secOpsOverridePolicy

Security Team Override Policy. Exempt security-team mailboxes from filtering for phishing simulations. The secOpsOverridePolicy entity set lives under /exchange/v1.0/secOpsOverridePolicy in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/secOpsOverridePolicy`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-SecOpsOverridePolicy, Set-SecOpsOverridePolicy, New-SecOpsOverridePolicy, Remove-SecOpsOverridePolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/secOpsOverridePolicy`	List SecOps override policies - containers letting security-team phishing tests reach SOC mailboxes unfiltered.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/secOpsOverridePolicy`	Create a new secOpsOverridePolicy. Required: name. Use ?dryRun=true to preview without committing.	`ThreatPolicy.ReadWrite`	Enterprise
GET	`/exchange/v1.0/secOpsOverridePolicy/{key}`	Get a single secOpsOverridePolicy by Identity. Returns 404 if absent.	`ThreatPolicy.Read`	Community
PATCH	`/exchange/v1.0/secOpsOverridePolicy/{key}`	Partial update via Set-SecOpsOverridePolicy. Use delta-style addSentTo/removeSentTo for the SOC mailbox list.	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/secOpsOverridePolicy/{key}`	Remove a secOpsOverridePolicy. Use ?dryRun=true to preview without deletion.	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/secOpsOverridePolicy

List SecOps override policies - containers letting security-team phishing tests reach SOC mailboxes unfiltered.

Backing cmdlet: Get-SecOpsOverridePolicy. Role: ThreatPolicy.Read (Community).

List secOpsOverridePolicy

Stub auto-generated example for the secOpsOverridePolicy collection. Backing cmdlet: Get-SecOpsOverridePolicy. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/secOpsOverridePolicy?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#secOpsOverridePolicy",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/secOpsOverridePolicy

Create a new secOpsOverridePolicy. Required: name. Use ?dryRun=true to preview without committing.

Backing cmdlet: New-SecOpsOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`name`	body		yes
`sentTo`	body		yes
`comment`	body
`enabled`	body
`dryRun`	query	bool (switch)

Create rejected - missing required SentTo

New-SecOpsOverridePolicy requires both name and sentTo. Omitting sentTo returns a 400 BadRequest from the body-allowlist validation before the cmdlet is invoked.

POST /exchange/v1.0/secOpsOverridePolicy HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-secOpsOverridePolicy",
  "comment": "Exonaut SecOps phishing-test override"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The field 'sentTo' is required.",
    "target": "sentTo"
  },
  "correlationId": "0HN7K2P4QF9CD:00000003"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a SecOps override policy

Creates a SecOps mailbox override policy via New-SecOpsOverridePolicy, letting security-team phishing-test emails bypass filtering for the listed SOC mailboxes.

POST /exchange/v1.0/secOpsOverridePolicy HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-secOpsOverridePolicy",
  "sentTo": [
    "soc-mailbox@contoso.com",
    "phishing-tests@contoso.com"
  ],
  "comment": "Exonaut SecOps phishing-test override",
  "enabled": true
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/secOpsOverridePolicy/exonaut-sample-secOpsOverridePolicy

{
  "Id": "exonaut-sample-secOpsOverridePolicy",
  "Identity": "exonaut-sample-secOpsOverridePolicy",
  "Name": "exonaut-sample-secOpsOverridePolicy",
  "SentTo": [
    "soc-mailbox@contoso.com",
    "phishing-tests@contoso.com"
  ],
  "Comment": "Exonaut SecOps phishing-test override",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/secOpsOverridePolicy/{key}

Get a single secOpsOverridePolicy by Identity. Returns 404 if absent.

Backing cmdlet: Get-SecOpsOverridePolicy. Role: ThreatPolicy.Read (Community).

Get a single secOpsOverridePolicy entry

Stub auto-generated example for GET /secOpsOverridePolicy/{key}. Backing cmdlet: Get-SecOpsOverridePolicy with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/secOpsOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#secOpsOverridePolicy/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/secOpsOverridePolicy/{key}

Partial update via Set-SecOpsOverridePolicy. Use delta-style addSentTo/removeSentTo for the SOC mailbox list.

Backing cmdlet: Set-SecOpsOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`addSentTo`	body
`comment`	body
`enabled`	body
`removeSentTo`	body
`dryRun`	query	bool (switch)

Update a SecOps override policy

Partial update via Set-SecOpsOverridePolicy. Uses delta-style addSentTo to extend the SOC mailbox list and toggles enabled/comment. Returns the updated entity.

PATCH /exchange/v1.0/secOpsOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "addSentTo": [
    "soc-tier2@contoso.com"
  ],
  "comment": "Exonaut SecOps override - Tier 2 added",
  "enabled": true
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-secOpsOverridePolicy",
  "Identity": "exonaut-sample-secOpsOverridePolicy",
  "Name": "exonaut-sample-secOpsOverridePolicy",
  "SentTo": [
    "soc-mailbox@contoso.com",
    "phishing-tests@contoso.com",
    "soc-tier2@contoso.com"
  ],
  "Comment": "Exonaut SecOps override - Tier 2 added",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/secOpsOverridePolicy/{key}

Remove a secOpsOverridePolicy. Use ?dryRun=true to preview without deletion.

Backing cmdlet: Remove-SecOpsOverridePolicy. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a SecOps override policy

Removes a SecOps override policy via Remove-SecOpsOverridePolicy. Returns 204 No Content on success.

DELETE /exchange/v1.0/secOpsOverridePolicy/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.