---
name: Transport Rule Risk Review
description: Review Exchange Online mail flow (transport) rules for risky patterns that bypass security controls or exfiltrate mail.
---

# Transport Rule Risk Review

> **TL;DR:** Inspect Exchange Online transport rules read-only, flag patterns that auto-forward, exfiltrate, or bypass spam and malware controls, and rank each rule by risk.

## How Exchange Online mail flow rules shape security in Microsoft Purview

Exchange Online mail flow rules (transport rules) evaluate every message in transit and can redirect, modify, or bypass filtering. A misconfigured rule can silently forward mail externally or skip Microsoft Defender for Office 365 scanning. Reviewing these rules complements Microsoft Purview audit and Microsoft Defender XDR investigations, giving a clear picture of how mail flow controls behave across the tenant.

## When should you run this skill?

- "Review our transport rules for anything that auto-forwards mail to external domains."
- "Did someone add a rule that bypasses spam filtering or malware scanning?"
- "Audit Exchange Online mail flow rules after a suspected business email compromise."
- "Check whether any mail flow rule deletes or blind-copies messages to a hidden mailbox."
- "Score our transport rules so I know which ones to remediate first."
- "Find disabled rules that could be re-enabled to weaken our controls."
- "Confirm no rule strips attachments or X-headers before delivery."

## How this skill works, step by step

1. Enumerate all transport rules with a read-only connection to Exchange Online (for example `Get-TransportRule`).
2. Capture each rule's state, priority, conditions, actions, and exceptions for analysis.
3. Flag exfiltration actions such as redirect, blind carbon copy, or forward to external recipients.
4. Flag bypass actions such as setting the spam confidence level to bypass filtering or skipping malware scanning.
5. Flag tampering actions such as deleting messages, removing headers, or stripping attachments.
6. Note rules scoped to external domains, broad sender or recipient wildcards, or recently modified rules.
7. Identify disabled rules that retain risky actions and could be re-enabled.
8. Derive a risk score by weighting matched patterns: exfiltration actions score highest, then control bypass, then tampering, with modifiers for external scope and broad matching.
9. Summarise findings, listing the highest-scoring rules first for prioritised review.

## Output format

| Rule name | Risky pattern | Scope | Risk score |
| --- | --- | --- | --- |
| External-AutoForward | Redirect message to external recipient | External domain | High |
| Skip-Filtering | Set SCL to bypass spam filtering | All senders | High |

- Total rules reviewed and count flagged by severity.
- Highest-risk rule and the specific action driving its score.
- Disabled rules retaining risky actions.
- Recommended next step for each flagged rule (no changes made by this skill).

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Exchange Online mail flow rules | Exchange Online Plan 1 |
| Mail flow and audit reporting | Microsoft 365 E3 |

### Least-privilege roles

- View-Only Configuration role (Exchange Online), read-only access to transport rule configuration.

### Microsoft Graph permissions (read-only)

- Transport rules are administered via the Exchange Online PowerShell module or the Exchange admin center, not Microsoft Graph; use the View-Only Configuration role for read-only enumeration.

## Scope and safety

This skill is read-only by default and enumerates transport rule configuration for review only.

This skill does NOT:

- Create, modify, enable, disable, or delete any transport rule.
- Read or alter the content of any email message.
- Change tenant security policies, filtering settings, or recipient configuration.

## Sources and compliance

- [Mail flow rules (transport rules) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
- [Mail flow rule conditions and exceptions (predicates) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)
- Maps to ASD Essential Eight under configuration hardening and restricting mail flow paths that bypass malware and content filtering.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.