Defender for Office 365
- Anti-phishing, anti-spam, outbound spam and anti-malware policies, each with its rule.
- Safe Links and Safe Attachments policies, with their rules.
- Quarantine policies, created before the policies that name them. Built-in ones are left out.
- The Tenant Allow/Block List: senders, URLs and file hashes. Expired entries are left out.
- Default policies, the tenant-wide Safe Links and Safe Attachments settings, quarantine notification settings, and the Standard and Strict preset security policies are changed to match the source rather than created. Only settings that differ are changed.
Exchange Online
- Mail flow (transport) rules, created in test mode.
- Journal rules, created switched off.
- Remote domains, including the Default remote domain.
- Outlook on the web policies and mobile device mailbox policies, and their defaults.
- Mailbox retention tags and retention policies (MRM). Built-in tags are left out.
Domains, mailboxes and groups referenced by these policies are mapped too: partner domains are kept, .onmicrosoft.com domains are matched automatically, and addresses are rewritten with the domain's match.
Defender for Endpoint
Indicators (blocked or allowed files, IPs, URLs and certificates) and custom detection rules.
How it connects
Exchange Online and Security & Compliance PowerShell run inside the app, so there's nothing to install. The source tenant's sessions refuse anything but Get- cmdlets, so nothing can be written there. Only settings a New- cmdlet accepts are sent, and anything it can't take is listed for you to set by hand.
Rollback
Rollback removes what the run created and puts back the earlier values of default policies and settings it changed.