Exfiltration rules

Exfiltration rules look for paths that move business data out of the tenant. The category carries the highest scoring multiplier, 2.0, so a single exfiltration finding dominates a flow’s risk score.

EXF-02 — Email Exfiltration (High)

What it checks. Actions on the Office 365 Outlook or mail connectors. The rule extracts email addresses from the action inputs and flags any recipient domain outside a built-in allowlist: company.com, microsoft.com, onmicrosoft.com.

Why it matters. A flow that mails data to an outside address is a direct exfiltration path.

What to do. Restrict email destinations to approved domains and use DLP policies to block external email connectors on sensitive flows. Note that the allowlist is fixed in the rule; if your tenant uses other domains, expect findings on legitimate flows and review the flagged domains in each finding.

EXF-03 — HTTP Exfiltration Risk (High)

What it checks. HTTP actions that use POST, PUT, or PATCH against a host outside a Microsoft allowlist (graph.microsoft.com, *.sharepoint.com, *.microsoft.com, login.microsoftonline.com, *.azure.com, *.windows.net, *.office.com, *.office365.com). The rule only fires when the flow also reads business data through connectors such as SharePoint, SQL, Dynamics 365, Excel, or OneDrive. If the target host cannot be determined from the action inputs, the rule treats the call as external.

Why it matters. Reading business data and then writing it to an arbitrary endpoint is the exfiltration pattern this rule exists to catch.

What to do. Review the endpoint named in the finding. Whitelist approved endpoints only, and prefer managed connectors over raw HTTP actions.

EXF-04 — Anonymous File Sharing (High)

What it checks. SharePoint actions that create a sharing link with anonymous scope (createsharinglink combined with anonymous).

Why it matters. An anonymous link opens the file to anyone who holds the URL. No sign-in, and no record of who used it.

What to do. Replace anonymous links with organization-only or specific-people links, and audit existing shared links regularly.

Last updated: July 27, 2026