Intend of this document is to automate whitelisting Right Hand Cyber Security Platform IP(s) and Domain(s) in Office 365 - Specifically when customers/partners have a large number of accounts to onboard onto the Right-Hand platform. Inspired by the manual process for whitelisting the RHC platform in Office 365 documented in this link.
Requirements:
Operating Systems: Windows OS (Professional, Server)
Tool: PowerShell
Credentials: Office 365
Authorization: Exchange Online
Roles that would require to execute operations:
Compliance Management
Organization Management
Records Management
Security Administrator
Hygiene Management
Note: The Office 365 user who is executing this script either should be part of the above-listed roles or should be a “Global Administrator”.
PowerShell script can be downloaded from this link
How to use the PowerShell script?
Extract provided zip archived file.
Open PowerShell as an Administrator.
Click Start, type PowerShell, right-click Windows PowerShell, and then click Run as administrator.
Go to the folder where
rhc-whitelist.zipis extracted.For Ex.
cd 'D:\rhc-whitelist\'
Execution
Execute the Script without passing any inline parameters.
./rhc-whitelist.ps1
Right Hand Cyber Security Whitelisting PowerShell script accepts two inline parameters
-IPListFilePathand-DomainListFilePath.By default, it fetches the IP list from
iplist.txtand Domain list fromdomainlist.txtwhich are already present in the folder in the same zip file available with the zip package.Optionally you can execute a script with Inline arguments
./rhc-whitelist.ps1 -IPListFilePath "<path_to_iplist.txt>" -DomainListFilePath ""<path_to_domain_list.txt>""
On execution, the script will prompt you to enter Office 365 login credentials.
In case, You entered MFA-enabled credentials, you will be prompted again to confirm with a defined method such as Text on a registered cell phone, or 6 digit code from MS Authenticator App.
After successfully entering the credentials, execution will take approximately 1-3 mins to complete. The output will appear as shown in the below screenshot if the execution is successful.
After successful execution, you will see these two rules enabled under Mail Flow -> Rules inside Microsoft Exchange.
Right Hand IP will be added in the Connection filter policy inside Threat Policy under Microsoft Security
