MT.1043: Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains

ID	MT.1043
Severity	Medium
Suite	Mito
Product	Exchange Online
Feature	Mail flow
Security area	Email and collaboration protection
Resource type	MailFlowRule
User impact of fixing	Low
Effort to fix	Medium
Framework controls	nist-800-53-r5:SI-8 Spam Protection
MITRE ATT&CK	T1566
Reads from	Exchange Online

What this checks and how to fix it

Spam confidence level (SCL) SHOULD NOT be set to -1 in mail transport rules with specific domains

Rationale: Allow-listing domains in transport rules bypasses regular malware and phishing scanning, which can enable an attacker to launch attacks against your users from a safe haven domain.

Remediation action

1. Connect to Exchange Online:

Connect-ExchangeOnline

1. View your current transport rules:

Get-TransportRule | Select-Object Name, SetScl

1. For each transport rule that uses SetScl -1, modify it to set SCL to 0 or higher:

Set-TransportRule -Identity "RuleName" -SetSCL 0

1. Verify the changes:

Get-TransportRule | Where-Object { $_.SetScl -eq -1 }

The result should return no rules.

Related links

• Exchange Transport Rules and SCL values
• Spam Confidence Levels (SCL) in Exchange Online
• Microsoft Secure Score - Set SCL to 0 or higher for domains

---

Mito check. Author: weyCC81; contributors: bastienperez. Open-source licences.