Revise Implementation Steps for MS.EXO.7.1v1

[adhilto]

Prerequisites

• This issue has an informative and human-readable title.

💡 Summary

Add flexibility in how MS.EXO.7.1v1 can be implemented, as there are multiple valid methods.

Motivation and context

MS.EXO.7.1v1, "External sender warnings SHALL be implemented," has multiple possible implementations. The current baseline implementation steps suggest using mail flow rules to add the warning. The Rego checks to ensure that a mail flow rule exists that:

• Is enabled
• Is enforced
• Targets mail from external senders
• Prepends something to the subject line

The baseline and Rego implementations are at the same time to proscriptive (there are other ways of doing this) and too vague (we don't proscribe what to prepend to the subject in the baseline so the Rego can't check what is being prepended).

The primary alternative to using mail flow rules is Set-ExternalOutlook. Multiple users have reported using this method (e.g., #1624). Also, this is the approach recommended by the latest CIS benchmark.

Implementation notes

• Identify the different ways MS.EXO.7.1v1 could be implemented
• Identify the limitations associated with each
• Adjust the baseline implementation steps to allow all methods with acceptable limitations
• Update the Rego code to reflect the updated implementation steps in the baseline

Acceptance criteria

• The baseline implementation is updated
• The Rego implementation is updated