Read time: 12 minutes
Quick Answer: To configure anti spam Office 365 filter, go to security.microsoft.com, select Email & collaboration > Threat polices > Anti-spam. Here, create anti-spam policies for the inbound and outbound emails in your organization.
Spam emails are junk messages received by users in their mailbox with or without their permission. When users configure a Microsoft 365 account in Outlook, or another email client, for communication, these junk emails become a nuisance and sometimes a threat to the organization’s security.
To tackle this issue, administrators configure Office 365 spam filters for their organization. The filters are applied by creating individual anti-spam policies for incoming and outgoing emails using the Microsoft Defender portal.
In this guide, we will see what kind of online protection you can implement for your users’ mailboxes, what strategy to adapt for different threat, and the steps to create, modify, and remove Microsoft 365 spam filter.
Configure Office Spam Filter to Protect Your Organization
An admin uses the Exchange Online Protection (EOP) services to set up Office 365 email spam filters to protect cloud mailboxes from spoofed, spammed emails. Blocking unwanted emails also helps with Office 365 mailbox management. When configuring Office 365 spam protection, it is possible to:
Control the Incoming Emails
Create anti spam policies to check an incoming email. The policy may use old spam history and other configuration to decide whether to allow the email to reach the user’s Inbox, or whether it should be quarantined.
Prevent Outgoing Spams
EOP also allows controlling the emails that are leaving your organization. An admin can set up policy to verify if an outgoing email is a spam and block it if necessary. Such filters are helpful when an employee’s account is compromised.
Block Emails from Specific Senders and IP
Using the connection filters, you can choose senders, organizations, URLs, and IPs that you do not trust for receiving emails. This instantly saves you from several online threats.
Protect Against Phishing and Spoofing
The Microsoft Defender portal allows setting up anti-phishing policies and use spoof intelligence to safeguard the online mailboxes from threats by identifying and blocking fake email accounts.
Create Spam Filter for Specific Group
Instead of applying the same anti spam filter on the whole organization, the Exchange Online Protection services allow for creating separate protection policies for different groups in the organization.
Choose the Right Office 365 Spam Filter Settings
You cannot expect that a single Office 365 spam filtering policy can protect your organization from all kinds of online troubles. Different issues require different solutions.
A few of the most common Office 365 problems related to user mailboxes and their solutions are:
| Goal | What to do |
| Control the incoming and outgoing spam emails. | Create an inbound and outbound anti-spam policy and setup spam level as per requirement. |
| Create different anti-spam policy for different departments in your organization | Setup spam filter Office 365 for each group with different configurations. |
| Safeguard your employees from phishing emails | Implement anti-spoofing and anti-phishing rules using the threat polices in Microsoft Defender |
| Stop incoming emails from specific URLs, and IPs | Use the connection filtering and configure the IP block list to stop unwanted emails from certain sources. |
How to Configure Anti Spam Office 365 Policies?
By default, all the online mailboxes are covered with three policies, including Anti-spam inbound policy, Connection filter policy, and Anti-spam outbound policy. In addition to these, Office 365 allows for creating a more customized anti-spam policy for inbound and outbound emails. Let’s see how:
Configure Spam Filter Office 365 for Incoming Emails
An inbound anti-spam policy is specifically applied on the incoming emails in your organization. With this policy, you can implement stricter filters to reduce the number of spam emails your users are getting in their mailboxes.
To configure inbound anti-spam policy, follow the below-mentioned steps properly:
- Visit the Anti-spam policies page by clicking on this link–
https://security.microsoft.com/antispam - Click on + Create Policy. A dropdown menu will open and select Inbound. Now, this will require you to add information on various pages as you proceed ahead.
- In the Name your policy section, you need to enter a suitable title and an optional description. After providing the required data, Click Next.
- This is the Users, groups, and domains page. Select a field and input the specific values for it. The policy will only be applied to the values you choose. After configuring this section, click Next to continue.
Note: If your requirement is to exclude specific user, groups, and domains from this policy, after entering the values, select the “Exclude these users, groups, and domains” option before clicking Next.
- In the Bulk email threshold & spam properties, do this:
- Set up how the policy handles getting emails in bulk. 7 is the default value. A lower value means higher acceptance of bulk emails while a larger value means receiving bulk emails will be harder.
- Configure the properties for Increase spam score and Mark as spam
- Enable test mode. This allows you to test how this policy will behave before you implement it on the whole organization.
Once done, click Next to continue.
- The Actions page is where you will decide what happens with all the junk messages. By default, spam and bulk emails are send to the junk folder, while emails marked as high confidence spam, phishing, and high confidence phishing, are sent to the quarantine mailbox. The retention period for spam is 15 days. All these default settings can be adjusted as per your requirements.
- In the Allow and block list section, you can allow or block receiving emails from specific users or domains. After configuring it, click Next to proceed.
- The Review page is the summary of all the settings you have applied. Verify them and if everything is configured as per your needs, click Create to Configure anti spam Office 365.
- After all the steps have been completed properly, a confirmation message will appear. Click on Done to conclude.
Note: It will take at least 1 hour before the policy takes effect within your organization.
Configure Spam Filter Office 365 for Outgoing Emails
Here, we will see how to configure Office 365 spam filter for emails that will be sent from your organization to an external domain or user. Follow these steps:
- Go to the Anti –spam policies page, click on + Create Policy and select Outbound.
- On the Name your policy page, enter the name and description of the policy. Click on Next once done.
- On the Users, groups, and domains page, you can add all those to which this policy will be applicable.
- The Protection settings page is where you can set up the limit of external, internal, and daily messages. Click Next to proceed.
- On the Review page, verify the spam protection Office 365 settings. If everything is correct, click Create.
- A confirmation message will appear. Click Done to exit the screen.
Note: It will take at least 1 hour before the policy takes effect within your organization.
Modify Connection Filter Policy
If you want configuration that blocks the emails based on IP, use a connection filter. We have provided a detailed stepwise guide to modify the connection filter policy. Follow it properly to get an accurate outcome:
- Move to the Anti-spam policies page by clicking on the link. This time click on the Connection filter policy (Default).
https://security.microsoft.com/antispam - Click on the Edit connection filter policy to customize the allowance and blockage of IP addresses.
- You can add a single IP or a range of IP addresses to the Allow or Block list. You can also choose to turn on the safe list. In the end, click Save, and the modifications will be saved.
Remove Anti Spam Filter in Office 365
In a situation where you want to delete a certain policy, you can easily do so with the following steps:
- Open the Anti-spam policies page with this link –
https://security.microsoft.com/antispam - Click on the applied anti-spam policy which you want to remove.
- Click the Delete policy option.
Note: If you only want to disable the policy for a temporary period, select Turn off.
- When the warning message appears, click Yes, and the spam filter Office 365 policy will be deleted.
Troubleshooting Issues After Configuring the Spam Filter
When you configure Office 365 spam filter policy, you may experience some issues. The following are the most common problems and their solutions:
| Issue | Solution |
| Policy changes not working immediately | Microsoft says that any new policy will take approximately 1 hour for complete implementation. And group-scoped policies can take even longer. |
| An existing anti-spam policy is overriding your custom new policy | Old Standard or Strict preset policies can override custom policies. In this case, you must either remove the old stricter policies or customize them if possible. |
| Wrong policy applies to a user | This may happen in case of multiple policies. Check the priority level of the policy that keeps applying and set it to a lower level than your custom-made new policy. |
| Legitimate emails marked as spam | Verify SPF, DKIM, and DMARC, review message headers, and also verify the allow and block list of your anti-spam policy. Additionally, make use of Exchange Online message tracing to analyze the email journey and pinpoint the issues. |
| Bulk newsletters landing in Junk | Edit the anti-spam policy applied to emails and raise the bulk email threshold in it. Alternatively, you can also set the bulk action to No action. |
| Fails to save (create) the anti-spam policy and received the 403 error | Confirm you have the Security Administrator or Organization Management role before creating the anti spam policy. |
Conclusion
Office 365 automatically protects every mailbox with a default anti-spam policy, but you can further control the protection with custom inbound, outbound, and connection filter policies. Remember, when you configure Office 365 spam filter using the Microsoft Defender portal, the policy can take up to an hour to start working.
Lastly, remember that spam filters can’t catch everything. That’s why many admins also keep Office 365 backups. Use the native eDiscovery portal or a dedicated tool to export Office 365 emails to PST.
Frequently Asked Questions
Ans: It’s the built-in email protection system offered by Microsoft for all the cloud mailboxes. This filter checks every incoming email before it reaches a user’s mailbox and, based on the filter, moves a suspicious email to the Junk folder or quarantines it.
Ans: No. It is not mandatory. All the online mailboxes in Office 365 are protected by the default anti-spam policy automatically. In case you require custom filters, you can setup Office 365 spam filter as per your requirements.
Ans: Yes. You can create a custom anti-spam policy and apply it to a specific department. For this, create a group for your department. Then, setup spam filter Office 365 and when you reach the “Users, groups, and domains” page, add the group in the “Groups” field and leave the other field blank.
