Malware Internal Sender Filter Notification Policy - DEPRECATED
Sends an alert when an internal user is blocked from sending malware, helping identify potentially compromised accounts quickly.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Internal sender notifications enabled | Enables or disables admin notifications when an internal sender is detected sending malware. Learn more |
| Internal sender notification email | Email address to receive internal sender malware notifications. Learn more |
Configure it
This baseline checks only the internal-sender notification setting in the Default anti-malware policy, the same policy Anti Malware Policy (Default) checks in full.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Leave internal sender notifications off.
Leave Internal sender notifications enabled off. A compromised internal account already shows up in the anti-malware policy’s blocking, without also generating a separate notification email every time.
-
Save.
Turn on Auto-remediation if you want Octiga to reapply this whenever the Default policy changes (see Remediation).
Check it worked
Passing means the Default anti-malware policy in Exchange Online has internal sender admin notifications turned off. Check it in the Microsoft Defender portal, under Email & collaboration → Policies & rules → Threat policies → Anti-malware, alongside Anti Malware Policy (Default). Users see no difference either way.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.