What this check looks at
Checks the default outbound anti-spam policy copies suspicious outbound messages to someone and notifies someone when a sender is blocked for spamming.
When a mailbox sends mail that looks like spam, or goes over the outbound limits, Exchange Online Protection routes it through a higher-risk delivery pool and may block the sender from sending altogether. The outbound anti-spam policy can copy those suspicious outbound messages to named people, and notify named people when a sender is blocked. In the default policy both are off.
The check reads the default outbound anti-spam policy and passes when both settings are on, each with at least one recipient. It fails when either is off or has nobody to send to, and says which.
A mailbox suddenly sending spam or phishing is almost always compromised. Microsoft’s built-in alert for a restricted user goes by email to the Global Administrators, often an inbox nobody watches. Without a copy going to a monitored mailbox, the first sign is a customer asking why they received a strange invoice from the company.
Why it matters
A mailbox suddenly sending spam is almost always compromised. When Microsoft blocks it, someone needs to know at once to reset the account; otherwise the first sign is a customer complaining.
An attacker who takes over a sales mailbox sends a secure document phishing link to the 2,000 contacts in its address book. Exchange blocks the account after a few hundred messages, but nobody at the client is told, so the attacker keeps reading the mailbox through the stolen session while the customers who did receive the link start ringing the next morning.
Early warning shortens the incident: the password reset and sessions revoked within the hour, customers warned before they act, and less harm to the domain’s sending reputation. Without it, genuine mail can be delayed or junked by receivers for days afterwards.
CIS Microsoft 365 Foundations Benchmark 2.1.6 asks for Exchange Online spam policies to notify administrators. NIST CSF 2.0 DE.AE-06, CIS Controls v8 13.1, ISO 27001 A.8.16 and A.5.25, and NCSC CAF C1.c ask for detections to reach the people who can act on them.
How to fix it
Where: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam
Before you start
- Choose a monitored mailbox for the copies and the notifications.
Step by step
- Choose the recipients. Use the monitored security shared mailbox or distribution list. Both settings accept several addresses, so you can add your service desk alongside the client’s own mailbox.
- Open the default outbound policy. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam, select Anti-spam outbound policy (Default), then select Edit protection settings in its details.
- Turn on both notifications. Under Notifications tick the option to send a copy of suspicious outbound messages, or messages that exceed the limits, to these users and groups, and add the address. Tick the option to notify these users and groups if a sender is blocked due to sending outbound spam, and add the address. Select Save.
- Or set it in PowerShell. Connect with Connect-ExchangeOnline and run Set-HostedOutboundSpamFilterPolicy -Identity Default -BccSuspiciousOutboundMail $true -BccSuspiciousOutboundAdditionalRecipients security@contoso.com -NotifyOutboundSpam $true -NotifyOutboundSpamRecipients security@contoso.com.
- Send the built-in alert to the same place. In the Microsoft Defender portal open Email & collaboration > Policies & rules > Alert policy, find User restricted from sending email and add the same address to its email recipients, so the alert and the notification arrive together.
- Know how to release a blocked sender. A blocked sender appears in Email & collaboration > Review > Restricted entities. Reset the password, revoke sessions and remove any malicious inbox rules first, then release the user there.
- Confirm the settings. Run Get-HostedOutboundSpamFilterPolicy -Identity Default | Format-List BccSuspiciousOutboundMail, BccSuspiciousOutboundAdditionalRecipients, NotifyOutboundSpam, NotifyOutboundSpamRecipients and check both settings are True with the address listed. The next assessment passes.
What users will notice
None for users. The mailbox receives suspicious outbound messages and is told when a sender is blocked for spamming.
How to confirm it worked
Get-HostedOutboundSpamFilterPolicy -Identity Default shows BccSuspiciousOutboundMail and NotifyOutboundSpam as True, each with a recipient.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.c Generating alerts |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-1 Enable threat detection capabilities |
| Zero Trust | Visibility, automation and orchestration |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| NIST SP 800-171 | 3.14.6 Monitor systems to detect attacks |
| CMMC Level 2 | SI.L2-3.14.6 Monitor Communications for Attacks |
| ISO 27001:2022 | A.8.16 Monitoring activitiesA.5.25 Assessment and decision on information security events |
| CIS M365 | 2.1.6 Ensure Exchange Online Spam Policies are set to notify administrators |
| CIS Controls v8.1 | 13.1 Centralize security event alerting (IG2) |
| NIST CSF 2.0 | DE.AE-06: Information on adverse events is provided to authorized staff and tools |
| NCSC 10 Steps | Logging and monitoringIncident management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Configure outbound spam policies (Microsoft Learn)