ms365
8 Dtwo policies tagged "ms365", including Block Agent Email to External Recipients, Block Mail-Rule and Webhook Persistence. Browse by what the control does rather than which app it targets.
Block Agent Email to External RecipientsBlocks agent-initiated Microsoft 365 email sends when any recipient address falls outside a corporate-domain allowlist.Block Mail-Rule and Webhook PersistenceUnconditionally denies the classic business-email-compromise (BEC) persistence surface in Microsoft 365: creating or updating Outlook mail rules, changing…Deny Graph API Batch Escape HatchBlocks the Microsoft 365 MCP server's raw-Graph passthrough tool (graph-batch, observed live as ms365-graph-batch).Freeze Destructive Microsoft 365 OperationsDenies every Microsoft 365 tool call whose verb segment is delete- or cancel- unless the caller's IdP token carries the placeholder group m365-admin.Freeze M365 Identity PlaneFreezes directory and membership mutations on the Microsoft 365 MCP surface. The policy denies, by tool-name suffix:Guard OneDrive/SharePoint Share LinksStops agents from opening OneDrive/SharePoint files to the whole internet. It guards the two Microsoft 365 sharing tools:Microsoft 365: Redact PII from Mail, Files & TranscriptsScans the responses of the highest-density PII read surfaces in Microsoft 365 — mail bodies, Excel ranges, SharePoint list items, meeting transcripts, and…Read-Only Baseline: Group-Gated Microsoft 365 WritesThe least-privilege baseline for Microsoft 365 through the gateway: every tool call is allowed only if it is a read , or the caller's IdP token carries the…