Exchange Online Quarantine
In Exchange Online, there are a few ways to handle email messages from external sources that could be a malicious, contain malware, phishing attempts and more. These messages could be quarantined (user or system depending on the email), sent to Junk Mail, redirected to another mailbox or even removed completely. Now if we have emails going to the Quarantine, we will probably also want to notify the end users that there are emails in their Quarantine so that the end users can decide how to handle these messages. By Default this is turned off in a tenant and needs to be enabled and configured.
Configure Quarantine Notifications
In order to edit the End User Quarantine Notification settings, we need to open up the Security and Compliance Center and navigate to Threat Management –> Policy –> Anti-Spam Settings. Inside of the Anti-Spam Settings, the global End User Quarantine configuration is available in the Default Anti-Spam Policy:
If we configure the End User Quarantine settings, we see this screen:
That isn’t a whole lot for configuration settings. What if we have a custom Ant-Spam Policy, can we make any configuration changes to it for End User Spam Notifications:
Looks like it. However, these settings are limited, just like the default Anti-Spam policy.
PowerShell Configuration
With PowerShell, we find that there are quite a few other options that we can use to config for these notifications. Now, where can we find the cmdlets to handle these configurations? If we look at Quarantine cmdlets, we see that these are our available options:
Delete-QuarantineMessage Export-QuarantineMessage Get-QuarantineMessage Get-QuarantineMessageHeader Preview-QuarantineMessage Release-QuarantineMessage
All of these deal with emails that are present in the Quarantine. So, what other cmdlets are there? With a bit of guesswork we can deduce that the cmdlet has to do with the Anti-Spam configuration, like we see in the Security and Compliance Center. The PowerShell cmdlets for Anti-Spam Policy settings revolve around the HostedContentFilterPolicy verb. So, let’s explore the Get cmdlet to see what settings there are:
What see is generic with little information. There is the Default global policy, the Strict policy template, Standard policy temple and one custom policy. Let’s look at the Default policy and pick out any relevant properties:
Get-HostedContentFilterPolicy Default | Fl
Looks like there are a few entries with EnduserSpamNotifications:
EndUserSpamNotificationFrequency EnableEndUserSpamNotifications EndUserSpamNotificationCustomFromAddress ** EndUserSpamNotificationCustomFromName ** EndUserSpamNotificationCustomSubject EndUserSpamNotificationLanguage EndUserSpamNotificationLimit ***
** It appears that quite a few of these settings are actually deprecated in PowerShell and no longer available
*** Internal Microsoft use only
With these restrictions in mind, what can we change? We can turn on the notifications (EnableEndUserSpamNotifications), decide how often [1 to 15 days] the emails are sent (EndUserSpamNotificationFrequency), the language of the emails (EndUserSpamNotificationLanguage) as well as the subject of the emails (EndUserSpamNotificationCustomSubject). For our example, we will turn on notifications, set the frequency to every two days, set the language of the emails to French and set to subject to “Notification de Spam”:
Set-HostedContentFilterPolicy Default -EndUserSpamNotificationFrequency 2 -EndUserSpamNotificationLanguage French -EndUserSpamNotificationCustomSubject "Notification de Spam"
Before this change:
Verifying our change:
Get-HostedContentFilterPolicy Default | Fl name,eduser*
Takeaways
The key here is that we can create custom Anti-Spam policies with their own Quarantine message cadence if we desire. It is not a global setting, unless we want it to be by using only the Default Anti-Spam Policy.
Further Reading
I cover this topic and more topics related to email quarantine / security in three books:
Security and Compliance Center PowerShell
|
Microsoft 365 Security for IT Pros
|
Exchange Online PowerShell
|
