Public/Disable-M365ExternalForwarding.ps1
|
function Disable-M365ExternalForwarding { <# .SYNOPSIS Disables inbox rules that forward mail to external recipients (remediation for the mail-forwarding report). .DESCRIPTION Finds enabled inbox rules that forward/redirect to external recipients (via Get-M365MailForwarding) and disables them via Microsoft Graph. Every change goes through ShouldProcess: with -WhatIf NOTHING is changed (dry run). Returns one object per rule. Requires MailboxSettings.ReadWrite. .PARAMETER UserId Restrict to a single user (UPN or id). .PARAMETER WhatIf Dry run - only show what would be disabled. .EXAMPLE Disable-M365ExternalForwarding -WhatIf .EXAMPLE Disable-M365ExternalForwarding -UserId marta@contoso.ch #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')] [OutputType([pscustomobject])] param([string]$UserId) Assert-TTGraph $rules = @(Get-M365MailForwarding -UserId $UserId | Where-Object Enabled) Write-TTLog -Level INFO -Message "Found $($rules.Count) enabled external-forwarding rule(s)." foreach ($r in $rules) { $done = $false if ($PSCmdlet.ShouldProcess("$($r.UPN): rule '$($r.Rule)'", "Disable external-forwarding rule (to: $(@($r.External) -join ', '))")) { try { Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/users/$($r.UserId)/mailFolders/inbox/messageRules/$($r.RuleId)" -Body (@{ isEnabled = $false } | ConvertTo-Json) -ErrorAction Stop | Out-Null Write-TTLog -Level ACTION -Message "Disabled forwarding rule '$($r.Rule)' for '$($r.UPN)'." $done = $true } catch { Write-TTLog -Level WARN -Message "Could not disable rule for '$($r.UPN)': $_" } } [pscustomobject]@{ User = $r.User; UPN = $r.UPN; Rule = $r.Rule; External = $r.External; Disabled = $done; WhatIf = [bool]$WhatIfPreference } } } |