All 19 Exchange Online checks - what each one checks, why, and the access used to evaluate it.

19 checks. Column "Access used" lists the application permissions and collected data sources this check's evaluation reads; "None" means Watchtower reads no tenant data for it.

Check	Severity	What it checks	Why it matters	Access used
AuditBypassEnabled is not enabled on mailboxes `wt.exo.audit-bypass-disabled`	HIGH	Checks that no mailboxes have AuditBypassEnabled set to true, which would cause all mailbox actions performed by associated accounts to be omitted from the audit log.	Audit bypass suppresses the audit trail for any account or service account granted the bypass. Attackers or malicious insiders who gain access to an account with audit bypass can read, modify, or delete mailbox contents without generating any log events, completely defeating forensic investigation capabilities.	`Exchange.ManageAsApp` - via `mailboxAuditBypassAssociations`
AuditDisabled organizationally is set to False `wt.exo.audit-enabled`	HIGH	Checks that mailbox auditing is not disabled at the organisation level in Exchange Online, ensuring all mailbox-level audit events are collected.	Disabling audit at the organisation level silently suppresses mailbox audit logs for all users, eliminating the forensic trail needed to detect and investigate email-based attacks including business email compromise, data exfiltration via email forwarding, and insider threats.	`Exchange.ManageAsApp` - via `organizationConfig`
External sharing of calendars is not available `wt.exo.calendar-external-sharing-disabled`	MEDIUM	Checks that the Default Sharing Policy in Exchange Online is disabled, preventing users from sharing calendar availability details with external email addresses.	External calendar sharing reveals meeting titles, attendees, locations, and free/busy details to external parties. Attackers use this information for targeted spear-phishing, scheduling-based social engineering, and to map organisational structures and travel patterns for physical or cyber attacks.	`Exchange.ManageAsApp` - via `sharingPolicies`
Direct Send submissions are rejected `wt.exo.direct-send-rejected`	MEDIUM	Checks that Exchange Online is configured to reject Direct Send (unauthenticated SMTP sent directly to MX with a From address in a verified tenant domain) so that internal-looking spoofed mail cannot bypass authentication checks.	Direct Send allows any host with network access to the MX record to send email appearing to come from a tenant domain without authenticating. This is exploited for internal spear-phishing and business email compromise where attackers spoof an internal sender address to bypass user suspicion.	`Exchange.ManageAsApp` - via `organizationConfig`
DKIM is enabled for all Exchange Online domains `wt.exo.dkim-enabled`	HIGH	Checks that DomainKeys Identified Mail (DKIM) signing is enabled for every verified Exchange Online domain, ensuring outbound messages carry a cryptographic signature that receiving servers can validate.	DKIM allows receiving mail servers to verify that email claiming to come from your domain was actually sent by your authorised mail infrastructure and has not been tampered with in transit. Without DKIM, threat actors can send spoofed email from your domain that passes SPF checks (e.g. from a permitted relay), enabling business email compromise.	`Exchange.ManageAsApp` - via `dkimSigningConfig`, `domainDnsRecords`
DMARC records for all Exchange Online domains are published `wt.exo.dmarc-published`	HIGH	Checks that a DMARC record with at least a quarantine or reject policy is published in DNS for every Exchange Online domain, instructing receiving mail servers how to handle messages that fail SPF and DKIM alignment.	Without DMARC, even with SPF and DKIM in place, receiving mail servers have no instruction on what to do with failing messages, leaving your domain open to spoofing attacks that reach recipients. DMARC with a `p=reject` policy prevents attackers from sending email that appears to come from your domain to external recipients.	None - public data only - via `domainDnsRecords`
Email from external senders is identified `wt.exo.external-sender-tagged`	MEDIUM	Checks that Exchange Online is configured to display an External tag in Outlook when email is received from outside the organisation, alerting users before they interact with potentially suspicious messages.	Visual external sender indicators reduce the effectiveness of phishing and business email compromise by training users to pause before acting on email from external sources. Without the tag, spoofed internal-looking addresses from external domains are indistinguishable from legitimate internal mail at a glance.	`Exchange.ManageAsApp` - via `externalInOutlook`
Mailbox audit actions are configured `wt.exo.mailbox-audit-actions`	HIGH	Checks that each user mailbox has auditing enabled with the recommended set of actions logged for admin, delegate, and owner access types.	Mailbox audit logs are essential for detecting and investigating business email compromise, insider data theft, and suspicious delegation. Without comprehensive audit action coverage, critical events such as message deletion, forwarding rule creation, and folder permission changes go unlogged, leaving gaps in forensic evidence.	`Exchange.ManageAsApp` - via `userMailboxes`
MailTips are enabled for end users `wt.exo.mailtips-enabled`	MEDIUM	Checks that MailTips are enabled for all tips including external recipients and group metrics, providing users with warnings before sending email to external parties or large distribution lists.	MailTips act as a last-line-of-defence prompt against accidental data disclosure - warning users when they are about to send sensitive information to external recipients, large groups, or addresses that generate automatic responses. This reduces misdirected email, which is a leading cause of data breaches.	`Exchange.ManageAsApp` - via `organizationConfig`
Modern authentication for Exchange Online is enabled `wt.exo.modern-auth-enabled`	MEDIUM	Checks that modern authentication (OAuth 2.0) is enabled for Exchange Online, allowing Conditional Access policies and MFA to be enforced on mail clients.	Without modern authentication, email clients fall back to basic authentication which does not support MFA or Conditional Access enforcement. Blocking legacy authentication (wt.entra.ca.legacy-auth-blocked) while disabling modern auth would lock users out - but more critically, without modern auth, clients cannot benefit from Identity Protection signals or phishing-resistant authentication methods.	`Exchange.ManageAsApp` - via `organizationConfig`
Mail transport rules do not whitelist specific domains `wt.exo.no-domain-whitelist-rules`	MEDIUM	Checks that no Exchange Online mail flow (transport) rules are configured to bypass spam filtering or mark messages as safe based on the sender's domain.	Transport rules that whitelist domains at the mail flow layer bypass all EOP and Defender for Office 365 filtering for messages matching the rule, regardless of how malicious the content is. If the permitted domain is spoofed or its mail infrastructure is compromised, attackers can deliver phishing and malware-laden messages directly to inboxes.	`Exchange.ManageAsApp` - via `transportRules`
No transport rules redirect email to external domains `wt.exo.no-external-forwarding-rules`	CRITICAL	Checks that no Exchange Online transport (mail flow) rules are configured to automatically redirect or forward messages to external email addresses or domains.	External email forwarding via transport rules is one of the most common data exfiltration techniques used after business email compromise. Once an attacker has access to an administrator account, they can create a transport rule that silently copies all mail to an external address - a technique that persists even after the compromised account's password is reset.	`Exchange.ManageAsApp` - via `transportRules`
Outbound anti-spam message limits are in place `wt.exo.outbound-spam-limits`	MEDIUM	Checks that outbound spam filter policies enforce recipient-per-hour and per-day limits and automatically block users who exceed them, with administrator notification enabled.	A compromised mailbox used for mass outbound spam or phishing campaigns can damage the organisation's email reputation, result in the tenant's IP ranges being blocklisted, and signal an active account compromise. Recipient limits and automatic blocking provide early warning and containment when an account is being abused.	`Exchange.ManageAsApp` - via `hostedOutboundSpamFilterPolicies`
Outbound spam policy has auto-forwarding disabled `wt.exo.outbound-spam-no-auto-forward`	MEDIUM	Checks that automatic email forwarding to external addresses is disabled in outbound spam filter policies, preventing users or attackers from silently redirecting mailbox traffic to external destinations.	Auto-forwarding to external addresses is a primary data exfiltration technique used in business email compromise. Attackers who compromise a mailbox immediately configure forwarding rules to receive a copy of all incoming mail, including invoices, financial data, and credentials - while the compromise often goes undetected for weeks.	`Exchange.ManageAsApp` - via `hostedOutboundSpamFilterPolicies`
Users installing Outlook add-ins is not allowed `wt.exo.outlook-addins-blocked`	MEDIUM	Checks that users are prevented from installing their own Outlook add-ins, ensuring only administrator-approved add-ins are available in the mail client.	Malicious or poorly-secured Outlook add-ins can read all email content, extract attachments, and forward data to external services without user awareness. Preventing self-service add-in installation ensures all integrations with the mail client are reviewed and approved, reducing the data-exfiltration and supply-chain attack surface.	`OrgSettings-AppsAndServices.Read.All` - via `appsAndServices`
Additional storage providers are restricted in Outlook on the web `wt.exo.owa-additional-storage-restricted`	MEDIUM	Checks that the OWA mailbox policy is configured to prevent users from connecting third-party cloud storage providers (such as Dropbox or Google Drive) to Outlook on the web.	Third-party storage integrations in OWA allow users to attach files directly from and save files to external cloud services, creating an uncontrolled data exfiltration channel that bypasses DLP controls and corporate data governance policies.	`Exchange.ManageAsApp` - via `owaMailboxPolicies`
SMTP AUTH is disabled `wt.exo.smtp-auth-disabled`	HIGH	Checks that SMTP AUTH (client SMTP submission on port 587 with basic authentication) is disabled at the organisation level in Exchange Online.	SMTP AUTH uses basic authentication and does not support MFA or Conditional Access enforcement. Attackers with stolen credentials can use SMTP AUTH to send email from a compromised account without triggering sign-in risk detections, bypassing modern authentication controls entirely and enabling persistent email abuse even after MFA is enforced via Conditional Access.	`Exchange.ManageAsApp` - via `transportConfig`
Exchange Online Spam Policies are set to notify administrators `wt.exo.spam-admin-notification-enabled`	MEDIUM	Checks that outbound spam filter policies are configured to notify and BCC administrators when a user sends a message that is identified as suspicious outbound spam.	Outbound suspicious mail notifications are an early-warning signal for compromised accounts being used to send spam or phishing campaigns. Prompt notification allows the security team to investigate and block the account before the tenant's sending reputation is damaged and the domain is blocklisted.	`Exchange.ManageAsApp` - via `hostedOutboundSpamFilterPolicies`
SPF records are published for all Exchange domains `wt.exo.spf-records-published`	HIGH	Checks that a valid SPF TXT record is published in DNS for every verified Exchange Online domain, authorising Microsoft's mail servers to send on behalf of the domain.	Without SPF, any server on the internet can send email appearing to come from your domain and receiving mail servers have no mechanism to verify the sender's legitimacy. This enables spoofing attacks that bypass basic sender identity checks, supporting phishing campaigns that target your partners, customers, and employees.	None - public data only - via `domainDnsRecords`