Microsoft 365 defender quarantine spam filter contains emails send to deleted emailaddresse accounts

Question

Hi,

In Microsoft 365 Defender quarantine spam filter admin center I see many spam emails have been send to deleted emailaddresse accounts. Where is this coming from because some accounts have been deleted years ago. Or how to configure this so I don't see this anymore?

Answer 1

Hi,

It's possible that the spam emails are being sent to email addresses that were previously associated with deleted accounts. These emails could still be routed to those addresses if they were listed on any public-facing websites or if they were shared publicly in any way. Here are some steps that you can take to optimize the spam filter in Microsoft 365 Defender:

Review and verify the settings of your anti-spam policies. Make sure that they are up-to-date and configured in a way that effectively blocks spam. You can refer to the following article for instructions on how to create or modify anti-spam policies: Anti-spam policies in Microsoft 365

Consider using an anti-phishing policy to prevent phishing emails from reaching your users. You can create a policy to block emails that impersonate someone in your organization, emails that request sensitive information, or emails from a specific set of domains. Learn more about exclusive settings in anti-phishing policies here.

Make sure that your users know how to submit spam and phishing messages for analysis and release. End-users can submit messages directly from their quarantine area. Admins can submit messages via the Submission area in the Microsoft Defender Security Center. Refer to the following article for more information: Submit spam, phish, and false positive messages to Microsoft for analysis

Configure alerts to notify you when new messages are quarantined or released. You can configure these alerts by going to Alerts in the Security & Compliance Center. Refer to the following article for step-by-step instructions: Manage quarantined messages and files as an admin in Microsoft 365

If you still continue to see spam emails after these steps, you might want to contact Microsoft Support for further investigation.

References:

Anti-Spam policies in Microsoft 365

Exclusive settings in anti-phishing policies in Microsoft Defender for Office 365

Submit spam, phish, and false positive messages to Microsoft for analysis

Manage quarantined messages and files as an admin in Microsoft 365

Answer 2

Hi XinGuo,

Thanks for all your information, but in my mind this remains strange and impossible because the account is completely out of our system. So, If an account no longer exists in our tenant then surely no spam can come into our spam filter?

We have an policy to prevent phising email to our users, and have looked in our policies and I cannot find anything in there that could cause this.

Like you said, maybe i need it investigated by Microsoft support.

Regards GerritV