# Default Hosted Outbound Spam Filter Policy > A default Exchange Online Protection (EOP) outbound spam filter policy that monitors and blocks suspicious outbound mail, helping MSPs detect and prevent compr… A default Exchange Online Protection (EOP) outbound spam filter policy that monitors and blocks suspicious outbound mail, helping MSPs detect and prevent compromised accounts from sending spam or malicious content. ## Settings this baseline controls | Setting | What it does | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Policy name | The Identity parameter specifies the outbound spam filter policy that you want to modify. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Bcc suspicious mail enabled | Enables or disables sending a copy of suspicious outbound messages to the specified recipients. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Bcc recipient addresses | Email addresses to receive a copy of suspicious outbound messages. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Outbound spam notifications enabled | Enables or disables sending notifications when a sender is blocked for outbound spam. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Outbound spam notification recipients | Email addresses to receive notifications about blocked senders. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | External recipient hourly limit | Maximum number of external recipients per hour before blocking the sender. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Internal recipient hourly limit | Maximum number of internal recipients per hour before blocking the sender. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | | Daily recipient limit | Maximum number of recipients per day before blocking the sender. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | **1 more setting** | Setting | What it does | | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Action when limit reached | Action to take when recipient limits are reached (e.g., BlockUserForToday, BlockUser). [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-hostedoutboundspamfilterpolicy?view=exchange-ps) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this baseline to the tenant to set the Default outbound anti-spam policy for every mailbox, or bundle it into a scheme you deploy to many tenants at once. 1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. **Leave the recipient limits at their default.** Leave **External recipient hourly limit**, **Internal recipient hourly limit** and **Daily recipient limit** at `0`. This applies Microsoft's own service-wide sending limits rather than a custom cap you set yourself; it doesn't mean unlimited. 3. **Set the action when a limit is reached.** Set **Action when limit reached** to `BlockUserForToday`, so a mailbox that suddenly starts sending like a compromised account can't send any more mail until the next day, rather than only being flagged. 4. **Leave the extra notifications off.** Leave **Outbound spam notifications enabled** and **Bcc suspicious mail enabled** off, unless your organisation also wants a copy of every blocked outbound message and an email alert sent to a specific admin address. 5. **Save.** Turn on **Auto-remediation** ([Remediation](https://docs.octiga.io/baselines/remediation/)) if you want Octiga to restore these values whenever the Default policy changes. ## Check it worked Passing means the Default outbound spam filter policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under **Email & collaboration → Policies & rules → Threat policies → Anti-spam**, on the outbound policy. A user whose mailbox is blocked for the rest of the day appears on the Defender portal's Restricted entities page and gets a notification that their account has been restricted from sending mail. ## Standards this addresses ### CIS - **M365 6.2.1** — CIS M365 Foundations Benchmark 6.2.1 - **v8 9.7** — CIS Controls v8 Safeguard 9.7 ### NIST - **PR.DS-5** — NIST CSF 2.0 PR.DS-5 - **SC-7** — NIST SP 800-53 SC-7 - **AC-20** — NIST SP 800-53 AC-20 ### ISO 27001 - **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23 - **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)