Transport Rule & Connector Inventory

The question it answers: Which transport rules and connectors send mail outside the organisation, bypass spam filtering or reroute mail?

Mail-flow rules and connectors are where attackers hide after a compromise: a rule that quietly BCCs the CFO’s mail to an outside address, a rule that skips spam filtering for a spoofable domain, a connector that routes all outbound mail through someone else’s server. This inventory flags exactly those.

Note

Read through Exchange Online PowerShell with the app’s certificate, the same connection the existing Exchange reports use. The app needs an Exchange role that can read transport configuration (e.g. View-Only Organization Management).

At a glance

Where in the app	Exchange Online › Security › Transport Rules & Connectors
Workload	Exchange Online
Kind	Table · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	exchange.security.mail-flow-inventory

Columns

Column	Key	Type
Name	Name	Text
Kind	Kind	Text
Status	Severity	Status
Findings	FindingsString	Text
What it does	Summary	Text
Priority	Priority	Text
Changed	WhenChanged	Date

Filters

Filter	Key (API)	On when the page opens
Only items with a finding	findings	Yes

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application

Data sources it reads

• Get-TransportRule
• Get-InboundConnector
• Get-OutboundConnector
• Get-AcceptedDomain

Through the API and MCP

GET /ir-api/v1/reports/exchange.security.mail-flow-inventory?size=100
GET /ir-api/v1/reports/exchange.security.mail-flow-inventory?filter=findings

An AI assistant reads it with the MCP tool get_report and the id exchange.security.mail-flow-inventory. The client needs the Read grant for Exchange Online. See Using the API.