All scripts
Governance 371

Get-AntiPhishPolicyReport

Reports every anti-phishing policy's impersonation protection settings and which users or domains are protected, useful when confirming executive accounts are actually covered.

Get-AntiPhishPolicyReport.ps1
<#
.SYNOPSIS
    Reports anti-phishing policy impersonation protection settings.

.DESCRIPTION
    Lists every anti-phishing policy with impersonation protection status
    and the protected users/domains configured, so you can confirm the
    accounts that actually need impersonation protection, like executives
    and finance, are covered by a policy.

.EXAMPLE
    .\Get-AntiPhishPolicyReport.ps1

.NOTES
    Requires ExchangeOnlineManagement and an active Connect-ExchangeOnline session
    with Defender for Office 365 permissions.

.AUTHOR
    Shehryar Hassan
#>

$policies = Get-AntiPhishPolicy

$report = $policies | ForEach-Object {
    [pscustomobject]@{
        PolicyName            = $_.Identity
        Enabled               = $_.Enabled
        ImpersonationProtected = ($_.TargetedUsersToProtect -join ", ")
        ProtectedDomains      = ($_.TargetedDomainsToProtect -join ", ")
        MailboxIntelligence   = $_.EnableMailboxIntelligence
    }
}

$report | Format-Table -AutoSize

Read it before you run it, and test in a safe tenant first.