What this check looks at
Checks the default outbound anti-spam policy sets recipient limits of at most 500 external and 1,000 internal per hour and 1,000 per day, and stops a sender who goes over them.
The outbound anti-spam policy sets how many recipients a single mailbox can send to, per hour outside the organisation, per hour inside, and per day in total, and what happens when a mailbox reaches a limit. In the default policy all three are 0, meaning Microsoft’s service limits apply, which allow thousands of recipients a day, and a mailbox that reaches them is blocked only until the following day.
The check reads the default outbound anti-spam policy and passes when the external limit is between 1 and 500 an hour, the internal limit between 1 and 1,000 an hour, the daily limit between 1 and 1,000, and the action is to restrict the user from sending mail (BlockUser) until an administrator releases them. It fails when any limit is 0 or above those values, or the action is anything else, listing each gap.
A compromised mailbox is the attacker’s best phishing tool, because the mail genuinely comes from a trusted sender. With the service limits an attacker can send thousands of messages before Microsoft steps in, and with the default action the account can send again the next day.
Why it matters
A compromised mailbox is used to send phishing to everyone in its contacts. Low sending limits, and blocking the sender when they are reached, contain it to a few hundred messages instead of thousands under the company’s name.
An attacker in a director’s mailbox sends a fake shared document to 3,000 customers and suppliers in an evening. Every one is a trusted message from a real contact, and some recipients are compromised in turn. With a 500-an-hour external limit and BlockUser, sending stops after the first few hundred and stays stopped until someone has secured the account.
Containing the blast radius limits the cost: fewer customers phished in the company’s name, fewer apologies, less damage to the domain’s reputation. The limits rarely affect normal users; people who genuinely send bulk mail should use a mailing platform with its own authentication.
CIS Microsoft 365 Foundations Benchmark 2.1.15 asks for these outbound limits. ISO 27001 A.8.16 (monitoring) and A.8.12 (data leakage prevention), CIS Controls v8 13.1, NIST CSF 2.0 PR.PS-01 and NCSC CAF C1.c and B3.b cover detecting and containing abnormal sending.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam
Before you start
- Check the outbound spam report for anyone who sends to more than 500 external recipients an hour (newsletters, invoicing systems) and route bulk mail through a dedicated service.
Step by step
- Check who sends in bulk today. In the Microsoft Defender portal, open Reports > Email & collaboration > Email & collaboration reports and look at the top senders and outbound mail, or ask the client which mailboxes send newsletters, statements or bulk notifications. Anyone who routinely sends to more than 500 external recipients an hour needs a mailing service, or a separate outbound policy of their own.
- Open the default outbound policy. Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam, select Anti-spam outbound policy (Default) and then Edit protection settings.
- Set the limits and the action. Under Message limits set the external message limit to 500, the internal message limit to 1000 and the daily message limit to 1000. Set the restriction placed on users who reach the message limit to Restrict the user from sending mail, not the option that lifts the restriction the following day. Select Save.
- Or set it in PowerShell. Connect with Connect-ExchangeOnline and run Set-HostedOutboundSpamFilterPolicy -Identity Default -RecipientLimitExternalPerHour 500 -RecipientLimitInternalPerHour 1000 -RecipientLimitPerDay 1000 -ActionWhenThresholdReached BlockUser.
- Allow for genuine bulk senders. For a mailbox that genuinely needs more, such as an invoicing system sending through Exchange Online, create a custom outbound policy (Create policy > Outbound) applying only to that mailbox, with higher limits. The default policy stays at the CIS values for everyone else.
- Know how to release a blocked user. A user who hits a limit appears in Email & collaboration > Review > Restricted entities. Check the account for compromise (sign-in logs, inbox rules, sent items) before releasing it there.
- Confirm the settings. Run Get-HostedOutboundSpamFilterPolicy -Identity Default | Format-List RecipientLimitExternalPerHour, RecipientLimitInternalPerHour, RecipientLimitPerDay, ActionWhenThresholdReached and check 500, 1000, 1000 and BlockUser. The next assessment passes.
With PowerShell
Set-HostedOutboundSpamFilterPolicy -Identity Default -RecipientLimitExternalPerHour 500 -RecipientLimitInternalPerHour 1000 -RecipientLimitPerDay 1000 -ActionWhenThresholdReached BlockUser
What users will notice
A mailbox that sends past the limits is blocked from sending until an admin releases it, which stops a compromised account spamming.
How to confirm it worked
Get-HostedOutboundSpamFilterPolicy -Identity Default shows the limits 500, 1000 and 1000 and ActionWhenThresholdReached BlockUser.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.c Generating alertsB3.b Data in transit |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Applications |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| NIST SP 800-171 | 3.14.6 Monitor systems to detect attacks |
| CMMC Level 2 | SI.L2-3.14.6 Monitor Communications for Attacks |
| ISO 27001:2022 | A.8.16 Monitoring activitiesA.8.12 Data leakage prevention |
| CIS M365 | 2.1.15 Ensure outbound anti-spam message limits are in place |
| CIS Controls v8.1 | 13.1 Centralize security event alerting (IG2) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure outbound spam policies (Microsoft Learn)