Commands › Exchange Online

Get-ATPProtectionPolicyRule

Exchange Online ExchangeOnlineManagement Get-*

View rules for Microsoft Defender for Office 365 protections in preset security policies. The rules specify recipient conditions and exceptions for the protection, and also allow you to turn on and turn off the associated preset security policies.

Quick start script

# Get-ATPProtectionPolicyRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-ATPProtectionPolicyRule | Format-List

# 3. Export for evidence / drift tracking
Get-ATPProtectionPolicyRule | Export-Clixml .\ATPProtectionPolicyRule-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-ATPProtectionPolicyRule [[-Identity] <RuleIdParameter>]
 [-State <RuleState>]
 [<CommonParameters>]

Parameters (2)

Parameter	Type	Required	What it controls
-Identity	RuleIdParameter		The Identity parameter specifies the rule that you want to view. You can use any value that uniquely identifies the rule. For example:
-State	RuleState		The State parameter filters the results by the state of the rule. Valid values are:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.