question

ShimsheyRosenberg avatar image
0 Votes"
ShimsheyRosenberg asked udara commented

Too many recipents? Mail Flow rule possible?

Often, Spam or phishing emails would be sent to my entire organization. other times, it would be sent to 10-15 people.
Is there any way to set a rule something like this;
"If an email arrives from a sender that sent more then X emails in the past hour, then notify an admin".
Like this, we can get alerts when something does not sound right, and act on it quickly.
Yet I know it is going to be many false positives, hence the reason I want alerts only and not blocking.

Does anything like this exist?

office-exchange-online-itpro
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Enable Anti spam protection on Exchange servers. More details are given in following documents.
**antispam-on-mailbox-servers**
antispam-protection


0 Votes 0 ·
AndyDavid1608 avatar image
0 Votes"
AndyDavid1608 answered

There is no mail flow rule or anything built-in natively to Exchange like that to alert.
I assume you are referring to on-prem Exchange here.

I would look at your anti-spam solution to see if that is supported. Hopefully, you are not using just the built-in Exchange anti-spam capabilities. :)

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

joyceshen-MSFT avatar image
0 Votes"
joyceshen-MSFT answered

As Andy said, there is no such mailflow rule can meet your requirement. You could refer to the official document about Configure outbound spam filtering in EOP

It gives a configuration (Optional) Expand the Recipient Limits section to configure the limits and actions for suspicious outbound email messages

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.