Regular Microsoft Entra user with Exchange Online PowerShell enabled

This configuration does not grant elevated administrative control by itself. However, the presence of this configuration increases exposure if the user account is compromised or misused due to expanded remote automation access.

An attacker can use a compromised account with Exchange Online PowerShell enabled to execute commands that access mailboxes, modify inbox rules, configure forwarding SMTP addresses, or initiate mass phishing attacks by sending emails to other users in the tenant. This expanded capability supports later attacker activity, such as reconnaissance and persistence.

Cayosoft Guardian continuously monitors permissions and settings of regular user accounts for those that have been granted permission to use Exchange Online PowerShell, enabling detection of this configuration.

Cayosoft Guardian alerts administrators to review and limit unnecessary Exchange Online PowerShell access for regular users, reducing the actions available to an attacker if a user account is compromised by limiting remote command access.