Default Hosted Outbound Spam Filter Policy
A default Exchange Online Protection (EOP) outbound spam filter policy that monitors and blocks suspicious outbound mail, helping MSPs detect and prevent compromised accounts from sending spam or malicious content.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | The Identity parameter specifies the outbound spam filter policy that you want to modify. Learn more |
| Bcc suspicious mail enabled | Enables or disables sending a copy of suspicious outbound messages to the specified recipients. Learn more |
| Bcc recipient addresses | Email addresses to receive a copy of suspicious outbound messages. Learn more |
| Outbound spam notifications enabled | Enables or disables sending notifications when a sender is blocked for outbound spam. Learn more |
| Outbound spam notification recipients | Email addresses to receive notifications about blocked senders. Learn more |
| External recipient hourly limit | Maximum number of external recipients per hour before blocking the sender. Learn more |
| Internal recipient hourly limit | Maximum number of internal recipients per hour before blocking the sender. Learn more |
| Daily recipient limit | Maximum number of recipients per day before blocking the sender. Learn more |
1 more setting
| Setting | What it does |
|---|---|
| Action when limit reached | Action to take when recipient limits are reached (e.g., BlockUserForToday, BlockUser). Learn more |
Configure it
Add this baseline to the tenant to set the Default outbound anti-spam policy for every mailbox, or bundle it into a scheme you deploy to many tenants at once.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Leave the recipient limits at their default.
Leave External recipient hourly limit, Internal recipient hourly limit and Daily recipient limit at
0. This applies Microsoft’s own service-wide sending limits rather than a custom cap you set yourself; it doesn’t mean unlimited. -
Set the action when a limit is reached.
Set Action when limit reached to
BlockUserForToday, so a mailbox that suddenly starts sending like a compromised account can’t send any more mail until the next day, rather than only being flagged. -
Leave the extra notifications off.
Leave Outbound spam notifications enabled and Bcc suspicious mail enabled off, unless your organisation also wants a copy of every blocked outbound message and an email alert sent to a specific admin address.
-
Save.
Turn on Auto-remediation (Remediation) if you want Octiga to restore these values whenever the Default policy changes.
Check it worked
Passing means the Default outbound spam filter policy in Exchange Online has these settings. You can confirm it in the Microsoft Defender portal under Email & collaboration → Policies & rules → Threat policies → Anti-spam, on the outbound policy. A user whose mailbox is blocked for the rest of the day appears on the Defender portal’s Restricted entities page and gets a notification that their account has been restricted from sending mail.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.