EOP & Defender for Office 365 Posture

The question it answers: Are the Exchange Online Protection and Defender for Office 365 protections switched on, and is automatic forwarding to outside addresses blocked?

Are the protections that stop phishing and malware actually switched on - preset policies, spoof intelligence, impersonation protection, Safe Links, Safe Attachments, zero-hour auto purge - and is automatic forwarding to outside addresses blocked?

At a glance

Where in the app	Exchange Online › Mail Security Posture › EOP & Defender for O365
Workload	Exchange Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online Protection; Defender for Office 365 Plan 1/2 for Safe Links, Safe Attachments and impersonation.
Report id (API and MCP)	exchange.posture.mail-protection

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Subject	Subject	Link
Setting	Setting	Text
Current value	Value	Text
Assessment	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: Exchange Online Protection; Defender for Office 365 Plan 1/2 for Safe Links, Safe Attachments and impersonation.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-EOPProtectionPolicyRule
• Get-ATPProtectionPolicyRule
• Get-AntiPhishPolicy
• Get-SafeLinksPolicy
• Get-SafeAttachmentPolicy
• Get-AtpPolicyForO365
• Get-HostedOutboundSpamFilterPolicy
• Get-MalwareFilterPolicy

Through the API and MCP

GET /ir-api/v1/reports/exchange.posture.mail-protection?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.posture.mail-protection. The client needs the Read grant for Exchange Online. See Using the API.