Bulk complaint level (BCL) in EOP

• Applies to:

  ✅ Exchange Online Protection, ✅ Microsoft Defender for Office 365 plan 1 and plan 2, ✅ Microsoft Defender XDR

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, EOP assigns a bulk complaint level (BCL) value to inbound messages from bulk senders. The BCL value is added to the message in an X-header and is similar to the spam confidence level (SCL) that's used to identify messages as spam. A higher BCL value indicates a bulk message is more likely to exhibit undesirable spam-like behavior. Microsoft uses both internal and third party sources to identify bulk mail and determine the appropriate BCL value.

Bulk senders vary in their sending patterns, content creation, and recipient acquisition practices. Good bulk senders send desired messages with relevant content to their subscribers. These messages generate few complaints from recipients. Other bulk senders send unsolicited messages that closely resemble spam and generate many complaints from recipients. Messages from a bulk sender are known as bulk mail or gray mail.

Spam filtering marks messages as Bulk email based on the BCL threshold (the default value or a value you specify) and takes the specified action on the message. For more information, see Configure anti-spam policies and What's the difference between junk email and bulk email?

The BCL thresholds are described in the following table.

BCL	Description
0	The message isn't from a bulk sender.
1, 2, 3	The message is from a bulk sender that generates few complaints.
4, 5, 6, 7	The message is from a bulk sender that generates a mixed number of complaints.
8, 9	The message is from a bulk sender that generates a high number of complaints.

The default BCL threshold that's used in anti-spam policies is described in the following list:

• Default anti-spam policy and new anti-spam policies: 7.
• Standard preset security policy: 6.
• Strict preset security policy: 5.

Messages that meet or exceed the configured BCL threshold have the following default actions taken on them:

• Default anti-spam policy, new anti-spam policies, and Standard preset security policy: Deliver the message to recipient Junk Email folders.
• Strict preset security policy: Quarantine the message.

The View data by Email > Spam and Chart breakdown by Detection Technology view in the Threat protection status report has a Bulk complaint level slider. This slider is available in Filter when you also select the Detection value Bulk. Using this slider shows you the results of increasing or decreasing the BCL value in the report.