control 'microsoft-365-foundations-6.5.2' do
  title 'Ensure MailTips are enabled for end users'
  desc "MailTips are informative messages displayed to users while they're composing a message. While a new message is open and being composed, Exchange analyzes the message (including recipients). If a potential problem is detected, the user is notified with a MailTip prior to sending the message. Using the information in the MailTip, the user can adjust the message to avoid undesirable situations or non-delivery reports (also known as NDRs or bounce messages)."

  desc 'check',
       "To audit using PowerShell:
        1. Connect to Exchange Online using Connect-ExchangeOnline.
        2. Run the following PowerShell command:
            Get-OrganizationConfig | fl MailTips*
        3. Verify the values for MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, and MailTipsGroupMetricsEnabled are set to True and MailTipsLargeAudienceThreshold is set to an acceptable value; 25 is the default value."

  desc 'fix',
       "To remediate using PowerShell:
        1. Connect to Exchange Online using Connect-ExchangeOnline.
        2. Run the following PowerShell command:
            $TipsParams = @{ MailTipsAllTipsEnabled = $true MailTipsExternalRecipientsTipsEnabled = $true MailTipsGroupMetricsEnabled = $true MailTipsLargeAudienceThreshold = '25' }
            Set-OrganizationConfig @TipsParams"

  desc 'rationale',
       'Setting up MailTips gives a visual aid to users when they send emails to large groups of
        recipients or send emails to recipients not within the tenant.'

  impact 0.5
  tag severity: 'medium'
  tag cis_controls: [{ '8' => ['untracked'] }]
  tag nist: ['CM-6']

  ref 'https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips'
  ref 'https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps'

  ensure_mailtip_enabled_for_end_users_script = %(
    Get-OrganizationConfig | Select-Object -Property MailTips* | ConvertTo-Json
 )
  powershell_output = pwsh_single_session_executor(ensure_mailtip_enabled_for_end_users_script).run_script_in_graph_exchange
  raise Inspec::Error, "The powershell output returned the following error:  #{powershell_output.stderr}" if powershell_output.exit_status != 0

  powershell_output = powershell_output.stdout.strip
  mailtips_settings = JSON.parse(powershell_output) unless powershell_output.empty?
  describe 'Ensure that the MailTip setting' do
    subject { mailtips_settings }
    its(['MailTipsAllTipsEnabled']) { should cmp true }
    its(['MailTipsExternalRecipientsTipsEnabled']) { should cmp true }
    its(['MailTipsGroupMetricsEnabled']) { should cmp true }
    its(['MailTipsLargeAudienceThreshold']) { should eq((input('mailtipslargeaudiencethreshold_value'))) }
  end
end
