Exchange External Sender Policy: Multiple Rules not iterated through

[skirkpatrickms]

For Exchange 2.7, the script marks this check as not implemented if Multiple External Sender Policies are present, and the first policy is disabled but the follow-on rules are appropriately configured. Suggest iterating through the policies and checking the configs of each to determine the outcome.

[rgbrow1949]

Hi Patrick, I've been working to replicate this bug so I try and fix it but I have not been able to. Scuba will correctly flag the test as incorrect if no compliant mail flow rule is present and will mark the test as a success if any such rule exists that meets the criteria regardless of where it is.

I have tried:

1. Creating a second new mail flow that is in compliance with the baseline and disabled the first rule.
2. Misconfiguring the first rule and created a second mail flow rule that is compliant.

What steps did you take to find this bug?

Something incorrect I have noticed is that even if the rule is disabled, if the rule would be compliant, the test is marked as success.

[skirkpatrickms]

Give me a bit to pull the information from the customer tenant and sanitize it. Maybe you can mirror those settings and test.
There are a few checks that are doing this same thing.

[skirkpatrickms]

Something incorrect I have noticed is that even if the rule is disabled, if the rule would be compliant, the test is marked as success. ----This is what we were noticing.

[rgbrow1949]

I have made pull request #130 where the Rego will now only examine enabled rules if they are correctly configured or not. Now for 2.7 to pass there must be at least one correctly configured rule that is enabled.