Created by Claude - please verify

Transport rules and connectors - read-only. A flagged rule may be intentional (journaling, archiving, a mail gateway); confirm with its owner.

Required Microsoft Graph permissions

Exchange.ManageAsApp — application permission, granted to the app registration with admin consent.

Endpoints: Get-TransportRule · Get-InboundConnector · Get-OutboundConnector · Get-AcceptedDomain

Read through Exchange Online PowerShell with the app's certificate, the same connection the existing Exchange reports use. The app needs an Exchange role that can read transport configuration (e.g. View-Only Organization Management).

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Transport Rule & Connector Inventory

Mail-flow rules and connectors are where attackers hide after a compromise: a rule that quietly BCCs the CFO's mail to an outside address, a rule that skips spam filtering for a spoofable domain, a connector that routes all outbound mail through someone else's server. This inventory flags exactly those.