SecOps - 41035 - User reporting for phishing and spam is enabled and routed to a reviewed mailbox

[Sandeep Jha (sandeepjha000)]

Spec-41035

Issue-1020

[Copilot]

Pull request overview

Adds a new SecOps assessment (41035) to evaluate whether end-user phishing/spam reporting is enabled and routed to an actionable destination (Microsoft, a monitored SOC mailbox, or a third-party reporter), with corresponding markdown output content. It also updates the global Microsoft Graph scopes list to include a threat-submission scope intended to support an informational Graph probe.

Changes:

• Introduces Test-Assessment-41035 to query Exchange Online report submission policy/rule and generate a detailed markdown results table.
• Adds the Test-Assessment.41035.md narrative/remediation content for the assessment report.
• Adds ThreatSubmission.Read.All to the default Graph scopes returned by Get-ZtGraphScope.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/powershell/tests/Test-Assessment.41035.ps1	New assessment test to validate user reporting routes and emit a settings/results table (plus an informational Graph probe).
src/powershell/tests/Test-Assessment.41035.md	New report content/remediation links for assessment 41035.
src/powershell/public/Get-ZtGraphScope.ps1	Adds a new Graph permission scope intended for threat-submission API reachability checks.

Suppressed comments (1)

src/powershell/tests/Test-Assessment.41035.ps1:256

• The markdown section title says "User reported settings" but the link currently points to the user submissions report page ($portalUrl). This looks like an incorrect/dead-end link for the settings being evaluated.

    $mdInfo             = $formatTemplate -f $portalUrl, $tableRows, $graphNote
    $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (3)

src/powershell/tests/Test-Assessment.41035.ps1:143

• $anyRoute treats EnableReportToMicrosoft alone as a passing configuration. That can mark the test as passed even when no monitored SOC mailbox / reviewed destination is configured, which conflicts with the test title and the accompanying markdown that recommends routing to a monitored mailbox (and Microsoft). Align the pass criteria and/or title/output so a "pass" guarantees the intended reviewed routing.

    # Spec evaluation order: Pass → Investigate → Fail
    $anyRoute = $microsoftRoute -or $customMailboxRoute -or $thirdPartyRoute

    $passed       = $false
    $customStatus = $null

src/powershell/tests/Test-Assessment.41035.ps1:11

• The test performs a Microsoft Graph probe against /beta/security/threatSubmission/emailThreats but the comment-based help only lists Exchange cmdlets as required permissions. Document the optional Graph permission needed for the probe so operators understand the warning when it fails due to missing scopes.

    Required Module: ExchangeOnlineManagement
    Required permissions: Get-ReportSubmissionPolicy, Get-ReportSubmissionRule
#>

src/powershell/tests/Test-Assessment.41035.ps1:250

• The markdown header is labeled "User reported settings" but the generated link uses $portalUrl (user submissions view) rather than the settings URL. This makes the report link inconsistent with the label and with the earlier guidance link to /securitysettings/userSubmission.

    $mdInfo             = $formatTemplate -f $portalUrl, $tableRows, $graphNote