O365 Create/Update Name Spoof Rule for All Users

Created by Andrew Schott, Modified on Tue, Nov 8, 2022 at 1:50 PM by Andrew Schott

## Based on https://github.com/Scine/Office365/blob/master/Display%20Name%20Spoofing%20365.ps1



Connect-ExchangeOnline


While([String]::IsNullOrWhiteSpace($domain)){

    $domain = Read-Host -Prompt 'User domain (domain.com)'

}


$ruleName = "External Senders with matching Display Names"


$rule = Get-TransportRule | Where-Object {$_.Identity -contains $ruleName}

$displayNames = (Get-Mailbox | Where {$_.EmailAddresses -like "*@$domain"}).DisplayName


if (!$rule) {

    Write-Host "Rule not found, creating rule" -ForegroundColor Green

    New-TransportRule -Name $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true

}

else {

    Write-Host "Rule found, updating rule" -ForegroundColor Green

    Set-TransportRule -Identity $ruleName -Priority 0 -FromScope "NotInOrganization" -HeaderMatchesMessageHeader From -HeaderMatchesPatterns $displayNames -Quarantine $true

}

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article