Exchange Online patterns - what is the latest?

Iron Contributor

For many years various O365 documents contained the fallacy that EXO uses .Net regular expressions in mail flow rule predicates; here is the predicate article from May that could do with an update:

https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-ex... (look for patterns toward the end)

 

Oh no it fscking well doesn't, as any experienced admin will ruefully tell you.

 

And no, MS customer support won't help with patterns because it's "customer configuration" (and I suspect they know perfectly well what they would be getting into if they did). 

 

Thankfully we now have a Learn page from August with an alternative take on the topic:

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/regular-expressions-usage-transp...

 

This offers a much smaller subset of metacharacters to work with. Round brackets replace square ones for sets (termed "groups" in New Patterns terminology) and we no longer have occurrences. 

 

If I follow the new syntax correctly, regular expression \w{4,8} can be written as:

 

(\w\w\w\w|\w\w\w\w\w|\w\w\w\w\w\w|\w\w\w\w\w\w\w|\w\w\w\w\w\w\w\w)

 

Which can then be reduced (because our limit is by character for the whole tenancy) as: 

 

\w\w\w\w(|\w|\w\w|\w\w\w|\w\w\w\w)

\w\w\w\w(|\w(|\w|\w\w|\w\w\w))

\w\w\w\w(|\w(|\w(|\w|\w\w)))

\w\w\w\w(|\w(|\w(|\w(|\w))))

 

The final reduction offers no practical reduction in length, so \w{4,8} should be written as:

 

\w\w\w\w(|\w(|\w(|\w|\w\w)))

 

Do I understand correctly?

 

Any other observations on patterns would be extremely welcome, but please note that this question is tagged just for Exchange Online; the rules for on-premises transport rules are probably subtly different.

1 Reply

Nope, when I finally the pattern it fails with:
Error: Invalid Operation:
Cannot process argument transformation on parameter 'SubjectOrBodyMatchesPatterns'.
Cannot convert value "System.String[]" to type "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.Pattern[]". Error: "You cannot configure a pattern with empty 'OR' conditions (e.g. 'a|' or '|a'). Remove the empty 'OR' conditions from the pattern to continue."

I try \w\w\w(\w|\w\w|\w\w\w|\w\w\w\w|\w\w\w\w\w) which failed at the first attempt, but appears to be acceptable. It is of course far too long, and enough of those patterns will either put the rule length over the maximum or burn through the maximum number of regular expression characters permitted for the whole tenant.

 

Incidentally, if one does provide an invalid pattern then the following error is given:
Error: Invalid Operation:
Cannot process argument transformation on parameter 'SubjectOrBodyMatchesPatterns'.
Cannot convert value "System.String[]" to type "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.Pattern[]". Error: "The pattern contains incorrect characters, operators, or constructs. Learn what patterns are supported using https://go.microsoft.com/fwlink/?linkid=2092813"

Which links to: 
https://learn.microsoft.com/en-gb/dotnet/standard/base-types/regular-expression-language-quick-refer... and perpetuates the same ignorance we started with!