How to find out which transport rule was applied to an email EXCHANGE ONLINE

Question

How to find out which transport rule was applied to an email EXCHANGE ONLINE

It.sam1 5

Hello, I have going through all the Microsoft docs. however, I couldn't find anything there!!

I'd like to know how can I identify which transport rule was applied to a specific email in Exchange Online?

My 2nd question is related to the picture attached:
is the Guid mentioned belongs to one of the Exchange Transport rule or it's a miss leading and it's related to the impactful Anti-Spam? Guid

1 answer

Your answer

Answer 1

Kael Yao 37,746 Moderator

Hi @It.sam1,

I'd like to know how can I identify which transport rule was applied to a specific email in Exchange Online?

You can check which rule was applied in Exchange Admin Center>Mail flow>Message trace.

Please see the following screenshot:

My 2nd question is related to the picture attached:
is the Guid mentioned belongs to one of the Exchange Transport rule or it's a miss leading and it's related to the impactful

Based on my test, this field should be in the format like <mail flow rule name>/<guid>.

Please see the screenshot:

While this guid (in my test 51d970e8-5fd5-4949-b863-e8301fd2f76a) does refer to the mail flow rule applied.

You can check a mail flow rule's guid either in Exchange Admin Center or via Exchange Online Powershell.

In Exchange admin Center:

In Exchange Online Powershell:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

It.sam1 5 Reputation points

2023-05-23T21:53:37.55+00:00

I have checked the Message Trace and The Exchange Transport Rule doesn’t appear in Message Tracking and only shows the ID in the Explorer.

The issue is that the Transport Rule ID doesn’t exist in the tenant. Where is it coming from?
It.sam1 5 Reputation points

2023-05-24T14:51:50.74+00:00

I have checked the Message Trace and The Exchange Transport Rule doesn’t appear in Message Tracking and only shows the ID in the Explorer.

The issue is that the Transport Rule ID doesn’t exist in the tenant. Where is it coming from?
It.sam1 5 Reputation points

2023-05-24T14:52:55.0666667+00:00

I have checked the Message Trace and The Exchange Transport Rule doesn’t appear in Message Tracking and only shows the ID in the Explorer.

The issue is that the Transport Rule ID doesn’t exist in the tenant. Where is it coming from?
Kael Yao 37,746 Reputation points Moderator

2023-05-25T02:36:27.15+00:00

Thanks for the information.

Can you find this rule by the guid in Exchange Online Powershell?
It.sam1 5 Reputation points

2023-05-25T22:26:32.6766667+00:00

Noope see below please:
Kael Yao 37,746 Reputation points Moderator

2023-05-26T08:07:06.1366667+00:00

What action did this rule actually take?

For further investigation I would suggest creating a service request in Microsoft 365 admin center>Support>Help & Support to check if more information can be found in backend.
John Dunn (IR Pros) 5 Reputation points

2024-08-22T19:02:12.5166667+00:00

This is extremely frustrating.
Why not make the "Mail flow rule" id searchable when looking at Rules in the portal?

or provide the name of the rule that can be searched on the Rules page in the Exchange admin center?
Nick Dooley 0 Reputation points

2024-09-10T20:30:27.66+00:00

I have the same concern, I have a user with issues regarding mail delivery and there appears to be a transport rule impacting mail flow based on the message trace, but no name is given, so there is no quick way to resolve it because the ID does not lead us to the pertinent Rule. Having to click on rule after rule in the list in order to check for an ID match in the URL is not an efficient process for troubleshooting.
Alan McLaughlin 0 Reputation points

2025-02-18T20:00:22.0133333+00:00
I also wasn't having luck querying the rule in powershell by the GUID provided in the message trace logs. Ugh.

But if I did a full output of the transport rules I could see the GUID in the return. So I used this to filter instead.

$GUID = '68D69D8B-5271-4580-BFE7-5A8A7B9A8275‎' Get-TransportRule | Where-Object{$_.guid.guid -ieq $GUID} | select name,identity,guid

Share via

How to find out which transport rule was applied to an email EXCHANGE ONLINE

1 answer

Your answer