Block incoming messages with attachements only to certain groups

Question

I understand we can block all incoming messages with attachments based on this article: https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/common-attachment-blocking-scenarios

And I would have thought I could set up mail rules for individual users to block attachments and generate an auto-reply, but I've never seen that work correctly. Even if it did, those rules would apply to the user account, not a mail group. If this were the only option, we could possibly set up a user account as the group and just provide shared access to it, but that's definitely not a work-around we would want to take.

What we want to do is block incoming emails with attachments (or attachments over a certain size, either way would be OK) being sent to a mail group, rather than to an individual account. Is there a way to do that? If so, could you help me understand how we would set this up? I would prefer not to block attachments to individual user accounts, just to specific mail groups, regardless of the membership of the group (i.e., members of the group should still be able to receive large attachments, as long as those attachments are emailed directly to the user email address, instead of to the group email address).

Answer 1

@GraniteStateColin

Do you mean that:

1. Only block emails with attachments sent to groups.
2. Could send emails with attachments to individual mailbox/group members.

If so, you cannot achieve it so far, because SentTo predicate does not allow distribution groups:

Here may be a workaround for you:

1. Add a mail tip to this group (It may take a while for it to take effect):
   
2. Add a mailbox to moderate emails sent to this group.
   

If you want to block the emails with attachments to group and individual mailbox, you could use the "The recipient is a member of"

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

Thanks, I'll investigate that. I thought I had tried that before and in my tests, the sender never received the rejection message, but I'm not certain I had used the same condition you've recommended here. Thanks!