Anti Spam Inbound Policy (Default)
The default Exchange Online Protection (EOP) anti-spam inbound policy defines how incoming messages are handled based on spam confidence levels, bulk thresholds, and HTML content checks. Configuring this policy helps protect users from spam, phishing, and bulk email threats.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | The name of the anti-spam policy. The Default policy applies to all users without a specific policy assignment. Learn more |
| Spam action | The action to take on messages identified as spam (SCL 5-6). Options: MoveToJmf, AddXHeader, ModifySubject, Redirect, Delete, Quarantine, NoAction. Learn more |
| High-confidence spam action | The action to take on messages identified as high-confidence spam (SCL 9). Options: MoveToJmf, AddXHeader, ModifySubject, Redirect, Delete, Quarantine, NoAction. Learn more |
| Phishing action | The action to take on messages identified as phishing. Options: MoveToJmf, AddXHeader, ModifySubject, Redirect, Delete, Quarantine, NoAction. Learn more |
| Bulk email action | The action to take on messages identified as bulk email. Options: MoveToJmf, AddXHeader, ModifySubject, Redirect, Delete, Quarantine, NoAction. Learn more |
| Bulk email threshold | The Bulk Complaint Level (BCL) threshold (1-9). Messages at or above this level are treated as bulk email. Lower values are more aggressive (3-4 = strict, 7-9 = lenient). Learn more |
| Inline safety tips enabled | Enables or disables safety tips shown to recipients for spam, phishing, or spoofed messages. Learn more |
| Allowed senders | List of sender email addresses whose messages bypass spam filtering. Learn more |
9 more settings
| Setting | What it does |
|---|---|
| Allowed sender domains | List of sender domains whose messages bypass spam filtering. Use with caution as this can increase phishing risk. Learn more |
| Blocked senders | List of sender email addresses whose messages are always marked as high-confidence spam. Learn more |
| Blocked sender domains | List of sender domains whose messages are always marked as high-confidence spam. Learn more |
| JavaScript in HTML filter | Marks messages as spam if they contain JavaScript in HTML. Values: On, Off, Test. Learn more |
| Frames in HTML filter | Marks messages as spam if they contain frames or iframes in HTML. Values: On, Off, Test. Learn more |
| Object tags in HTML filter | Marks messages as spam if they contain object tags in HTML. Values: On, Off, Test. Learn more |
| Embed tags in HTML filter | Marks messages as spam if they contain embed tags in HTML. Values: On, Off, Test. Learn more |
| Form tags in HTML filter | Marks messages as spam if they contain form tags in HTML. Values: On, Off, Test. Learn more |
| Web bugs in HTML filter | Marks messages as spam if they contain web bugs (tracking pixels) in HTML. Values: On, Off, Test. Learn more |
Configure it
Add this baseline to the tenant to set the Default inbound anti-spam policy for every mailbox, or bundle it into a scheme you deploy to many tenants at once.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Set the spam and phishing actions.
Set Spam action and Phishing action to
MoveToJmf(move the message to the recipient’s Junk Email folder), and High-confidence spam action and Bulk email action toQuarantine, so the messages Microsoft is most confident about never reach the inbox. -
Set the bulk email threshold.
Set Bulk email threshold to
6. This mid-range value catches mass mailings and newsletters without also quarantining the lower-confidence bulk mail some legitimate tools send. -
Leave the allow and block lists empty.
Leave Allowed senders, Allowed sender domains, Blocked senders and Blocked sender domains empty unless your organisation needs to exempt or always block a specific address. An allowed sender or domain skips spam filtering altogether, so use allow entries sparingly.
-
Leave the HTML content filters on.
Leave the six “in HTML filter” settings on (JavaScript, frames, object tags, embed tags, form tags and web bugs in HTML). Each adds to a message’s spam score rather than blocking it outright, so they only affect borderline messages.
-
Save.
Turn on Auto-remediation (Remediation) if you want Octiga to reapply these settings whenever the Default policy changes.
Check it worked
Passing means the Default anti-spam inbound policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Anti-spam. End users notice more suspected spam and phishing landing in their Junk Email folder instead of the inbox, and the occasional message an admin needs to release from quarantine.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.