Skip to content

Commit 8165b24

Browse files
isgq-github01isgq-github01
committed
ISGQ only - enable EWS on shared mailbox
1 parent 027dc6a commit 8165b24

2 files changed

Lines changed: 118 additions & 124 deletions

File tree

‎Config/standards.json‎

Lines changed: 25 additions & 124 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,20 @@
3939
"powershellEquivalent": "Set-MsolCompanyContactInformation",
4040
"recommendedBy": []
4141
},
42+
{
43+
"name": "standards.EnableEWSOnSharedMailbox",
44+
"cat": "Exchange Standards",
45+
"tag": [],
46+
"helpText": "Enable EWS on shared mailboxes, required for some backup products to continue functioning.",
47+
"docsDescription": "Enable EWS on shared mailboxes, required for some backup products to continue functioning.",
48+
"executiveText": "Enable EWS on shared mailboxes, required for some backup products to continue functioning.",
49+
"label": "Enable EWS on Shared Mailboxes",
50+
"disabledFeatures": { "report": true, "warn": true, "remediate": false },
51+
"impact": "Medium Impact",
52+
"impactColour": "warning",
53+
"addedDate": "2026-04-15",
54+
"powershellEquivalent": "Set-CASMailbox -Identity 'sharedmailbox@domain.com' -EwsEnabled $true & Set-OrganizationConfig -EwsEnabled $true"
55+
},
4256
{
4357
"name": "standards.DeployMailContact",
4458
"cat": "Exchange Standards",
@@ -4779,7 +4793,7 @@
47794793
}
47804794
]
47814795
},
4782-
{
4796+
{
47834797
"type": "switch",
47844798
"name": "standards.TeamsGlobalMeetingPolicy.AllowPSTNUsersToBypassLobby",
47854799
"label": "Allow dial-in users to bypass lobby"
@@ -5106,10 +5120,7 @@
51065120
"condition": {
51075121
"field": "standards.TeamsFederationConfiguration.DomainControl.value",
51085122
"compareType": "isOneOf",
5109-
"compareValue": [
5110-
"AllowSpecificExternal",
5111-
"BlockSpecificExternal"
5112-
]
5123+
"compareValue": ["AllowSpecificExternal", "BlockSpecificExternal"]
51135124
}
51145125
}
51155126
],
@@ -5847,34 +5858,22 @@
58475858
"name": "standards.DeployCheckChromeExtension",
58485859
"cat": "Intune Standards",
58495860
"tag": [],
5850-
"helpText": "Deploys the Check by CyberDrain browser extension via a Win32 script app in Intune for both Chrome and Edge browsers with configurable settings. Chrome ID: benimdeioplgkhanklclahllklceahbe, Edge ID: knepjpocdagponkonnbggpcnhnaikajg",
5851-
"docsDescription": "Creates an Intune Win32 script application that writes registry keys to install and configure the Check by CyberDrain browser extension on managed devices for both Google Chrome and Microsoft Edge browsers. Uses a PowerShell detection script to enforce configuration drift — when settings change in CIPP the app is automatically redeployed.",
5852-
"executiveText": "Automatically deploys the Check by CyberDrain browser extension across all company devices with configurable security and branding settings, ensuring consistent security monitoring and compliance capabilities. This extension provides enhanced security features and monitoring tools that help protect against threats while maintaining user productivity.",
5861+
"helpText": "Deploys the Check Chrome extension via Intune OMA-URI custom policies for both Chrome and Edge browsers with configurable settings. Chrome ID: benimdeioplgkhanklclahllklceahbe, Edge ID: knepjpocdagponkonnbggpcnhnaikajg",
5862+
"docsDescription": "Creates Intune OMA-URI custom policies that automatically install and configure the Check Chrome extension on managed devices for both Google Chrome and Microsoft Edge browsers. This ensures the extension is deployed consistently across all corporate devices with customizable settings.",
5863+
"executiveText": "Automatically deploys the Check browser extension across all company devices with configurable security and branding settings, ensuring consistent security monitoring and compliance capabilities. This extension provides enhanced security features and monitoring tools that help protect against threats while maintaining user productivity.",
58535864
"addedComponent": [
5854-
{
5855-
"type": "switch",
5856-
"name": "standards.DeployCheckChromeExtension.showNotifications",
5857-
"label": "Show notifications",
5858-
"defaultValue": true
5859-
},
58605865
{
58615866
"type": "switch",
58625867
"name": "standards.DeployCheckChromeExtension.enableValidPageBadge",
58635868
"label": "Enable valid page badge",
5864-
"defaultValue": false
5869+
"defaultValue": true
58655870
},
58665871
{
58675872
"type": "switch",
58685873
"name": "standards.DeployCheckChromeExtension.enablePageBlocking",
58695874
"label": "Enable page blocking",
58705875
"defaultValue": true
58715876
},
5872-
{
5873-
"type": "switch",
5874-
"name": "standards.DeployCheckChromeExtension.forceToolbarPin",
5875-
"label": "Force pin extension to toolbar",
5876-
"defaultValue": false
5877-
},
58785877
{
58795878
"type": "switch",
58805879
"name": "standards.DeployCheckChromeExtension.enableCippReporting",
@@ -5886,68 +5885,27 @@
58865885
"name": "standards.DeployCheckChromeExtension.customRulesUrl",
58875886
"label": "Custom Rules URL",
58885887
"placeholder": "https://YOUR-CIPP-SERVER-URL/rules.json",
5889-
"helperText": "Enter the URL for custom rules if you have them. This should point to a JSON file with the same structure as the rules.json used for CIPP reporting.",
58905888
"required": false
58915889
},
58925890
{
58935891
"type": "number",
58945892
"name": "standards.DeployCheckChromeExtension.updateInterval",
58955893
"label": "Update interval (hours)",
5896-
"defaultValue": 24
5894+
"defaultValue": 12
58975895
},
58985896
{
58995897
"type": "switch",
59005898
"name": "standards.DeployCheckChromeExtension.enableDebugLogging",
59015899
"label": "Enable debug logging",
59025900
"defaultValue": false
59035901
},
5904-
{
5905-
"type": "switch",
5906-
"name": "standards.DeployCheckChromeExtension.enableGenericWebhook",
5907-
"label": "Enable generic webhook",
5908-
"defaultValue": false
5909-
},
5910-
{
5911-
"type": "textField",
5912-
"name": "standards.DeployCheckChromeExtension.webhookUrl",
5913-
"label": "Webhook URL",
5914-
"placeholder": "https://webhook.example.com/endpoint",
5915-
"required": false
5916-
},
5917-
{
5918-
"type": "autoComplete",
5919-
"multiple": true,
5920-
"creatable": true,
5921-
"required": false,
5922-
"name": "standards.DeployCheckChromeExtension.webhookEvents",
5923-
"label": "Webhook Events",
5924-
"placeholder": "e.g. pageBlocked, pageAllowed"
5925-
},
5926-
{
5927-
"type": "autoComplete",
5928-
"multiple": true,
5929-
"creatable": true,
5930-
"required": false,
5931-
"freeSolo": true,
5932-
"name": "standards.DeployCheckChromeExtension.urlAllowlist",
5933-
"label": "URL Allowlist",
5934-
"placeholder": "e.g. https://example.com/*",
5935-
"helperText": "Enter URLs to allowlist in the extension. Press enter to add each URL. Wildcards are allowed. This should be used for sites that are being blocked by the extension but are known to be safe."
5936-
},
59375902
{
59385903
"type": "textField",
59395904
"name": "standards.DeployCheckChromeExtension.companyName",
59405905
"label": "Company Name",
59415906
"placeholder": "YOUR-COMPANY",
59425907
"required": false
59435908
},
5944-
{
5945-
"type": "textField",
5946-
"name": "standards.DeployCheckChromeExtension.companyURL",
5947-
"label": "Company URL",
5948-
"placeholder": "https://yourcompany.com",
5949-
"required": false
5950-
},
59515909
{
59525910
"type": "textField",
59535911
"name": "standards.DeployCheckChromeExtension.productName",
@@ -5966,7 +5924,7 @@
59665924
"type": "textField",
59675925
"name": "standards.DeployCheckChromeExtension.primaryColor",
59685926
"label": "Primary Color",
5969-
"placeholder": "#F77F00",
5927+
"placeholder": "#0044CC",
59705928
"required": false
59715929
},
59725930
{
@@ -5978,7 +5936,7 @@
59785936
},
59795937
{
59805938
"name": "AssignTo",
5981-
"label": "Who should this app be assigned to?",
5939+
"label": "Who should this policy be assigned to?",
59825940
"type": "radio",
59835941
"options": [
59845942
{
@@ -6010,11 +5968,11 @@
60105968
"label": "Enter the custom group name if you selected 'Assign to Custom Group'. Wildcards are allowed."
60115969
}
60125970
],
6013-
"label": "Deploy Check by CyberDrain Browser Extension",
5971+
"label": "Deploy Check Chrome Extension",
60145972
"impact": "Low Impact",
60155973
"impactColour": "info",
60165974
"addedDate": "2025-09-18",
6017-
"powershellEquivalent": "Add-CIPPW32ScriptApplication",
5975+
"powershellEquivalent": "New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies'",
60185976
"recommendedBy": ["CIPP"]
60195977
},
60205978
{
@@ -6081,62 +6039,5 @@
60816039
"impactColour": "info",
60826040
"addedDate": "2025-11-19",
60836041
"powershellEquivalent": "New-GraphPostRequest to /beta/security/secureScoreControlProfiles/{id}"
6084-
},
6085-
{
6086-
"name": "standards.ColleagueImpersonationAlert",
6087-
"cat": "Exchange Standards",
6088-
"tag": [
6089-
"Exchange",
6090-
"Security",
6091-
"Transport Rules"
6092-
],
6093-
"helpText": "Creates/updates 5x Exchange Online transport rules (A-E, F-J, K-O, P-T, U-Z) that prepend an HTML disclaimer banner to inbound emails where the sender display name matches a mailbox in the organisation. Accepted tenant domains are always exempt automatically. Inactive users are removed and enabled users are added. Any manually configured sender or domain exemptions already present on existing rules are preserved.",
6094-
"docsDescription": "Creates five Exchange Online transport rules grouped by the first letter of user display names (A-E, F-J, K-O, P-T, U-Z). Each rule fires when an external sender's From header matches a display name in that group, prepends a configurable HTML warning banner, and skips emails from accepted organisational domains. Any manually configured sender or domain exemptions on existing rules are preserved when the standard runs. The disclaimer HTML is fully customisable via the standard settings.",
6095-
"executiveText": "Protects staff from display-name impersonation attacks by injecting a visible warning banner on emails that appear to come from a colleague but originate externally. Rules are maintained automatically across all letter groups and updated whenever the standard runs.",
6096-
"addedComponent": [
6097-
{
6098-
"type": "heading",
6099-
"label": "Alert Banner (HTML)",
6100-
"required": false
6101-
},
6102-
{
6103-
"type": "textField",
6104-
"name": "standards.ColleagueImpersonationAlert.disclaimerHtml",
6105-
"label": "Disclaimer HTML – Paste the full HTML for the warning banner",
6106-
"required": true
6107-
},
6108-
{
6109-
"type": "heading",
6110-
"label": "Keyword Exclusions (Exclude certain users by keywords)",
6111-
"required": false
6112-
},
6113-
{
6114-
"type": "autoComplete",
6115-
"name": "standards.ColleagueImpersonationAlert.excludedMailboxes",
6116-
"label": "Exclude mailboxes by keywords for example any Displayname starting with (Leaver)",
6117-
"multiple": true,
6118-
"creatable": true,
6119-
"required": false
6120-
},
6121-
{
6122-
"type": "heading",
6123-
"label": "Exempt Senders (Email Accounts)",
6124-
"required": false
6125-
},
6126-
{
6127-
"type": "autoComplete",
6128-
"name": "standards.ColleagueImpersonationAlert.additionalExemptSenders",
6129-
"label": "Additional exempt sender addresses",
6130-
"multiple": true,
6131-
"creatable": true,
6132-
"required": false
6133-
}
6134-
],
6135-
"label": "Colleague Impersonation Alert Transport Rules",
6136-
"impact": "Medium Impact",
6137-
"impactColour": "warning",
6138-
"addedDate": "2026-03-22",
6139-
"powershellEquivalent": "New-TransportRule / Set-TransportRule",
6140-
"recommendedBy": []
61416042
}
61426043
]

‎Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableEWSOnSharedMailbox.ps1‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
function Invoke-CIPPStandardEnableEWSOnSharedMailbox {
2+
<#
3+
.FUNCTIONALITY
4+
Internal
5+
.COMPONENT
6+
(APIName) EnableEWSOnSharedMailbox
7+
.SYNOPSIS
8+
(Label) ISGQ only - Enable EWS on shared mailboxes accounts
9+
.DESCRIPTION
10+
(Helptext) Enable EWS on shared mailboxes, required for CW Backup to continue functioning. Can kill off from October 2026.
11+
(DocsDescription) Enable EWS on shared mailboxes, required for some backup products to continue functioning. Can kill off from October 2026.
12+
.NOTES
13+
CAT
14+
Exchange Standards
15+
TAG
16+
17+
EXECUTIVETEXT
18+
Enable EWS on shared mailboxes, required for some backup products to continue functioning. Can kill off from October 2026.
19+
ADDEDCOMPONENT
20+
IMPACT
21+
Medium Impact
22+
ADDEDDATE
23+
2026-04-15
24+
POWERSHELLEQUIVALENT
25+
Set-CASMailbox -Identity "sharedmailbox@domain.com" -EwsEnabled $true & Set-OrganizationConfig -EwsEnabled $true
26+
RECOMMENDEDBY
27+
28+
UPDATECOMMENTBLOCK
29+
Run the Tools\Update-StandardsComments.ps1 script to update this comment block
30+
.LINK
31+
https://docs.cipp.app/user-documentation/tenant/standards/list-standards
32+
#>
33+
34+
param($Tenant, $Settings)
35+
36+
try {
37+
$SharedMailboxList = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{filter = "RecipientTypeDetails -eq 'SharedMailbox'" }
38+
}
39+
catch {
40+
$ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
41+
Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SharedMailbox for $Tenant. Error: $ErrorMessage" -Sev Error
42+
return
43+
}
44+
45+
if ($Settings.remediate -eq $true) {
46+
if ($SharedMailboxList.Count -gt 0) {
47+
$AuditState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').EwsEnabled
48+
if (!($AuditState)) {
49+
New-ExoRequest -tenantid $Tenant -cmdlet 'Set-OrganizationConfig' -cmdParams @{EwsEnabled = $true }
50+
}
51+
$Request = $SharedMailboxList | ForEach-Object {
52+
@{
53+
CmdletInput = @{
54+
CmdletName = 'Set-CASMailbox'
55+
Parameters = @{Identity = $_.UserPrincipalName; EwsEnabled = $true }
56+
}
57+
}
58+
}
59+
60+
$BatchResults = New-ExoBulkRequest -tenantid $tenant -cmdletArray @($Request)
61+
$BatchResults | ForEach-Object {
62+
if ($_.error) {
63+
$ErrorMessage = Get-NormalizedError -Message $_.error
64+
Write-Host "Failed to enable EWS for $($_.target). Error: $ErrorMessage"
65+
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to enable EWS for $($_.target). Error: $ErrorMessage" -sev Error
66+
}
67+
}
68+
69+
}
70+
71+
<#if ($Settings.alert -eq $true) {
72+
73+
if ($SharedMailboxList) {
74+
Write-StandardsAlert -message "Shared mailboxes with enabled accounts: $($SharedMailboxList.Count)" -object $SharedMailboxList -tenant $Tenant -standardName 'DisableSharedMailbox' -standardId $Settings.standardId
75+
Write-LogMessage -API 'Standards' -tenant $Tenant -message "Shared mailboxes with enabled accounts: $($SharedMailboxList.Count)" -sev Info
76+
} else {
77+
Write-LogMessage -API 'Standards' -tenant $Tenant -message 'All Entra accounts for shared mailboxes are disabled.' -sev Info
78+
}
79+
}
80+
81+
if ($Settings.report -eq $true) {
82+
$State = $SharedMailboxList ? $SharedMailboxList : @()
83+
84+
$CurrentValue = [PSCustomObject]@{
85+
DisableSharedMailbox = @($State)
86+
}
87+
$ExpectedValue = [PSCustomObject]@{
88+
DisableSharedMailbox = @()
89+
}
90+
91+
Set-CIPPStandardsCompareField -FieldName 'standards.EnableEWSOnSharedMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant#>
92+
}
93+
}

0 commit comments

Comments
 (0)