Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Disable Transport Rule [FIX-9002]

This remediation disables an Exchange Online transport rule (mail flow rule) by its identity. The rule is set to a disabled state but is not deleted, so it remains in the Exchange admin center for review and can be re-enabled when needed.

Unlike an inbox rule, which acts on a single mailbox, a transport rule applies organisation-wide at the mail-flow level. Disabling a malicious or misconfigured transport rule stops it from affecting mail for the entire tenant.

Rationale

Transport rules are a high-impact target because they operate on all mail flowing through the organisation. An attacker who gains administrative access can create a transport rule to silently bcc or redirect inbound or outbound mail to an external address, to strip safety headers or warning banners, or to whitelist their own phishing infrastructure past anti-spam controls. Because the rule lives in mail flow rather than in a user's mailbox, it is easy to overlook and affects every user at once.

Disabling the rule immediately removes it from the active mail-flow pipeline, stopping the unwanted behaviour for the whole tenant. Keeping the rule in place (disabled) preserves its full configuration (conditions, actions, and exceptions) so responders can document exactly what it did before deciding whether to delete it. Legitimate-but-misconfigured rules can simply be corrected and re-enabled.

This remediation runs Disable-TransportRule via the Exchange Online connector and reads the rule back with Get-TransportRule to confirm. It requires the Exchange.ManageAsApp permission plus a directory role that allows transport-rule management (such as Exchange Administrator).

Fix

An automated fix is available through Attic.

Manual steps:

  1. Open PowerShell and connect to Exchange Online: Connect-ExchangeOnline
  2. List all transport rules: Get-TransportRule
  3. Disable the specific rule by name or ID: Disable-TransportRule -Identity "RuleName"
  4. Verify the rule is disabled: Get-TransportRule -Identity "RuleName" | Select Name, State

Impact

  • The transport rule is no longer enforced; mail flow is processed as if the rule did not exist.
  • The change is organisation-wide, since transport rules apply to all mail flow.
  • The rule is disabled, not deleted; it remains in the Exchange admin center and can be re-enabled or removed manually.
  • Mail already processed by the rule before it was disabled is not reverted.

Revert

  1. Connect to Exchange Online: Connect-ExchangeOnline
  2. Re-enable the rule: Enable-TransportRule -Identity "RuleName"
  3. Verify: Get-TransportRule -Identity "RuleName" | Select Name, State

Alternatively, in the Exchange admin center at https://admin.exchange.microsoft.com go to Mail flow > Rules, select the rule and switch it On.

Re-enabling restores the rule with its original conditions, actions and exceptions, so nothing is lost by disabling it. Mail that flowed while the rule was off is not reprocessed. If the rule was legitimate but misconfigured, correct it before switching it back on.

More Information