserOverride", + "IPAudioMode": "EnabledOutgoingIncoming", + "IPVideoMode": "EnabledOutgoingIncoming", + "AllowAnonymousUsersToDialOut": false, + "AllowAnonymousUsersToStartMeeting": false, + "AllowAnonymousUsersToJoinMeeting": true, + "BlockedAnonymousJoinClientTypes": null, + "AllowedStreamingMediaInput": null, + "ExplicitRecordingConsent": "Disabled", + "AllowLocalRecording": false, + "AllowPrivateMeetingScheduling": false, + "AutoAdmittedUsers": "EveryoneInCompany", + "AllowCloudRecording": false, + "AllowRecordingStorageOutsideRegion": false, + "RecordingStorageMode": "OneDriveForBusiness", + "AllowOutlookAddIn": false, + "AllowPowerPointSharing": true, + "AllowParticipantGiveRequestControl": true, + "AllowExternalParticipantGiveRequestControl": false, + "AllowSharedNotes": true, + "AllowWhiteboard": true, + "AllowTranscription": false, + "AllowNetworkConfigurationSettingsLookup": false, + "MediaBitRateKb": 50000, + "ScreenSharingMode": "EntireScreen", + "VideoFiltersMode": "AllFilters", + "AllowPSTNUsersToBypassLobby": false, + "AllowOrganizersToOverrideLobbySettings": false, + "PreferredMeetingProviderForIslandsMode": "TeamsAndSfb", + "AllowNDIStreaming": false, + "AllowUserToJoinExternalMeeting": "Disabled", + "SpeakerAttributionMode": "EnabledUserOverride", + "EnrollUserOverride": "Disabled", + "RoomAttributeUserOverride": "Off", + "StreamingAttendeeMode": "Disabled", + "AttendeeIdentityMasking": "DisabledUserOverride", + "AllowBreakoutRooms": true, + "TeamsCameraFarEndPTZMode": "Disabled", + "AllowMeetingReactions": true, + "AllowMeetingRegistration": true, + "WhoCanRegister": "Everyone", + "AllowScreenContentDigitization": "Enabled", + "AllowCarbonSummary": true, + "RoomPeopleNameUserOverride": "Off", + "AllowMeetingCoach": true, + "NewMeetingRecordingExpirationDays": 120, + "LiveStreamingMode": "Disabled", + "MeetingInviteLanguages": null, + "ChannelRecordingDownload": "Allow", + "AllowCartCaptionsScheduling": "DisabledUserOverride", + "AllowTasksFromTranscript": "Enabled", + "InfoShownInReportMode": "FullInformation", + "LiveInterpretationEnabledType": "DisabledUserOverride", + "QnAEngagementMode": "Enabled", + "AllowImmersiveView": true, + "AllowAvatarsInGallery": true, + "AllowAnnotations": true, + "AllowDocumentCollaboration": "Enabled", + "AllowWatermarkForScreenSharing": false, + "AllowWatermarkForCameraVideo": false, + "AllowWatermarkCustomizationForCameraVideo": true, + "WatermarkForCameraVideoOpacity": 30, + "WatermarkForCameraVideoPattern": "Tiled", + "AllowWatermarkCustomizationForScreenSharing": true, + "WatermarkForScreenSharingOpacity": 30, + "WatermarkForScreenSharingPattern": "Tiled", + "AudibleRecordingNotification": "PstnOnly", + "ConnectToMeetingControls": "Enabled" } -], - "federation_configuration": [ + ], + "federation_configuration": [ { - "AllowedDomains": { - "AllowedDomain": "Domain=mitre.org" - }, - "BlockedDomains": [ - - ], - "AllowFederatedUsers": true, - "AllowPublicUsers": false, - "AllowTeamsSms": true, - "AllowTeamsConsumer": false, - "AllowTeamsConsumerInbound": true, - "TreatDiscoveredPartnersAsUnverified": false, - "SharedSipAddressSpace": false, - "RestrictTeamsConsumerToExternalUserProfiles": false, - "DataSource": null, - "Key": { - "ScopeClass": "Global", - "SchemaId": "XName=", - "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", - "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", - "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" - }, - "Identity": "Global" + "AllowedDomains": { + "AllowedDomain": "Domain=mitre.org" + }, + "BlockedDomains": [], + "AllowFederatedUsers": true, + "AllowPublicUsers": false, + "AllowTeamsSms": true, + "AllowTeamsConsumer": false, + "AllowTeamsConsumerInbound": true, + "TreatDiscoveredPartnersAsUnverified": false, + "SharedSipAddressSpace": false, + "RestrictTeamsConsumerToExternalUserProfiles": false, + "DataSource": null, + "Key": { + "ScopeClass": "Global", + "SchemaId": "XName=", + "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", + "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", + "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" + }, + "Identity": "Global" } -], - "client_configuration": [ + ], + "client_configuration": [ { - "AllowEmailIntoChannel": true, - "RestrictedSenderList": null, - "AllowDropBox": true, - "AllowBox": true, - "AllowGoogleDrive": true, - "AllowShareFile": true, - "AllowEgnyte": true, - "AllowOrganizationTab": true, - "AllowSkypeBusinessInterop": true, - "ContentPin": "RequiredOutsideScheduleMeeting", - "AllowResourceAccountSendMessage": true, - "ResourceAccountContentAccess": "NoAccess", - "AllowGuestUser": true, - "AllowScopedPeopleSearchandAccess": false, - "AllowRoleBasedChatPermissions": false, - "DataSource": null, - "Key": { - "ScopeClass": "Global", - "SchemaId": "XName=", - "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", - "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", - "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" - }, - "Identity": "Global" + "AllowEmailIntoChannel": true, + "RestrictedSenderList": null, + "AllowDropBox": true, + "AllowBox": true, + "AllowGoogleDrive": true, + "AllowShareFile": true, + "AllowEgnyte": true, + "AllowOrganizationTab": true, + "AllowSkypeBusinessInterop": true, + "ContentPin": "RequiredOutsideScheduleMeeting", + "AllowResourceAccountSendMessage": true, + "ResourceAccountContentAccess": "NoAccess", + "AllowGuestUser": true, + "AllowScopedPeopleSearchandAccess": false, + "AllowRoleBasedChatPermissions": false, + "DataSource": null, + "Key": { + "ScopeClass": "Global", + "SchemaId": "XName=", + "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", + "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", + "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" + }, + "Identity": "Global" } -], - "app_policies": [ + ], + "app_policies": [ { - "Identity": "Global", - "DefaultCatalogApps": [ - - ], - "GlobalCatalogApps": [ - - ], - "PrivateCatalogApps": [ - - ], - "Description": null, - "DefaultCatalogAppsType": "AllowedAppList", - "GlobalCatalogAppsType": "BlockedAppList", - "PrivateCatalogAppsType": "AllowedAppList" + "Identity": "Global", + "DefaultCatalogApps": [], + "GlobalCatalogApps": [], + "PrivateCatalogApps": [], + "Description": null, + "DefaultCatalogAppsType": "AllowedAppList", + "GlobalCatalogAppsType": "BlockedAppList", + "PrivateCatalogAppsType": "AllowedAppList" } -], - "broadcast_policies": [ + ], + "broadcast_policies": [ { - "Description": null, - "AllowBroadcastScheduling": true, - "AllowBroadcastTranscription": false, - "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", - "BroadcastRecordingMode": "UserOverride", - "DataSource": null, - "Key": { - "ScopeClass": "Global", - "SchemaId": "XName=", - "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", - "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", - "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" - }, - "Identity": "Global" + "Description": null, + "AllowBroadcastScheduling": true, + "AllowBroadcastTranscription": false, + "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", + "BroadcastRecordingMode": "UserOverride", + "DataSource": null, + "Key": { + "ScopeClass": "Global", + "SchemaId": "XName=", + "AuthorityId": "Class=Tenant;InstanceId=3c19c757-3b55-411f-b03f-2bcc514a598d;XmlRoot=", + "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", + "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" + }, + "Identity": "Global" }, { - "Description": null, - "AllowBroadcastScheduling": true, - "AllowBroadcastTranscription": false, - "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", - "BroadcastRecordingMode": "AlwaysEnabled", - "DataSource": "Memory", - "Key": { - "ScopeClass": "Tag", - "SchemaId": "XName=", - "AuthorityId": "Class=Host;InstanceId=00000000-0000-0000-0000-000000000000;XmlRoot=", - "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", - "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" - }, - "Identity": "Tag:Default" + "Description": null, + "AllowBroadcastScheduling": true, + "AllowBroadcastTranscription": false, + "BroadcastAttendeeVisibilityMode": "EveryoneInCompany", + "BroadcastRecordingMode": "AlwaysEnabled", + "DataSource": "Memory", + "Key": { + "ScopeClass": "Tag", + "SchemaId": "XName=", + "AuthorityId": "Class=Host;InstanceId=00000000-0000-0000-0000-000000000000;XmlRoot=", + "DefaultXml": "SchemaId=;Data=;ConfigObject=;Signature=00000000-0000-0000-0000-000000000000;IsModified=True", + "XmlRoot": "name={urn:schema:Microsoft.Rtc.Management.ScopeFramework.2008}AnchoredXmlKey" + }, + "Identity": "Tag:Default" } -], -"license_information": [ + ], + "license_information": [ { - "SkuId": "f30db892-07e9-47e9-837c-80727f46fd3d", - "SkuPartNumber": "FLOW_FREE", - "ConsumedUnits": 3, - "PrepaidUnits": { - "Enabled": 10000, - "LockedOut": 0, - "Suspended": 0, - "Warning": 0 - } + "SkuId": "f30db892-07e9-47e9-837c-80727f46fd3d", + "SkuPartNumber": "FLOW_FREE", + "ConsumedUnits": 3, + "PrepaidUnits": { + "Enabled": 10000, + "LockedOut": 0, + "Suspended": 0, + "Warning": 0 + } }, { - "SkuId": "c42b9cae-ea4f-4ab7-9717-81576235ccac", - "SkuPartNumber": "DEVELOPERPACK_E5", - "ConsumedUnits": 22, - "PrepaidUnits": { - "Enabled": 25, - "LockedOut": 0, - "Suspended": 0, - "Warning": 0 - } + "SkuId": "c42b9cae-ea4f-4ab7-9717-81576235ccac", + "SkuPartNumber": "DEVELOPERPACK_E5", + "ConsumedUnits": 22, + "PrepaidUnits": { + "Enabled": 25, + "LockedOut": 0, + "Suspended": 0, + "Warning": 0 + } } -], - "total_user_count": 51, - "teams_successful_commands": [ + ], + "total_user_count": 51, + "teams_successful_commands": [ "Get-CsTenant", "Get-CsTeamsMeetingPolicy", "Get-CsTenantFederationConfiguration", "Get-CsTeamsClientConfiguration", "Get-CsTeamsAppPermissionPolicy", "Get-CsTeamsMeetingBroadcastPolicy" -], - "teams_unsuccessful_commands": [ - -] - } + ], + "teams_unsuccessful_commands": [] +} diff --git a/Testing/Linting/MegaLinter/.mega-linter-powershell.yml b/Testing/Linting/MegaLinter/.mega-linter-security.yml similarity index 62% rename from Testing/Linting/MegaLinter/.mega-linter-powershell.yml rename to Testing/Linting/MegaLinter/.mega-linter-security.yml index 1a05efeeb..8dcafe5c3 100644 --- a/Testing/Linting/MegaLinter/.mega-linter-powershell.yml +++ b/Testing/Linting/MegaLinter/.mega-linter-security.yml @@ -1,6 +1,6 @@ # Config file for Mega-Linter -# PowerShell +# Checkov ENABLE_LINTERS: - - POWERSHELL_POWERSHELL + - REPOSITORY_CHECKOV LOG_LEVEL: ERROR diff --git a/Testing/Linting/MegaLinter/.yamllint.yml b/Testing/Linting/MegaLinter/.yamllint.yml index 6cb4c85e6..a50694fd0 100644 --- a/Testing/Linting/MegaLinter/.yamllint.yml +++ b/Testing/Linting/MegaLinter/.yamllint.yml @@ -11,3 +11,4 @@ rules: # Don't bother me with these rules document-start: disable truthy: disable + comments-indentation: disable