Exchange Online admin: mail flow rules, anti-spam and compliance

A practical admin guide to the Exchange Online side of Microsoft 365 for small businesses: mail flow rules (transport rules) for disclaimers, warnings and blocking, message trace for "where did my email go?", connectors, anti-spam, anti-malware and quarantine, and the compliance features (archiving, retention and holds) available on each plan.

• Applies to: Microsoft 365 Business Basic, Standard and Premium (admins)
• Time: 10 to 30 minutes per task
• Difficulty: Advanced

Before you start

• You need the Global Administrator or Exchange Administrator role. See Give someone admin rights.
• The three admin portals you'll use:
  • Exchange admin centre (EAC): admin.exchange.microsoft.com for mail flow, mailboxes and message trace.
  • Microsoft Defender portal: security.microsoft.com for anti-spam, anti-malware and quarantine.
  • Microsoft Purview portal: purview.microsoft.com for retention, holds and searches.
• Test changes on one mailbox first. Mail flow rules affect every message in your organisation and can take 30 minutes or more to start working.

Mail flow rules (transport rules)

Mail flow rules check every email as it passes through Microsoft 365 and act on it before it's delivered. They work no matter which device or app sent the message. A rule has conditions (which messages), actions (what to do) and optional exceptions.

Create a mail flow rule

1. Open the rules page. In the EAC, go to Mail flow → Rules.
2. Start a rule. Select Add a rule, then pick a template (such as Apply disclaimers) or Create a new rule.
3. Set the conditions. Give the rule a clear Name, then choose Apply this rule if, Do the following and, if needed, Except if. Select Next.
4. Set the rule settings. Choose a Rule mode: Enforce (live), or Test with Policy Tips / Test without Policy Tips to try it without affecting delivery. Optionally set Severity (for reports), dates in Activate this rule on / Deactivate this rule on, and Stop processing more rules. Select Next.
5. Review and finish. Check the summary, select Finish, then Done.
6. Turn the rule on. New rules are saved disabled so you can review them. Select the rule in the list and switch on Enable or disable rule at the top of the details pane. Its Status should show Enabled.

Add a company disclaimer or legal footer

UK companies must show details such as the registered name, number and office address on business emails, and a mail flow rule is the reliable way to add them to everything.

1. Select Add a rule → Apply disclaimers and name it "External email footer".
2. Apply this rule if: The sender → is external/internal → Inside the organization. Add a second condition: The recipient → is external/internal → Outside the organization. This adds the footer only to emails leaving your business.
3. Do the following: Apply a disclaimer to the message → Append a disclaimer. Enter the text (basic HTML is allowed) and choose a fallback action, usually Wrap, for messages that can't be changed, such as encrypted ones.
4. Except if: The subject or body → Subject or body matches these text patterns, and enter a distinctive phrase from your disclaimer, such as your company number. This stops the footer being added again and again down a long email thread.
5. Finish, then enable the rule as described above, and send a test to an outside address.

Ready-made rule ideas

Message trace: find out what happened to an email

1. In the EAC, go to Mail flow → Message trace and select Start a trace.
2. Enter Senders and/or Recipients (external addresses and wildcards such as *@supplier.co.uk work), and a Time range. The default is the last 2 days.
3. Select Search. For up to 10 days you get instant results. Each message shows a Status such as Delivered, Failed, Quarantined or Filtered as spam.
4. Select a result to see its Message events, including which mail flow rules and filters acted on it.

You can search back up to 90 days, but anything over 10 days is prepared as a downloadable report and can take several hours.

Connectors

Connectors control mail flow between Microsoft 365 and other systems. A typical small business doesn't need any. You'd use one for:

• A scanner, printer or application that relays email through Microsoft 365 from a fixed IP address. See Scan-to-email from a printer with Microsoft 365.
• A third-party email filtering or archiving service that your mail must pass through.

Connectors live under Mail flow → Connectors → Add a connector in the EAC. A wrong connector can stop all inbound or outbound email, so change them carefully and test straight away.

Remote domains

Mail flow → Remote domains controls what Microsoft 365 sends to outside domains: whether automatic replies, automatic forwarding, delivery reports and non-delivery reports are allowed. The Default entry covers all domains. Add an entry for a specific domain (such as your accountant's) to treat it differently.

Anti-spam, anti-malware and quarantine

Every Microsoft 365 business plan includes Exchange Online Protection (EOP), which filters spam, phishing and malware. Business Premium adds Microsoft Defender for Office 365 Plan 1 (Safe Links, Safe Attachments and stronger anti-phishing).

Recommended: turn on a preset security policy

Rather than tuning dozens of settings by hand, use Microsoft's preset policies. Go to security.microsoft.com/presetSecurityPolicies, open Standard protection (a good default) or Strict protection, select Manage protection settings, and apply it to all recipients. Microsoft keeps the settings up to date for you.

Anti-spam policies

At security.microsoft.com/antispam you'll find:

• Anti-spam inbound policy (Default): what happens to spam, high-confidence spam, phishing and bulk mail (move to Junk or quarantine), and the bulk email threshold.
• Anti-spam outbound policy (Default): sending limits and alerts when a user is blocked for sending spam (a strong sign the account has been compromised), and the Automatic forwarding rules setting. See Forward Microsoft 365 email before allowing external forwarding.
• Connection filter policy: IP addresses that are always allowed or blocked. Use sparingly.

Anti-malware policy

Under Anti-malware in the same Threat policies area, open the default policy and make sure Enable the common attachments filter is on. It blocks file types that are rarely legitimate in email, such as executables and scripts. Add admin notifications if you want to be told when malware is caught.

Quarantine and false positives

• Review quarantined mail at security.microsoft.com/quarantine. Select a message to preview, release or delete it. Quarantine policies decide whether users can release their own messages or only request release.
• A genuine sender keeps being blocked? Report the message as "not junk" (in Outlook, or Submissions in the Defender portal), then, if needed, add an allow entry in the Tenant Allow/Block List at security.microsoft.com/tenantAllowBlockList. Allow entries for senders expire unless you choose otherwise.
• Block a persistent spammer by adding a block entry for the sender or domain in the same list.
• Make sure your own domain has SPF, DKIM and DMARC set up, because it protects others from receiving fake email in your name. See Turn on DKIM and DMARC.

Archiving, retention and legal holds

Turn on the online archive for a user

1. In the EAC, go to Recipients → Mailboxes and select the user.
2. On the Others tab, select Manage mailbox archive, switch it on and save.
3. Wait for it to appear. The Online Archive shows in Outlook and Outlook on the web, usually within a few hours (allow up to 24). By default, Exchange moves items older than two years into the archive automatically.

Retention and holds

Retention policies (keep or delete email after a set time) and holds are managed in the Microsoft Purview portal under Data lifecycle management. Litigation Hold is set per mailbox in the EAC (Recipients → Mailboxes → the user → Others → Litigation hold) and only works on mailboxes with the right licence. Check licensing before you rely on a hold for legal or HR purposes. If you need these features regularly, Business Premium is usually the most cost-effective route; talk to us about upgrading.

Troubleshooting

My mail flow rule isn't doing anything

Check its Status is Enabled (new rules start disabled), its mode is Enforce, any activation dates have passed, and a rule higher up isn't stopping processing. Allow 30 minutes after changes, then run a message trace on a test email and look at the message events.

The disclaimer is added several times or breaks the formatting

Add the "subject or body matches" exception with a phrase from the disclaimer. If plain-text emails look odd, keep the disclaimer HTML simple: short paragraphs and no large images.

Email is going to quarantine or Junk for everyone

Run a message trace to see whether it was filtered as spam, phishing or malware. If it's a genuine sender, report it as a false positive and add a temporary allow entry. If it's your own outgoing mail landing in other people's Junk, check SPF, DKIM and DMARC first.

A user has been blocked from sending email

This happens when Microsoft detects spam-like sending, usually from a compromised account. Reset the user's password, sign them out of all sessions, check for unknown inbox rules and forwarding, then release them under Restricted entities in the Defender portal (Email & collaboration → Review).

Last reviewed: October 2026