Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Custom Rule to qurantine emails in M365 based on total Number of Recipients

Copper Contributor

Lately we have been getting thousands of emails from Gmail which have pdfs and links. Last week we were hit with around 1.5 million emails which the ATP could not stop( we have A5 license). We created rules which says if attachment has specific name example Oddname.pdf then delete the email.

 

We are not in position to block gmail domain or block all emails which has pdf attachments.

 

Can we have a custom rule which based on number of recipients. Example --->if email has more then 100 recipients and gmail.com domain then quarantine the email or delete them.

 

 

2 Replies

Unfortunately no way to configure such rules in Exchange Online. You would need a custom transport agent to do something like that, and such are not available in Exchange Online.

@VasilMichev 

 

Thanks I had raised a User Voice for the same a month or so back, last time when we were getting hit

https://feedbackportal.microsoft.com/feedback/idea/2acd6e42-f9f1-ee11-a73d-000d3a04e3e2

 

If that was implemented this would have helped us.