How do you configure the outbound spam policy in Microsoft 365?

Every Microsoft 365 tenant has an outbound spam policy, and most still run it with the values Microsoft shipped. That matters, because the outbound policy decides how much a hijacked mailbox can send before anyone notices, and whether attackers can quietly forward a user's mail outside the company.

This guide goes through each setting, its default, the PowerShell parameter behind it and the value to choose. If a user is already blocked, start with unblocking a user restricted from sending. For the inbound side, see Microsoft 365 anti-spam policies.

What is the outbound spam policy in Microsoft 365?

The outbound spam policy is the Microsoft 365 setting that limits how many recipients each user can send to, decides what happens when a user goes over, and controls automatic forwarding to external addresses. It doesn't decide whether a message is spam: Microsoft scans every outbound message anyway, and "suspicious outbound messages are marked as spam and are routed through the high-risk delivery pool" (Microsoft Learn).

Microsoft is direct about why it exists: "Outbound spam from a user in your organization typically indicates a compromised account." The policy is your brake on that.

There's always one default policy, Anti-spam outbound policy (Default). It applies to all senders, its status is Always on, and you can't delete it or turn it off. You can add custom policies for specific users, groups or domains.

Where do you configure it?

In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam in the Policies section, or open https://security.microsoft.com/antispam. The outbound default policy is listed with the inbound and connection filter policies.

You need the Organization Management or Security Administrator role group in Exchange Online, the Entra Security Administrator role, or the Defender XDR permission Core Security settings (manage). Global Reader and Security Reader can view but not change.

The PowerShell equivalent of the default policy is the outbound spam filter policy named Default:

Get-HostedOutboundSpamFilterPolicy -Identity Default |
  Format-List RecipientLimit*,ActionWhenThresholdReached,AutoForwardingMode,Bcc*,Notify*

What does each setting do, and what is the default?

Here is every setting on the Protection settings page, with Microsoft's recommended values at the time of writing (October 2026). Outbound spam policies aren't part of the Standard or Strict preset security policies, so nothing applies these values for you.

Message limits

The three limits count recipients, not messages. A valid value is 0 to 10,000. Zero "means the service defaults are used" (Microsoft Learn). The service default that matters most is the Exchange Online recipient rate limit of 10,000 recipients per day, counted over a 24-hour sliding window (Exchange Online limits).

A compromised account can do a lot of damage below 10,000 a day. Setting explicit limits, such as Microsoft's Standard values, stops it much sooner. Our guide to email sending limits compares the Microsoft 365 and Google Workspace numbers.

What happens when a user hits a limit

There are three choices:

• Restrict the user from sending mail until the following day (BlockUserForToday), the default. Sending resumes the next day, based on UTC time.
• Restrict the user from sending mail (BlockUser). The user goes on the Restricted entities page and stays blocked until an admin removes them. Microsoft recommends this for both Standard and Strict.
• No action, alert only (Alert). The alert policy Email sending limit exceeded notifies admins, but mail keeps flowing.

BlockUser is the safer choice because it forces someone to check for compromise before the account sends again. The bounce users see is 550 5.1.8 Access denied, bad outbound sender.

Automatic forwarding rules

This setting controls automatic forwarding by Exchange Online mailboxes to external recipients, whether set up by a user's Inbox rule or by an admin as mailbox (SMTP) forwarding. Forwarding between internal users isn't affected.

The default, Automatic - System-controlled, is ambiguous. Microsoft says it changed to mean Off in 2021 "for new organizations and for existing organizations that weren't actively using" it, but for some older tenants it "can remain equivalent to On." Microsoft's own advice is to pick On or Off explicitly.

Choose Off - Forwarding is disabled. Attackers who take over a mailbox commonly add a forwarding rule to keep reading mail after a password reset; see malicious inbox rules and auto-forwarding. Blocked forwards bounce to the sender with this example text from Microsoft Learn:

5.7.520 Access denied, Your organization does not allow external forwarding.
Please contact your administrator for further assistance. AS(7555)

Microsoft notes that external senders get this bounce for every forwarding method, but internal senders get it only for mailbox forwarding, not for Inbox rules. Our 550 5.7.520 page covers the error, and our forwarding blocked guide explains who gets the bounce and how to allow forwarding for one user.

How forwarding controls combine

You can also control forwarding with remote domains in the Exchange admin center and with mail flow rules. Microsoft's rule is simple: "When one setting allows external forwarding, but another setting blocks external forwarding, the block typically wins."

That gives you a useful pattern: set the outbound policy to On for a small group, then use remote domains to limit which external domains they can forward to. To see who forwards today, use the Auto forwarded messages report in the Exchange admin center's mail flow reports.

Notifications

Both notification options are off by default, and Microsoft recommends using alert policies instead. The default alerts User restricted from sending email, Email sending limit exceeded and Suspicious email sending patterns detected already email the TenantAdmins group. Microsoft says the Notify these users and groups setting "is in the process of being deprecated", and the Bcc copy setting "works only in the default outbound spam policy."

Make sure the alerts reach someone who acts on them; our alert policies guide shows how to add recipients.

How do you create a custom outbound policy for a group?

Use a custom policy when one team legitimately sends more, or needs external forwarding, without loosening the default for everyone.

1. Open https://security.microsoft.com/antispam, select Create policy, then Outbound.
2. Name the policy, for example "Sales higher limits", and select Next.
3. On Users, groups, and domains, add the users, groups or domains. Different condition types use AND logic, so "Users: ana@" plus "Groups: Sales" applies only if Ana is in Sales. Domains include their subdomains unless you exclude them.
4. On Protection settings, set the limits, the restriction and the forwarding mode for this group.
5. Review and select Create.

New custom policies get the next priority number, and lower numbers run first. Microsoft says "outbound spam protection stops for a sender after the first policy is applied", so a user in two custom policies gets only the higher-priority one.

In PowerShell it's two steps, a policy and a rule:

New-HostedOutboundSpamFilterPolicy -Name "Sales higher limits" `
  -RecipientLimitExternalPerHour 800 -RecipientLimitInternalPerHour 1000 `
  -RecipientLimitPerDay 2000 -ActionWhenThresholdReached BlockUser `
  -AutoForwardingMode Off

New-HostedOutboundSpamFilterRule -Name "Sales higher limits" `
  -HostedOutboundSpamFilterPolicy "Sales higher limits" `
  -FromMemberOf "Sales Team" -Priority 0

The values above are an example, not a recommendation. Base yours on how many recipients the team really sends to, which you can see in message trace.

To apply Microsoft's Standard values to the default policy:

Set-HostedOutboundSpamFilterPolicy -Identity Default `
  -RecipientLimitExternalPerHour 500 -RecipientLimitInternalPerHour 1000 `
  -RecipientLimitPerDay 1000 -ActionWhenThresholdReached BlockUser `
  -AutoForwardingMode Off

What happens to outbound mail that Microsoft thinks is spam?

Microsoft doesn't hold it for you. Every outbound message is scanned, and mail judged as spam is sent from the high-risk delivery pool, a separate set of IP addresses for "low quality" messages. Microsoft warns that "delivery to the intended recipients isn't guaranteed, because many email organizations don't accept messages from the high risk delivery pool" (Microsoft Learn).

Two details catch admins out:

• Messages from a domain with no A record and no MX record in public DNS always go through the high-risk pool. If you send from a subdomain, make sure it publishes an MX record or an A record; check with the MX Lookup.
• Messages blocked by sending limits or by your outbound policy aren't sent at all.

Message trace shows which pool sent a message in the OutboundIpPoolName property. Beyond your policy, Microsoft also blocks accounts and whole tenants that send too much spam at "an undisclosed limit" (Microsoft Learn), so a strict policy is no reason to skip the other controls.

Outbound spam policy checklist

• External, internal and daily limits set to explicit values, not 0.
• Restriction set to Restrict the user from sending mail.
• Automatic forwarding rules set to Off in the default policy.
• Custom policies only for named groups with a documented reason.
• Alert policy recipients include the people who handle incidents.
• Newsletters and bulk sends moved off user mailboxes, since Microsoft says bulk email through Microsoft 365 "isn't a supported use of the service". For internal bulk sends, Microsoft's separate High Volume Email service is an option.
• Every mailbox protected by MFA, so a stolen password alone can't trigger any of this; see signs an email account is compromised.

Next steps

1. Run the Get-HostedOutboundSpamFilterPolicy command above and compare the output with the table.
2. Apply the Standard values to the default policy, then add custom policies only where needed.
3. Check whether any of your sending IPs or domains appear on public blocklists with the Blacklist Checker.
4. Outbound limits contain a compromised account; inbound filtering helps stop the phishing that compromises it. See how iBlockSpam adds a filtering layer in front of Microsoft 365.

Browse all spam filter setup guides.