CIS.M365.2.1.12: Ensure the connection filter IP allow list is not used (Only Checks Default Policy)

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.2.1.12
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Defender
Related products	Exchange Online
Feature	Anti-spam
Security area	Email and collaboration protection
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 2.1.12 (L1, E3 Level 1)
Framework controls	cis-m365:2.1.12 nist-800-53-r5:AC-4 Information Flow Enforcement
MITRE ATT&CK	T1566, T1684.002
Reads from	Exchange Online

What this checks and how to fix it

2.1.12 (L1) Ensure the connection filter IP allow list is not used

In Microsoft 365 organizations with Exchange Online mailboxes or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, connection filtering and the default connection filter policy identify good or bad source email servers by IP addresses. The key components of the default connection filter policy are IP Allow List, IP Block List and Safe list. The recommended state is IP Allow List empty or undefined.

Rationale

Without additional verification like mail flow rules, email from sources in the IP Allow List skips spam filtering and sender authentication (SPF, DKIM, DMARC) checks. This method creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered. Messages that are determined to be malware or high confidence phishing are filtered.

Impact

This is the default behavior. IP Allow lists may reduce false positives, however, this benefit is outweighed by the importance of a policy which scans all messages regardless of the origin. This supports the principle of zero trust.

Remediation action

To remove IPs from the allow list:

1. Navigate to Microsoft 365 Defender.
2. Click to expand Email & collaboration select Policies & rules > Threat policies.
3. Under policies select Anti-spam.
4. Click on the Connection filter policy (Default).
5. Click Edit connection filter policy.
6. Remove any IP entries from Always allow messages from the following IP addresses or address range:.
7. Click Save.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following PowerShell command:

Set-HostedConnectionFilterPolicy -Identity Default -IPAllowList @{}

Related links

• Microsoft 365 Defender
• Configure connection filtering in cloud organizations
• Create sender allowlists for cloud mailboxes
• When user and organization settings conflict
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 128

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: knussbaumer. Open-source licences.