Forum Discussion

Zubinmatie25's avatar
Zubinmatie25
Copper Contributor
May 08, 2024

Custom Rule to qurantine emails in M365 based on total Number of Recipients

Lately we have been getting thousands of emails from Gmail which have pdfs and links. Last week we were hit with around 1.5 million emails which the ATP could not stop( we have A5 license). We created rules which says if attachment has specific name example Oddname.pdf then delete the email.

 

We are not in position to block gmail domain or block all emails which has pdf attachments.

 

Can we have a custom rule which based on number of recipients. Example --->if email has more then 100 recipients and gmail.com domain then quarantine the email or delete them.

 

 

Resources