Forum Discussion
Custom Rule to qurantine emails in M365 based on total Number of Recipients
Lately we have been getting thousands of emails from Gmail which have pdfs and links. Last week we were hit with around 1.5 million emails which the ATP could not stop( we have A5 license). We created rules which says if attachment has specific name example Oddname.pdf then delete the email.
We are not in position to block gmail domain or block all emails which has pdf attachments.
Can we have a custom rule which based on number of recipients. Example --->if email has more then 100 recipients and gmail.com domain then quarantine the email or delete them.
2 Replies
Unfortunately no way to configure such rules in Exchange Online. You would need a custom transport agent to do something like that, and such are not available in Exchange Online.
Thanks I had raised a User Voice for the same a month or so back, last time when we were getting hit
https://feedbackportal.microsoft.com/feedback/idea/2acd6e42-f9f1-ee11-a73d-000d3a04e3e2If that was implemented this would have helped us.
