Which Microsoft 365 mail flow rules improve email security, and how do you set them up safely?

Mail flow rules, also called transport rules, let you inspect every message passing through Exchange Online and act on it: reject it, tag it, redirect it or add text. That power cuts both ways. A good rule closes a gap Microsoft's built-in policies leave open, and a careless one opens a hole in your spam filter for everyone.

This guide covers the security rules worth having, the built-in settings you should use instead where they exist, and how to test rules before they touch real mail.

Where do you manage mail flow rules in Microsoft 365?

Mail flow rules live in the Exchange admin center (EAC), not the Defender portal (Microsoft Learn):

• Path: Mail flow > Rules in the EAC at https://admin.exchange.microsoft.com.
• Direct link: https://admin.exchange.microsoft.com/#/transportrules
• PowerShell: Get-TransportRule, New-TransportRule and Set-TransportRule in Exchange Online PowerShell.

Three behaviors catch people out:

1. Rules created in the EAC start disabled. Microsoft does this so you can review them first. Turn the rule on in its details flyout when you're ready.
2. Changes aren't instant. Microsoft says a new or modified rule "might take 30 minutes or more" to apply.
3. Order matters. The rule at the top has priority 0 and runs first. A rule with Stop processing more rules prevents later rules from touching the message.

The limits are generous for a small business: 300 rules per organization, 8 KB per rule, and 20 KB for all the words and regular expressions in every rule's conditions and exceptions combined (Exchange Online limits).

When should you use a mail flow rule instead of a built-in policy?

Use the built-in control first whenever one exists. Policies are designed for the job, show up in Microsoft's security recommendations, and are harder to get subtly wrong.

The sections below go through each row.

How do you block automatic forwarding to external addresses?

Automatic forwarding is a favorite trick after an account takeover. An attacker who gets into a mailbox adds an Inbox rule that quietly copies mail to an outside address. Microsoft notes that users can set up such rules "deliberately or as a result of a compromised account" (Microsoft Learn).

Step 1: Set the outbound spam policy to Off

The outbound spam policy is the control that covers both Inbox rules and admin-configured mailbox forwarding. Its Automatic forwarding rules setting has three values:

• Automatic - System-controlled (the default). Microsoft changed it to mean "Off" in 2021 for new organizations, but for some older tenants it can still mean "On". Microsoft says to pick On or Off explicitly because "the behavior can differ by organization."
• On - Forwarding is enabled.
• Off - Forwarding is disabled. Forwarded mail bounces with 5.7.520 Access denied, Your organization does not allow external forwarding.

Microsoft's Standard and Strict recommendations are both Off (Microsoft Learn). To set it:

1. In the Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam (https://security.microsoft.com/antispam).
2. Open Anti-spam outbound policy (Default).
3. Under Protection settings, set Automatic forwarding rules to Off - Forwarding is disabled and save.

Or in PowerShell:

Set-HostedOutboundSpamFilterPolicy -Identity Default `
    -AutoForwardingMode Off

Forwarding between internal users isn't affected. If someone genuinely needs external forwarding, create a custom outbound spam policy set to On that applies only to them. Our 550 5.7.520 page covers the bounce users see.

Step 2: Know how the controls combine

Microsoft offers two other places to restrict forwarding: remote domains (Set-RemoteDomain -AutoForwardEnabled $false) and mail flow rules. Its rule is that "the block typically wins." If the outbound spam policy is On but a remote domain or a mail flow rule blocks forwarding, the forwarded mail is blocked. That's useful: you can leave the policy On and use a remote domain to allow forwarding only to one partner's domain.

Step 3: Add a mail flow rule only for what's left

A rule using the message type Auto-forward can reject forwarded mail to outside recipients:

New-TransportRule -Name "Block external auto-forward (Inbox rules)" `
    -MessageTypeMatches AutoForward `
    -SentToScope NotInOrganization `
    -RejectMessageReasonText "External forwarding is not allowed. Contact IT." `
    -Mode Audit

Know its blind spot. Microsoft says that if a message is forwarded with mailbox forwarding (SMTP forwarding), the auto-forward condition "will not" match (Microsoft Learn). That's why the outbound spam policy comes first. To see who is forwarding today, check the Auto forwarded messages report in the EAC, and see our guide to the signs of a compromised email account for the mailbox checks.

How do you add a warning banner to risky external email?

For a simple "this came from outside" marker, Microsoft's native external tag is usually the better choice. It shows an External label in Outlook without editing the message. Our guide to the Outlook external email warning tag compares it with banners.

A banner rule earns its place for narrower cases, such as external mail whose display name matches one of your executives:

New-TransportRule -Name "Warn: external sender using staff name" `
    -FromScope NotInOrganization `
    -HeaderContainsMessageHeader "From" `
    -HeaderContainsWords "Jane Example","John Example" `
    -ApplyHtmlDisclaimerLocation Prepend `
    -ApplyHtmlDisclaimerText "<p style='background:#fff4ce;padding:8px'><b>Caution:</b> this message is from outside the company but uses a staff member's name.</p>" `
    -ApplyHtmlDisclaimerFallbackAction Ignore `
    -Mode Audit

Points to get right:

• The fallback action. If the banner can't be added, for example to a signed or encrypted message, the default Wrap creates a new message with the original attached. Microsoft says not to use Wrap in rules that affect incoming external mail because it "interfere[s] with Safe Attachments scanning," and suggests Reject instead (New-TransportRule). Ignore delivers the original without the banner. Choose deliberately: Reject bounces some legitimate signed mail.
• Subject tags. -PrependSubject "[EXTERNAL] " is an alternative. Add a The subject includes exception so replies don't collect repeated tags, the same approach Microsoft recommends for disclaimers.
• Banner fatigue. If every external message carries a loud banner, people stop reading it. Keep banners for messages that deserve a second look.

How do you block dangerous attachments?

Start with the common attachments filter in the anti-malware policy, at Email & collaboration > Policies & rules > Threat policies > Anti-malware (https://security.microsoft.com/antimalwarev2). Its default list includes types such as exe, dll, iso, img, lnk, hta, scr, vbs and docm. Microsoft says it uses "best effort true type matching" so a renamed exe is still caught, and falls back to extension matching where that fails (Microsoft Learn).

The filter is on by default in new policies and in the default policy of tenants created after December 1, 2023, and its default action is to reject with an NDR. Older tenants should check it's turned on:

Get-MalwareFilterPolicy | Format-List Name, EnableFileFilter, FileTypeAction

Mail flow rules add two attachment conditions that are useful alongside the filter:

• Any attachment has executable content (AttachmentHasExecutableContent) inspects the file's properties rather than its extension.
• Any attachment's file extension matches (AttachmentExtensionMatchesWords) also checks files nested inside other attachments.

For example, to send executable attachments from outside to quarantine instead of bouncing them:

New-TransportRule -Name "Quarantine external executables" `
    -FromScope NotInOrganization `
    -AttachmentHasExecutableContent $true `
    -Quarantine $true `
    -SetAuditSeverity Medium `
    -Mode Audit

Microsoft notes that when the quarantine action runs, rule evaluation stops, and later rules aren't evaluated even after release. Place it low in the list. Our guide to dangerous email attachment types explains which formats attackers favor.

Which mail flow rules should you avoid?

The most damaging rule is one that sets the spam confidence level to -1 (Bypass spam filtering). It shows up in headers as SFV:SKN, and Microsoft's troubleshooting guide names an overly broad SCL -1 rule as a cause of spam reaching inboxes (Microsoft Learn). On its allowlist page, Microsoft says never to use a sender domain as the only condition, and not to use your own domains or popular domains as conditions, because attackers can spoof them. Our guide on why spam gets through Microsoft 365 shows how to find these rules.

Also avoid:

• Allowing by sender domain without authentication. If an exception is truly needed, require dmarc=pass in the Authentication-Results header as an extra condition.
• Silent deletes. Delete the message without notifying anyone leaves no bounce for a legitimate sender. Quarantine is easier to recover from.
• Duplicating policy settings. A rule and a policy that disagree are hard to debug months later. Add a comment to every rule saying why it exists.

How do you test a rule before enforcing it?

1. Create the rule in test mode. In PowerShell, -Mode Audit logs what the rule would do without affecting delivery. AuditAndNotify also sends notifications. In the EAC, choose Test without Policy Tips or Test with Policy Tips.
2. Set a severity. Any severity other than Not audit makes matches appear in the Exchange transport rule report under Reports > Mail flow. Microsoft notes some data can take up to 5 days to appear.
3. Send test messages after waiting at least 30 minutes, then run a message trace to confirm the rule matched.
4. Check the headers of a test message in our Email Header Analyzer. Our guide to Microsoft 365 spam headers explains the fields.
5. Enforce:

Set-TransportRule -Identity "Quarantine external executables" `
    -Mode Enforce

6. Back up your rules before larger changes with Export-TransportRuleCollection.

Next steps

1. Set Automatic forwarding rules to Off in the outbound spam policy, with custom policies for approved exceptions.
2. Confirm the common attachments filter is on with Get-MalwareFilterPolicy.
3. List your rules with Get-TransportRule | Format-Table Name, State, Priority, Mode and remove any SCL -1 rule scoped only by sender domain.
4. Add new rules in audit mode, check the report, then enforce.
5. Run a free Email Health Check to confirm your MX, SPF and DMARC records, and see how to block a sender or domain in Microsoft 365 for blocking without a rule.

If you want inbound filtering in front of Microsoft 365 with its own attachment-type and geographic filters, compare the options in Microsoft 365 built-in filtering vs a gateway. Browse more guides on running email day to day.