Office365 - Is the X-MS-Exchange-Organization-PCL header added by MS, if so does it need a feature/level?

Question

There is some documentation online for a Phishing scoring header added by Microsoft, however we're unable to identify any emails including this header in our tenant. This obviously could be for numerous reasons so the question is, is this header added with Office365 (Defender?) and is there any current documentation on it?

Answer 1

Hi @Adam L ,

Yes, the X-MS-Exchange-Organization-PCL header is added by Microsoft. It’s part of the antispam stamps applied by Exchange Server to messages as they pass through the antispam features.

The X-MS-Exchange-Organization-PCL header, also known as the Phishing Confidence Level (PCL) stamp, indicates the likelihood that a message is a phishing message based on its content. The PCL stamp is applied when the message is processed by the Content Filter agent.

The PCL values are described as follows:

• 1 through 3 (Neutral): The message content isn’t likely to be phishing.
• 4 through 8 (Suspicious): The message content is likely to be phishing.

Outlook uses the PCL stamp to block the content of suspicious messages. So, it doesn’t need a specific feature or level, but rather it’s a part of the antispam measures implemented by Microsoft. It’s used to help protect users from potentially harmful phishing emails.

More information, see: https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps?view=exchserver-2019

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.