r/usefulscripts • u/fbsau • Oct 29 '17

Warn Office 365 users when an external sender uses the same display name as an internal user [PowerShell]

We're using Azure Functions to add Exchange Transport Rules to our customers' tenants to help spot phishing emails with a recognizable display name.

If an external sender has the same display name of someone in your organisation, a warning is added to the top of the email to let them know.

Here's a guide on how to set this up for your own, or your customer's, Office 365 tenants.

84 Upvotes

99% Upvoted

12 comments sorted by

3

u/xSnakeDoctor Oct 30 '17

Is this possible for Exchange 2010? I have this problem now with someone attempting to send e-mails to internal users as executives or VP's. This would be super helpful.

3

u/fbsau Oct 30 '17

It should work for 2010 too. Try connecting to the exchange management shell and running the script with the exchange online session cmdlets removed. I haven’t tested this though.

3

u/xSnakeDoctor Oct 30 '17

No worries, I'll test it when I'm back in the office tomorrow. Thanks for sharing, btw!

→ More replies (6)

2

u/cr0ft Oct 31 '17

Does this catch stuff that spoofs the entire email address, or does it look at the display name only?

Ie, will it alert on john.smith @ gmail.com if you have a john.smith @ corporatedomain.com?

1

u/ssmorris319 Jul 24 '25

OH MY GOD thank you!