[GH-ISSUE #1424] Outlook Spoof Warning Not Working #789

Closed
opened 2026-03-02 12:45:15 +03:00 by kerem · 4 comments
Owner

Originally created by @CorneliousJD on GitHub (Mar 20, 2023).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1424

Description

I had been in discussion via Discord with MrGeek who I know was also in discussion with you as well at some point on this.

The issue is that the spoof warning set to be turned on only logs in the CIPP logs as "Spoofing warnings set to false" when it should be ENABLING it for all of them.
What's worse is after manually enabling it and then manually running a standard, it gets RESET to false again.

If I check later with Get-ExternalInOutlook it confirms that the Spoof warning is indeed set to false.
Here's a sample of that.
image
image

My Standards config is a single line in the standards table for AllTenants -- no other standards applied.
Note that I have also deleted/recreated this table, and tried to delete/recreate the standard on 3.1.0 and 3.2.0 but issues persist the same regardless.

My actual standard config is here, with e-mails redacted.
{ "Tenant": "AllTenants", "AddedBy": "me@domain.net", "AppliedAt": "2023-03-17T20:35:42", "Standards": { "SendFromAlias": true, "DisableSelfServiceLicenses": true, "AutoExpandArchive": true, "AnonReportDisable": true, "PWdisplayAppInformationRequiredState": true, "DelegateSentItems": true, "AuditLog": true, "DisableViva": true, "DisableUserSiteCreate": true, "NudgeMFA": true, "PasswordExpireDisabled": true, "TAP": { "Enabled": true, "config": "true" }, "DeletedUserRentention": true, "ModernAuth": true, "MailContacts": { "MarketingContact": { "Enabled": true, "Mail": "365marketing@domain.net" }, "GeneralContact": { "Enabled": true, "Mail": "365general@domain.net" }, "SecurityContact": { "Enabled": true, "Mail": "365security@domain.net" }, "TechContact": { "Enabled": true, "Mail": "365technical@domain.net" } }, "SecurityDefaults": true, "SpoofWarn": { "enable": true } }}

If I manually PowerShell into a tenant it does indeed let me enable it...
image

What's worse is after manually enabling it and then manually running a standard, it gets RESET to false again.

Environment data

self-hosted via Azure app, latest production version. (3.2 at time of writing)
Originally created by @CorneliousJD on GitHub (Mar 20, 2023). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1424 ### Description I had been in discussion via Discord with MrGeek who I know was also in discussion with you as well at some point on this. The issue is that the spoof warning set to be turned on only logs in the CIPP logs as "Spoofing warnings set to false" when it should be ENABLING it for all of them. **What's worse is after manually enabling it and then manually running a standard, it gets RESET to false again.** If I check later with Get-ExternalInOutlook it confirms that the Spoof warning is indeed set to false. Here's a sample of that. ![image](https://user-images.githubusercontent.com/724777/226338721-1e4148c6-5183-4fdc-a7cf-192b2ac814e7.png) ![image](https://user-images.githubusercontent.com/724777/226338781-d31572f2-238a-49a7-a542-08be098d8690.png) My Standards config is a single line in the standards table for AllTenants -- no other standards applied. Note that I have also deleted/recreated this table, and tried to delete/recreate the standard on 3.1.0 and 3.2.0 but issues persist the same regardless. My actual standard config is here, with e-mails redacted. `{ "Tenant": "AllTenants", "AddedBy": "me@domain.net", "AppliedAt": "2023-03-17T20:35:42", "Standards": { "SendFromAlias": true, "DisableSelfServiceLicenses": true, "AutoExpandArchive": true, "AnonReportDisable": true, "PWdisplayAppInformationRequiredState": true, "DelegateSentItems": true, "AuditLog": true, "DisableViva": true, "DisableUserSiteCreate": true, "NudgeMFA": true, "PasswordExpireDisabled": true, "TAP": { "Enabled": true, "config": "true" }, "DeletedUserRentention": true, "ModernAuth": true, "MailContacts": { "MarketingContact": { "Enabled": true, "Mail": "365marketing@domain.net" }, "GeneralContact": { "Enabled": true, "Mail": "365general@domain.net" }, "SecurityContact": { "Enabled": true, "Mail": "365security@domain.net" }, "TechContact": { "Enabled": true, "Mail": "365technical@domain.net" } }, "SecurityDefaults": true, "SpoofWarn": { "enable": true } }}` If I manually PowerShell into a tenant it does indeed let me enable it... ![image](https://user-images.githubusercontent.com/724777/226337863-ae4733d8-2965-4bba-b70d-673f047a26fa.png) **What's worse is after manually enabling it and then manually running a standard, it gets RESET to false again.** ### Environment data ```PowerShell self-hosted via Azure app, latest production version. (3.2 at time of writing) ```
kerem 2026-03-02 12:45:15 +03:00
Author
Owner

@github-actions[bot] commented on GitHub (Mar 20, 2023):

Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP
If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.".

Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".

<!-- gh-comment-id:1476140503 --> @github-actions[bot] commented on GitHub (Mar 20, 2023): Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.". Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".
Author
Owner

@CorneliousJD commented on GitHub (Mar 20, 2023):

I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.

<!-- gh-comment-id:1476141584 --> @CorneliousJD commented on GitHub (Mar 20, 2023): I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.
Author
Owner

@CorneliousJD commented on GitHub (Mar 20, 2023):

Worked with Kelvin via Discord chat.

Tested by created a new individual standard for one tenant that included ONLY enable spoof warn, which worked.
{ "Tenant": "tenant.com", "AddedBy": "me@domain.net", "AppliedAt": "2023-03-20T17:46:25", "Standards": { "SpoofWarn": { "enable": true } }}
image

Then I removed their individual standard and let them be part of the "AllTenants" standard again which flipped them back to having it disabled again. Confirmed this via Get-ExternalInOutlook cmdlet.

Once this is fixed under alltenants I can test and confirm that it is working correctly across various tenants.

<!-- gh-comment-id:1476708124 --> @CorneliousJD commented on GitHub (Mar 20, 2023): Worked with Kelvin via Discord chat. Tested by created a new individual standard for one tenant that included ONLY enable spoof warn, which worked. `{ "Tenant": "tenant.com", "AddedBy": "me@domain.net", "AppliedAt": "2023-03-20T17:46:25", "Standards": { "SpoofWarn": { "enable": true } }}` ![image](https://user-images.githubusercontent.com/724777/226428441-86a59a1a-caa7-4dd5-ba0a-653849930c5f.png) Then I removed their individual standard and let them be part of the "AllTenants" standard again which flipped them back to having it disabled again. Confirmed this via Get-ExternalInOutlook cmdlet. Once this is fixed under alltenants I can test and confirm that it is working correctly across various tenants.
Author
Owner

@KelvinTegelaar commented on GitHub (Mar 21, 2023):

Fixed in dev. @BNWEIN See latest commit for the changed you needed to make.

<!-- gh-comment-id:1477771183 --> @KelvinTegelaar commented on GitHub (Mar 21, 2023): Fixed in dev. @BNWEIN See latest commit for the changed you needed to make.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/CIPP#789
No description provided.