Office365 - Is the X-MS-Exchange-Organization-PCL header added by MS, if so does it need a feature/level?

Adam L 5 Reputation points
2024-02-07T15:00:49.1433333+00:00

There is some documentation online for a Phishing scoring header added by Microsoft, however we're unable to identify any emails including this header in our tenant. This obviously could be for numerous reasons so the question is, is this header added with Office365 (Defender?) and is there any current documentation on it?

Outlook | Windows | Classic Outlook for Windows | For business
Microsoft 365 and Office | Install, redeem, activate | For business | Windows
{count} vote

1 answer

Sort by: Most helpful
  1. Faery Fu-MSFT 19,751 Reputation points Moderator
    2024-02-08T06:48:36.3866667+00:00

    Hi @Adam L ,

    Yes, the X-MS-Exchange-Organization-PCL header is added by Microsoft. It’s part of the antispam stamps applied by Exchange Server to messages as they pass through the antispam features.

    The X-MS-Exchange-Organization-PCL header, also known as the Phishing Confidence Level (PCL) stamp, indicates the likelihood that a message is a phishing message based on its content. The PCL stamp is applied when the message is processed by the Content Filter agent.

    The PCL values are described as follows:

    • 1 through 3 (Neutral): The message content isn’t likely to be phishing.
    • 4 through 8 (Suspicious): The message content is likely to be phishing.

    Outlook uses the PCL stamp to block the content of suspicious messages. So, it doesn’t need a specific feature or level, but rather it’s a part of the antispam measures implemented by Microsoft. It’s used to help protect users from potentially harmful phishing emails.

    More information, see: https://learn.microsoft.com/en-us/exchange/antispam-and-antimalware/antispam-protection/antispam-stamps?view=exchserver-2019


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.