{"id":9837,"date":"2026-08-18T22:30:35","date_gmt":"2026-08-18T22:30:35","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=9837"},"modified":"2026-08-19T01:15:08","modified_gmt":"2026-08-19T01:15:08","slug":"defender-impersonation-not-working","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/defender-impersonation-not-working","title":{"rendered":"Defender impersonation not working – Mailflow protection"},"content":{"rendered":"\n

https:\/\/security.microsoft.com\/reportsubmission<\/a><\/p>\n\n\n\n

This builds an exchange rule to take the names out the defender impersonation list and creates a rule<\/p>\n\n\n\n

<#\n.SYNOPSIS\n    Builds\/updates an Exchange Online mail flow (transport) rule that quarantines\n    external mail impersonating your organization's \"protected\" VIP display names,\n    using the TargetedUsersToProtect list from your Defender for Office 365\n    Anti-Phishing policies.\n\n.DESCRIPTION\n    This is a backstop for Defender's built-in impersonation protection: it\n    quarantines any external message whose 'From' header display name exactly\n    matches one of your protected VIPs' names, unless the message genuinely\n    came from that person's real mailbox address.\n\n    Logic:\n      1. Connects to Exchange Online (if not already connected).\n      2. Reads every ENABLED Anti-Phish policy and pulls its TargetedUsersToProtect\n         list (format: \"Display Name;email@domain.com\", comma-separated entries).\n      3. Merges and de-duplicates the display names and email addresses across\n         all enabled policies.\n      4. Creates the transport rule if it doesn't exist, or updates it in place\n         if a rule with the same name already exists (conditions\/exceptions are\n         refreshed to match the current protected-user list; other settings such\n         as Mode are left untouched on update unless you pass -Force).\n      5. The rule is created\/left in AUDIT mode (Exchange calls this \"Test\" mode\n         under the hood; the admin center displays it as \"Audit\"). No mail is\n         actually quarantined while in this mode - only match events are logged.\n         Pass -Enforce to switch it to enforce mode instead.\n\n.PARAMETER RuleName\n    Name of the transport rule to create\/update.\n    Default: \"Quarantine - External Sender Impersonating Protected Names\"\n\n.PARAMETER Enforce\n    Switch. If specified, sets the rule to Enforce mode instead of Audit\/Test mode.\n    Omit this to keep the rule safely in audit-only mode.\n\n.PARAMETER Priority\n    Rule priority (lower number = higher priority). Default: 3, matching the\n    example rule this script is modeled on. Adjust to fit your existing rule set.\n\n.PARAMETER WhatIf\n    Preview the protected names\/addresses and the rule that would be\n    created\/updated, without making any changes in Exchange Online.\n\n.EXAMPLE\n    .\\New-ImpersonationQuarantineRule.ps1 -WhatIf\n    Shows what would happen without changing anything.\n\n.EXAMPLE\n    .\\New-ImpersonationQuarantineRule.ps1\n    Creates or updates the rule in Audit mode.\n\n.EXAMPLE\n    .\\New-ImpersonationQuarantineRule.ps1 -Enforce\n    Creates or updates the rule and sets it to Enforce mode (will actually quarantine mail).\n\n.NOTES\n    Requires the ExchangeOnlineManagement module and an account with Exchange\n    Online \/ Security & Compliance admin permissions (e.g. Organization\n    Management or Security Administrator role).\n\n    Review the -WhatIf output before running for real, and review the rule in\n    the Exchange admin center after creation. Audit mode is intentionally the\n    default so you can check for false positives (e.g. legitimate external\n    senders who happen to share a display name with a protected VIP) before\n    switching to Enforce.\n#>\n\n[CmdletBinding(SupportsShouldProcess = $true)]\nparam(\n    [string]$RuleName = \"Quarantine - External Sender Impersonating Protected Names\",\n    [switch]$Enforce,\n    [int]$Priority = 3\n)\n\n$ErrorActionPreference = \"Stop\"\n\nfunction Ensure-ExchangeOnlineConnection {\n    $connected = $false\n    try {\n        $null = Get-ConnectionInformation -ErrorAction Stop\n        $connected = $true\n    } catch {\n        $connected = $false\n    }\n\n    if (-not $connected) {\n        Write-Host \"Connecting to Exchange Online...\" -ForegroundColor Cyan\n        if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {\n            throw \"The ExchangeOnlineManagement module is not installed. Install it first with: Install-Module ExchangeOnlineManagement -Scope CurrentUser\"\n        }\n        Import-Module ExchangeOnlineManagement -ErrorAction Stop\n        Connect-ExchangeOnline -ShowBanner:$false\n    } else {\n        Write-Host \"Already connected to Exchange Online.\" -ForegroundColor DarkGray\n    }\n}\n\nfunction Get-ProtectedNamesAndAddresses {\n    <#\n        Pulls TargetedUsersToProtect from every ENABLED Anti-Phish policy and\n        returns a de-duplicated list of [pscustomobject]@{ DisplayName; Email }\n    #>\n    Write-Host \"Retrieving enabled Anti-Phish policies...\" -ForegroundColor Cyan\n    $policies = Get-AntiPhishPolicy | Where-Object { $_.Enabled -eq $true }\n\n    if (-not $policies -or $policies.Count -eq 0) {\n        Write-Warning \"No enabled Anti-Phish policies were found. Nothing to build the rule from.\"\n        return @()\n    }\n\n    $protected = New-Object System.Collections.Generic.List[object]\n\n    foreach ($policy in $policies) {\n        Write-Host \"  Policy: $($policy.Identity)\" -ForegroundColor DarkGray\n        $entries = $policy.TargetedUsersToProtect\n        if (-not $entries) { continue }\n\n        foreach ($entry in $entries) {\n            # Each entry is typically formatted as \"Display Name;email@domain.com\"\n            $parts = $entry -split ';'\n            if ($parts.Count -ge 2) {\n                $name  = $parts[0].Trim()\n                $email = $parts[1].Trim()\n            } else {\n                # Fallback: some tenants store just the display name or just the address\n                $name  = $entry.Trim()\n                $email = $null\n            }\n\n            if ([string]::IsNullOrWhiteSpace($name)) { continue }\n\n            $protected.Add([pscustomobject]@{\n                DisplayName = $name\n                Email       = $email\n            })\n        }\n    }\n\n    # De-duplicate by DisplayName+Email pair (case-insensitive)\n    $unique = $protected |\n        Group-Object { \"$($_.DisplayName.ToLower())|$($_.Email.ToLower())\" } |\n        ForEach-Object { $_.Group[0] }\n\n    return $unique\n}\n\n# --- Main ---\n\nEnsure-ExchangeOnlineConnection\n\n$protectedUsers = Get-ProtectedNamesAndAddresses\n\nif ($protectedUsers.Count -eq 0) {\n    Write-Warning \"No protected users found across enabled Anti-Phish policies. Exiting without changes.\"\n    return\n}\n\n$displayNames = $protectedUsers |\n    Select-Object -ExpandProperty DisplayName -Unique |\n    Where-Object { $_ }\n\n$emailAddresses = $protectedUsers |\n    Select-Object -ExpandProperty Email -Unique |\n    Where-Object { $_ }\n\nWrite-Host \"`nFound $($displayNames.Count) unique protected display name(s) and $($emailAddresses.Count) associated address(es):\" -ForegroundColor Green\n$protectedUsers | Sort-Object DisplayName | Format-Table DisplayName, Email -AutoSize\n\n$modeDescription = if ($Enforce) { \"Enforce (will actually quarantine matching mail)\" } else { \"Audit\/Test (logs matches only, no mail is quarantined)\" }\nWrite-Host \"`nRule to be created\/updated:\" -ForegroundColor Green\nWrite-Host \"  Name          : $RuleName\"\nWrite-Host \"  Priority      : $Priority\"\nWrite-Host \"  Mode          : $modeDescription\"\nWrite-Host \"  Condition     : 'From' header contains one of the protected display names\"\nWrite-Host \"                  AND sender is from outside the organization\"\nWrite-Host \"  Exception     : sender's address contains one of the protected users' real addresses\"\nWrite-Host \"  Action        : Deliver the message to the hosted quarantine\"\n\nif ($WhatIfPreference) {\n    Write-Host \"`n-WhatIf specified: no changes were made in Exchange Online.\" -ForegroundColor Yellow\n    return\n}\n\n$existingRule = $null\ntry {\n    $existingRule = Get-TransportRule -Identity $RuleName -ErrorAction Stop\n} catch {\n    $existingRule = $null\n}\n\n$ruleMode = if ($Enforce) { \"Enforce\" } else { \"Test\" }  # \"Test\" mode = \"Audit\" in the admin center UI\n\n$ruleParams = @{\n    Name                          = $RuleName\n    HeaderContainsMessageHeader   = \"From\"\n    HeaderContainsWords           = $displayNames\n    FromScope                     = \"NotInOrganization\"\n    ExceptIfFromAddressContainsWords = $emailAddresses\n    Quarantine                    = $true\n    Mode                          = $ruleMode\n    Priority                      = $Priority\n    RuleErrorAction               = \"Ignore\"\n    Comments                      = \"Backstop for Defender impersonation protection: quarantines external mail whose display name exactly matches a protected VIP name, even when Defender's own confidence scoring lets it through. Auto-generated\/updated by New-ImpersonationQuarantineRule.ps1 from enabled Anti-Phish policies' TargetedUsersToProtect lists on $(Get-Date -Format 'yyyy-MM-dd').\"\n}\n\nif ($existingRule) {\n    Write-Host \"`nExisting rule '$RuleName' found - updating it in place.\" -ForegroundColor Cyan\n    if ($PSCmdlet.ShouldProcess($RuleName, \"Update transport rule\")) {\n        Set-TransportRule @ruleParams\n        Write-Host \"Rule updated successfully.\" -ForegroundColor Green\n    }\n} else {\n    Write-Host \"`nNo existing rule named '$RuleName' - creating a new one.\" -ForegroundColor Cyan\n    if ($PSCmdlet.ShouldProcess($RuleName, \"Create transport rule\")) {\n        New-TransportRule @ruleParams\n        Write-Host \"Rule created successfully.\" -ForegroundColor Green\n    }\n}\n\nWrite-Host \"`nDone. Review the rule in the Exchange admin center (Mail flow > Rules) before relying on it,\" -ForegroundColor Yellow\nWrite-Host \"and keep it in Audit mode until you've confirmed there are no false positives.\" -ForegroundColor Yellow<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
https:\/\/security.microsoft.com\/reportsubmission This builds an exchange rule to take the names out the defender impersonation list and creates a rule<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9837","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t