So recently Office365 stopped using the settings in EAC for outbound spam quarantine notifications and moved that to its own alert policy in the Security and Compliance portal. For some reason, the setting for email notification was not carried over to the new alert policy. So we've got 70 tenants that we need to make sure we have email notifications for in case of a compromised account.
I would have liked to just edit the default MS-created alert policy that is called "User restricted from sending email" using the Set-ProtectionAlert cmdlet but apparently you cannot use this cmdlet to edit default alert policies. You can only modify alerts you have created using New-ProtectionAlert cmdlet.
Soooooooooooooo..... I've been trying to find a way to use New-ProtectionAlert to create a new Alert Policy with the same Operation trigger {Compromised Account} and it works fine when using the Exchange Online Powershell Module on one customer but I'm not trying to do that 70 times... so I've been looking around for ways to use my delegated admin credentials to connect to each of our tenants and create this alert policy for each of them.
I am trying to use this one as a template https://gcits.com/knowledge-base/get-alerts-elevation-privilege-operations-office-365-customer-tenan... - unfortunately I just cannot get this to work.
This is what I've got:
$ruleName = "CCS Security - Outbound Spam"
$ruleEmail = "help@company.net"
$credentials = Get-Credential
Connect-Msolservice -Credential $credentials
$customers = Get-MsolPartnerContract
foreach ($customer in $customers) {
Write-Host "\`nChecking activity alert on $($customer.name)" -ForegroundColor Blue
$InitialDomain = Get-MsolDomain -TenantId $customer.tenantid | Where-Object {$\_.IsInitial -eq $true}
$DelegatedOrgURL = "<a href="https://ps.compliance.protection.outlook.com/powershell-liveid?DelegatedOrg="+$InitialDomain.Name" target="_blank">https://ps.compliance.protection.outlook.com/powershell-liveid?DelegatedOrg="+$InitialDomain.Name</a>
$SCDS = New-PSSession -ConnectionUri $DelegatedOrgURL -Credential $credentials -Authentication Basic -ConfigurationName Microsoft.Exchange -AllowRedirection
Import-PSSession $SCDS -CommandName Get-ProtectionAlert, New-ProtectionAlert
$alert = $null
$alert = Get-ProtectionAlert -Identity $ruleName -ErrorAction SilentlyContinue
if (!$alert)
$newAlert = New-ProtectionAlert -Name $ruleName -Category ThreatManagement -NotifyUser
$ruleEmail -ThreatType "Activity" -Description "Alert CCS to any spam quarantined user" -AggregationType none -Operation CompromisedAccount
if ($newAlert) {
Write-Host "Alert created for $($customer.name)" -ForegroundColor Green
}
}
else {
Write-Host "Alert already exists for $($customer.name)" -ForegroundColor Green
}
Remove-PSSession $SCDS
}
When I run that I get this:
WARNING: Your connection has been redirected to the following URI:
"<a href="https://nam03b.ps.compliance.prot" target="_blank">https://nam03b.ps.compliance.prot</a>
ection.outlook.com/powershell-liveid?DelegatedOrg=customer.onmicrosoft.com;PSVersion=5.1.17134.85
8 "
New-PSSession : [nam03b.ps.compliance.protection.outlook.com] Connecting to remote server
nam03b.ps.compliance.protection.outlook.com failed with the following error message : Access is
denied. For more information, see the about_Remote_Troubleshooting Help topic.
At C:\test\ALL!_OutboundSpamNotify.ps1:13 char:13
+ $SCDS = New-PSSession -ConnectionUri $DelegatedOrgURL -Credential ...
Looking online I've seen that that Access Denied means that obviously that my user does not have access to Exchange Online for that customer but I've delegated admin for all of our tenants and I can perform other scripts with my credentials that work just fine.
Any insight or help would be appreciated.
