Public/generated/Get-KriticalUtcmEXOAntiPhishPolicy.ps1
|
# Kritical.PS.UTCM | Microsoft Graph UTCM REST API toolkit # (c) 2026 Kritical Pty Ltd | https://kritical.net # Kritical brand banner is rendered at module load via Write-KriticalUtcmBanner. function Get-KriticalUtcmEXOAntiPhishPolicy { <# .SYNOPSIS Kritical.UTCM shim for M365DSC resource EXOAntiPhishPolicy. .DESCRIPTION Search-replace safe: callers that today invoke Get-M365DSCEXOAntiPhishPolicy -Credential $cred -TenantId $tid can rename to Get-KriticalUtcmEXOAntiPhishPolicy -Credential $cred -TenantId $tid with ZERO other edits. Parameter shape matches the M365DSC .schema.mof exactly. By default -PreferM365DscBehavior is true. Actual Graph dispatch is delegated to Invoke-KriticalUtcmM365DscSchemaBridge. Bridge maps resource → Graph endpoint per per-resource wave; where mapping is not yet shipped, bridge returns an object with Verdict='UNMAPPED'. .NOTES Workload: Exchange Param count: 37 #> [CmdletBinding()] param( # The Identity parameter specifies the name of the antiphishing policy that you want to modify. [Parameter(Mandatory)] [string]$Identity, # Specify if this policy should exist or not. [ValidateSet('Present','Absent')] [string]$Ensure, # The AdminDisplayName parameter specifies a description for the policy. [string]$AdminDisplayName, # The PhishThresholdLevel parameter specifies the tolerance level that's used by machine learning in the handling of phishing messages. [ValidateSet('1','2','3','4')] [int]$PhishThresholdLevel, # The AuthenticationFailAction parameter specifies the action to take when the message fails composite authentication. [ValidateSet('MoveToJmf','Quarantine')] [string]$AuthenticationFailAction, # The TargetedUserProtectionAction parameter specifies the action to take on detected user impersonation messages for the users specified by the TargetedUsersToProtect parameter. [ValidateSet('BccMessage','Delete','MoveToJmf','NoAction','Quarantine','Redirect')] [string]$TargetedUserProtectionAction, # Specify if this policy should be enabled. Default is $true. [bool]$Enabled, # The EnableFirstContactSafetyTips parameter specifies whether to enable or disable the safety tip that's shown when recipients first receive an email from a sender or do not often receive email from a sender. [bool]$EnableFirstContactSafetyTips, # The EnableMailboxIntelligence parameter specifies whether to enable or disable mailbox intelligence (the first contact graph) in domain and user impersonation protection. [bool]$EnableMailboxIntelligence, # The EnableMailboxIntelligenceProtection specifies whether to enable or disable enhanced impersonation results based on each user's individual sender map. This intelligence allows Microsoft 365 to customize user impersonation detection and better handle false positives. [bool]$EnableMailboxIntelligenceProtection, # The EnableOrganizationDomainsProtection parameter specifies whether to enable domain impersonation protection for all registered domains in the Office 365 organization. [bool]$EnableOrganizationDomainsProtection, # The EnableSimilarDomainsSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for domain impersonation detections. [bool]$EnableSimilarDomainsSafetyTips, # The EnableSimilarUsersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for user impersonation detections. [bool]$EnableSimilarUsersSafetyTips, # The EnableSpoofIntelligence parameter specifies whether to enable or disable antispoofing protection for the policy. [bool]$EnableSpoofIntelligence, # The EnableTargetedDomainsProtection parameter specifies whether to enable domain impersonation protection for a list of specified domains. [bool]$EnableTargetedDomainsProtection, # The EnableTargetedUserProtection parameter specifies whether to enable user impersonation protection for the users specified by the TargetedUsersToProtect parameter [bool]$EnableTargetedUserProtection, # The EnableUnauthenticatedSender parameter enables or disables unauthenticated sender identification in Outlook. [bool]$EnableUnauthenticatedSender, # The EnableUnusualCharactersSafetyTips parameter specifies whether to enable safety tips that are shown to recipients in messages for unusual characters in domain and user impersonation detections. [bool]$EnableUnusualCharactersSafetyTips, # This setting is part of spoof protection. The EnableViaTag parameter enables or disables adding the via tag to the From address in Outlook. [bool]$EnableViaTag, # Make this the default antiphishing policy [bool]$MakeDefault, # The HonorDmarcPolicy enables or disables using the sender's DMARC policy to determine what to do to messages that fail DMARC checks. [bool]$HonorDmarcPolicy, # The ImpersonationProtectionState parameter specifies the configuration of impersonation protection. [string]$ImpersonationProtectionState, # The MailboxIntelligenceProtectionAction parameter specifies what to do with messages that fail mailbox intelligence protection. [string]$MailboxIntelligenceProtectionAction, # The MailboxIntelligenceQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by mailbox intelligence. [string]$MailboxIntelligenceQuarantineTag, # The SpoofQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by spoof intelligence. [string]$SpoofQuarantineTag, # The TargetedDomainProtectionAction parameter specifies the action to take on detected domain impersonation messages. [ValidateSet('BccMessage','Delete','MoveToJmf','NoAction','Quarantine','Redirect')] [string]$TargetedDomainProtectionAction, # The TargetedDomainQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by domain impersonation protection. [string]$TargetedDomainQuarantineTag, # The TargetedUserQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by user impersonation protection. [string]$TargetedUserQuarantineTag, # The DmarcQuarantineAction parameter specifies the action to take when a message fails DMARC checks and the sender's DMARC policy is p=quarantine [ValidateSet('MoveToJmf','Quarantine')] [string]$DmarcQuarantineAction, # The DmarcRejectAction parameter specifies the action to take when a message fails DMARC checks and the sender's DMARC policy is p=reject. [ValidateSet('Quarantine','Reject')] [string]$DmarcRejectAction, # Credentials of the Exchange Global Admin [string]$Credential, # Id of the Azure Active Directory application to authenticate with. [string]$ApplicationId, # Id of the Azure Active Directory tenant used for authentication. [string]$TenantId, # Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. [string]$CertificateThumbprint, # Username can be made up to anything but password will be used for CertificatePassword [string]$CertificatePassword, # Path to certificate used in service principal usually a PFX file. [string]$CertificatePath, # Managed ID being used for authentication. [bool]$ManagedIdentity ) Invoke-KriticalUtcmM365DscSchemaBridge -ResourceName 'EXOAntiPhishPolicy' -Workload 'Exchange' -Verb 'Get' -CallerParams $PSBoundParameters } |