cloud-api policy
Use this command to configure Microsoft 365 and Google Workspace scan policies. You must have domain administrator privileges to access Microsoft 365 or Google Workspace.
Syntax
config cloud-api policy
edit <policy_index>
set source-type {geoip-group | ip-address | ip-group}
set source-ip-address {<client_ipv4mask> | <client_ipv6mask>}
set source-ip-group <ip-group_name>
set source-geoip-group <geoip-group_name>
set sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard}
set sender-name <username_str>
set sender-domain <sender_fqdn>
set sender-ad-group-attr {custom | displayname | mail}
set sender-ad-group-attr-name <attribute-name_str>
set sender-ad-group-attr-value <attribute-value_str>
set sender-email-group <group_name>
set sender-ldap-profile <profile_name>
set sender-pattern-regex <sender_pattern>
set recipient-type {ad-group | email-group | ldap-group | regex | wildcard}
set recipient-name <username_str>
set recipient-domain <recipient_fqdn>
set recipient-ad-group-attr {custom | displayname | mail}
set recipient-ad-group-attr-name <attribute-name_str>
set recipient-ad-group-attr-value <attribute-value_str>
set recipient-email-group <group_name>
set recipient-ldap-profile <profile_name>
set recipient-pattern-regex <recipient_pattern>
set profile-antispam <profile_name>
set profile-antivirus <profile_name>
set profile-content <profile_name>
set profile-dlp <profile_name>
end
|
Variable |
Description |
Default |
|
Enter an index number for the policy in the table. |
|
|
|
Select the name of a Microsoft 365 or Google Workspace account. |
|
|
|
Enter a description or comment. |
|
|
| profile-antispam <profile_name> | Select which antispam profile this policy will apply. |
|
| profile-antivirus <profile_name> | Select which antivirus profile this policy will apply. |
|
| profile-content <profile_name> | Select which content profile this policy will apply. |
|
| profile-dlp <profile_name> | Select which DLP profile this policy will apply. |
|
|
Select which attribute contains email addresses in your Microsoft Azure Entra ID (formerly Active Directory) directory schema, either:
Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
displayname |
|
|
Enter the name of the custom attribute. Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
|
|
|
Enter the attribute value that will match this policy. Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
|
|
| recipient-domain <recipient_fqdn> | Enter the domain part of the recipient email address. |
* |
|
Select an email address group. Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
|
|
|
Select an LDAP profile. Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
|
|
| recipient-name <username_str> |
Depending on how you chose to define matching email addresses, enter either the:
Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is |
* |
|
Enter a regular expression that matches only email addresses that this policy should apply to. See also regular expression syntax and examples in the FortiMail Administration Guide. Tip: To test and validate the regular expression, you can use the FortiMail GUI. Note: This setting is only available when recipient-type {ad-group | email-group | ldap-group | regex | wildcard} is regex. |
|
|
|
recipient-type {ad-group | email-group | ldap-group | regex | wildcard} |
Select how you want to define the recipient email addresses that match this policy, either:
|
wildcard |
|
Select which attribute contains email addresses in your Microsoft Azure Entra ID (formerly Active Directory) directory schema, either:
Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
displayname |
|
|
Enter the name of the custom attribute. Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
|
|
|
Enter the attribute value that will match this policy. Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
|
|
| sender-domain <sender_fqdn> | Enter the domain part of the sender email address. |
* |
|
Select an email group. Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
|
|
|
Select an LDAP profile. Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
|
|
| sender-name <username_str> |
Depending on how you chose to define matching email addresses, enter either the:
Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
* |
|
Enter a regular expression that matches only email addresses that this policy should apply to. See also regular expression syntax and examples in the FortiMail Administration Guide. Tip: To test and validate the regular expression, you can use the FortiMail GUI. Note: This setting is only available when sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} is |
|
|
| sender-type {ad-group | email-group | external | internal | ldap-group | regex | wildcard} |
Select how you want to define the sender email addresses that match this policy, either:
|
wildcard |
| source-ip-address {<client_ipv4mask> | <client_ipv6mask>} |
Enter the SMTP client IP address and netmask. To match all clients, enter Note: This setting is only available when source-type {geoip-group | ip-address | ip-group} is |
0.0.0.0/0 |
|
Select which IP address group to use. Note: This setting is only available when source-type {geoip-group | ip-address | ip-group} is |
|
|
|
Select which GeoIP group to use. Note: This setting is only available when source-type {geoip-group | ip-address | ip-group} is |
|
|
| source-type {geoip-group | ip-address | ip-group} |
Select how you want to define the source IP addresses of SMTP clients that will match this policy, either:
|
ip-address |
| status {enable | disable} | Enable or disable the policy. |
disable |