Forum Discussion

StefanKi's avatar
StefanKi
Iron Contributor
Oct 09, 2020

eport why the mails were moved to the Junk

In Exchange online some mails are moved to the Junk folder. Can I get a report why the mails were moved to the Junk folder? I don't like to create large whitelists.   Thanks for your help Stefan
admin
exchange online
office 365
  • StefanKi's avatar
    StefanKi
    Iron Contributor
    Oct 10, 2020

    farismalaeb 

    Thanks for the link.
    How does the process for working with junk emails looks like? After the introduction of Exchange online, the number of false positives in junk emails is going up.
    I can create whitelists and the email/domain bypass the span check. But I don't think this is a good idea.

    • farismalaeb's avatar
      farismalaeb
      Steel Contributor
      Oct 10, 2020

      StefanKi 

      Creating a whitelist is not a proper solution, as later on if this mailbox is infected and starts sending you spam, these spam will go inside your org.

      I would recommend reviewing your organization SCL level

      use the command Get-OrganizationConfig | select *scl* what is the number, the higher number, the more possible of emails marked as SPAM, 

      Did you review the Protection.microsoft.com

      Review the policy Get-HostedContentFilterPolicy

      Also you need to understand that no matter your configuration, you will still have a false positive, as sometime its not your problem more than its the sender problem, such as

      - senders are embedding vbs in your email (they don't know)

      - sender have a bad email server configuration, (No SPF ... )

      - sender have IFRAM

      Try the Report Message Add-in

      https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/enable-the-report-message-add-in?redirectSourcePath=%252farticle%252fenable-the-report-message-add-in-4250c4bc-6102-420b-9e0a-a95064837676&view=o365-worldwide#entireorg

       

      • StefanKi's avatar
        StefanKi
        Iron Contributor
        Oct 10, 2020

        farismalaeb 

        These are the Powershell results.

         

        PS C:\Users\123456> Get-HostedContentFilterPolicy

        Name SpamAction HighConfidenceSpamAction IsDefault
        ---- ---------- ------------------------ ---------
        Default MoveToJmf MoveToJmf True


        PS C:\Users\123456> Get-OrganizationConfig | select *scl*

        SCLJunkThreshold
        ----------------
        4

         

        I could learn a lot from you. Can you recommend me a good book about Exchange online?
        Thanks a lot