secOpsOverrideRules

Security Team Override Rules. Bind the security-team override to specific mailboxes. The secOpsOverrideRules entity set lives under /exchange/v1.0/secOpsOverrideRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/secOpsOverrideRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-ExoSecOpsOverrideRule, Set-ExoSecOpsOverrideRule, New-ExoSecOpsOverrideRule, Remove-ExoSecOpsOverrideRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/secOpsOverrideRules	List secOpsOverrideRules - the SOC mailbox + sender criteria attached to a secOpsOverridePolicy.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/secOpsOverrideRules	Create a secOpsOverrideRule attached to a secOpsOverridePolicy. Body lists SentTo SOC mailbox addresses.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/secOpsOverrideRules/{key}	Get a single secOpsOverrideRule by Identity. Returns 404 if absent.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/secOpsOverrideRules/{key}	Partial update via Set-ExoSecOpsOverrideRule. Use addSentTo/removeSentTo for the SOC mailbox list.	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/secOpsOverrideRules/{key}	Remove a secOpsOverrideRule. Use ?dryRun=true to preview without deletion.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/secOpsOverrideRules

List secOpsOverrideRules - the SOC mailbox + sender criteria attached to a secOpsOverridePolicy.

Backing cmdlet: Get-ExoSecOpsOverrideRule. Role: ThreatPolicy.Read (Community).

List secOpsOverrideRules

Stub auto-generated example for the secOpsOverrideRules collection. Backing cmdlet: Get-ExoSecOpsOverrideRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/secOpsOverrideRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#secOpsOverrideRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/secOpsOverrideRules/{key}

POST /exchange/v1.0/secOpsOverrideRules

Create a secOpsOverrideRule attached to a secOpsOverridePolicy. Body lists SentTo SOC mailbox addresses.

Backing cmdlet: New-ExoSecOpsOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
policy	body		yes
comment	body
name	body
dryRun	query	bool (switch)

Create rejected - missing required Policy

New-ExoSecOpsOverrideRule requires a Policy (the secOpsOverridePolicy the rule binds to). Omitting it fails validation before the cmdlet runs and returns the canonical 400 envelope.

POST /exchange/v1.0/secOpsOverrideRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-secOpsOverrideRules",
  "comment": "SecOps override rule for the Exonaut SOC mailbox."
}

HTTP/1.1 400 Bad Request

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'policy' is missing.",
    "target": "policy"
  },
  "correlationId": "0HN3K8M2P9QR7"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/secOpsOverrideRules

Create a SecOps override rule

Creates a SecOps mailbox override rule via New-ExoSecOpsOverrideRule. The rule is attached to an existing secOpsOverridePolicy (the Policy field) so that mail to the SOC mailbox bypasses filtering.

POST /exchange/v1.0/secOpsOverrideRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "policy": "exonaut-sample-secOpsOverridePolicy",
  "name": "exonaut-sample-secOpsOverrideRules",
  "comment": "SecOps override rule for the Exonaut SOC mailbox."
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/secOpsOverrideRules/exonaut-sample-secOpsOverrideRules

{
  "Id": "exonaut-sample-secOpsOverrideRules",
  "Identity": "exonaut-sample-secOpsOverrideRules",
  "Name": "exonaut-sample-secOpsOverrideRules",
  "Policy": "exonaut-sample-secOpsOverridePolicy",
  "Comment": "SecOps override rule for the Exonaut SOC mailbox."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/secOpsOverrideRules

GET /exchange/v1.0/secOpsOverrideRules/{key}

Get a single secOpsOverrideRule by Identity. Returns 404 if absent.

Backing cmdlet: Get-ExoSecOpsOverrideRule. Role: ThreatPolicy.Read (Community).

Get a single secOpsOverrideRules entry

Stub auto-generated example for GET /secOpsOverrideRules/{key}. Backing cmdlet: Get-ExoSecOpsOverrideRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/secOpsOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#secOpsOverrideRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/secOpsOverrideRules

PATCH /exchange/v1.0/secOpsOverrideRules/{key}

Partial update via Set-ExoSecOpsOverrideRule. Use addSentTo/removeSentTo for the SOC mailbox list.

Backing cmdlet: Set-ExoSecOpsOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comment	body
dryRun	query	bool (switch)

Update a SecOps override rule

Partial update via Set-ExoSecOpsOverrideRule. The Wiki Set surface is minimal - only Comment is writable. The updated entity is re-fetched and returned.

PATCH /exchange/v1.0/secOpsOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comment": "Updated: SecOps override rule for the Exonaut SOC mailbox (contoso.com)."
}

HTTP/1.1 200 OK

{
  "Id": "exonaut-sample-secOpsOverrideRules",
  "Identity": "exonaut-sample-secOpsOverrideRules",
  "Name": "exonaut-sample-secOpsOverrideRules",
  "Policy": "exonaut-sample-secOpsOverridePolicy",
  "Comment": "Updated: SecOps override rule for the Exonaut SOC mailbox (contoso.com)."
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/secOpsOverrideRules

DELETE /exchange/v1.0/secOpsOverrideRules/{key}

Remove a secOpsOverrideRule. Use ?dryRun=true to preview without deletion.

Backing cmdlet: Remove-ExoSecOpsOverrideRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete a SecOps override rule

Removes a SecOps override rule via Remove-ExoSecOpsOverrideRule. Returns 204 No Content on success. Use ?dryRun=true to preview without deletion.

DELETE /exchange/v1.0/secOpsOverrideRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/secOpsOverrideRules

?dryRun=true previews of any write stay on Community.