Skip to content

feat: add display name separator support to colleague impersonation alert - #277

Open
Corsw wants to merge 1 commit into
CyberDrain:devfrom
Corsw:patch-1
Open

feat: add display name separator support to colleague impersonation alert#277
Corsw wants to merge 1 commit into
CyberDrain:devfrom
Corsw:patch-1

Conversation

@Corsw

@Corsw Corsw commented Aug 13, 2026

Copy link
Copy Markdown

Adds an optional display name separator setting to the Colleague Impersonation Alert standard.

When configured, CIPP adds both the full mailbox display name and the portion before the separator to HeaderMatchesPatterns.

Example:

Display name:
John Doe | Contoso

Separator:
|

Protected names:

  • John Doe | Contoso
  • John Doe

This helps protect tenants that append a company name or other identifier to user display names, while attackers may impersonate only the user's name.

If no separator is configured, the existing behavior remains unchanged.

…lert

Adds an optional display name separator setting.

When configured, CIPP protects both the full display name and the part before the separator. This supports display names such as "John Doe | Contoso", while also matching "John Doe".

Signed-off-by: Corsw <108132302+Corsw@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant