Public Folder Exposure
The question it answers: Which public folders accept mail from the internet or are shared with everyone or anonymous users?
Old public folders are often mail-enabled and accept mail from anyone on the internet, and are often shared with Default (every user) or Anonymous with edit rights. They are also a common EWS dependency (see EWS Retirement Readiness).
At a glance
Section titled “At a glance”| Where in the app | Exchange Online › Mail Security & Hygiene › Public Folder Exposure |
| Workload | Exchange Online |
| Kind | Findings list · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | exchange.hygiene.public-folders |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Folder type | Category | Text |
| Folder path | Subject | Link |
| Check | Setting | Text |
| Owners | Value | Text |
| Finding | Finding | Text |
| Address / size | Detail | Text |
| Last modified | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Exchange.ManageAsApp | Office 365 Exchange Online | Manage Exchange As Application | + View-Only Organization Management / Public Folders role |
Data sources it reads
Get-PublicFolder -RecurseGet-MailPublicFolderGet-PublicFolderClientPermissionGet-PublicFolderStatistics
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/exchange.hygiene.public-folders?size=100POST /ir-api/v1/reports/exchange.hygiene.public-folders/scanAn AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.public-folders. The client needs the Run scan grant for Exchange Online. See Using the API.