Hello,

Today, we will talk about Office 365 anti spam. Indeed, his configuration can be very tricky depending on what you want to achieve.By default, the anti spam engine in Office 365 is pretty kind with spam, so if you are used to use a good anti spam solution, and migrating to Office 365 you can experience an increase of spam in your inbox. You can customize the behavior in your Exchange Online Admin portal :

Office 365 Anti Spam

Office365 Anti Spam

You can then edit it :

Office 365 Anti Spam Settings

Office365 Anti Spam Edit 1

The “Bulk email” setting is interesting, this here you can play on “aggressiveness” with spam detection. The more you get close to 0 the more intransigent you are, and the more false positive you may get.

Office365 Anti Spam Edit 2

Here, you can block domains and/or senders for everyone.

Office365 Anti Spam Edit 3

This is the opposite of the previous setting, this is white list for everyone. You can add your partners/clients/Saas application, just to be sure.

Office365 Anti Spam Edit 4

Here, you can tag mail as spam with the language or senders region.

Office365 Anti Spam Edit 5

In the advanced settings, you will be able to detect spam on a variety of specifications, such as IP address in links, iFrame, JavaScript, SPF records, web bugs, etc.

The screen shot here are the default configuration when you create a brand new Office 365 tenant. They are great if you mail domain is new, but, if you migrate from a previous messaging platform, you may need to harden those settings a little, or your mail users may receive a lot more spam than before.

Connection Filter

If you find that your hardened anti spam configuration result in too many false positive, you can also customize your connection filter. Indeed, Microsoft offers us a maintained list of “trusted senders” that you can enable in your connection filter :

Office365 Anti Spam Connection Filter

Office365 Anti Spam Connection Filter Edit

If you tick the last box, you may receive a lot less false positive, but you open the door to more spam. You can also add white list IP ranged if you know the ones from your partners/client/SaaS applications.

Conclusion

So, as you may understand it, the configuration can be a bit tricky, there is no golden rule here, you need to play with it and find the best configuration for your company.