Mail flow rule conditions and exceptions (predicates) in Exchange Online

The sender > is this person

For more information about using Microsoft 365 groups with this condition, see the Addresses entry in the Property types section.

The sender > is external/internal

The sender > is a member of this group

For more information about using Microsoft 365 groups with this condition, see the Addresses entry in the Property types section.

The sender > address includes any of these words

The sender > address matches any of these text patterns

For more information about regular expressions, see Regular expressions to be used in transport rules.

The sender > is on a recipient's supervision list

The sender > has specific properties including any of these words

Second property: Words

The Country attribute requires the two-letter country code value (for example, DE for Germany).

The sender > has specific properties matching these text patterns

Second property: Patterns

The sender > IP address is in any of these ranges or exactly matches

The sender > domain is

This predicate will match domains and subdomains with domain provided. For example:

For the value "domain.com", both domain "domain.com" and subdomain "subdomain.domain.com" will be matched.

The recipient > is this person

Note: You can't specify distribution groups, mail-enabled security groups, or Microsoft 365 groups. If you need to take action on messages that are sent to a group, use the To box contains(AnyOfToHeader) condition instead.

The recipient > is external/external

The recipient > is a member of this group

For more information about using Microsoft 365 groups with this condition, see the Addresses entry in the Property types section.

The recipient > address includes any of these words

Note: This condition doesn't consider messages that are sent to recipient proxy addresses. It only matches messages that are sent to the recipient's primary email address.

The recipient > address matches any of these text patterns

Note: This condition doesn't consider messages that are sent to recipient proxy addresses. It only matches messages that are sent to the recipient's primary email address.

The recipient > is on the sender's supervision list

The recipient > has specific properties including any of these words

Second property: Words

The Country attribute requires the two-letter country code value (for example, DE for Germany).

The recipient > has specific properties matching these text patterns

Second property: Patterns

The recipient > domain is

This predicate will match domains and subdomains with domain provided. For example:

For the value "domain.com", both domain "domain.com" and subdomain "subdomain.domain.com" will be matched.

The subject or body > subject or body includes any of these words

The subject or body > subject or body matches these text patterns

The subject or body > subject includes any of these words

The subject or body > subject matches these text patterns

Any attachment > content includes any of these words

Any attachment > content matches these text patterns

Note: Only the first 150 kilobytes (KB) of the attachments are scanned.

Any attachment > content can't be inspected

Any attachment > file name matches these text patterns

Any attachment > file extension includes these words

Any attachment > size is greater than or equal to

In the EAC, you can only specify the size in kilobytes (KB).

Any attachment > didn't complete scanning

Any attachment > has executable content

Any attachment > is password protected

Any attachment > has these properties, including any of these words

Second property: Words

This condition helps you integrate mail flow rules with SharePoint, File Classification Infrastructure (FCI) in Windows Server 2012 R2 or later, or a third-party classification system.

You can select from a list of built-in properties, or specify a custom property.

Any recipient > address includes any of these words

Any recipient > address matches any of these text patterns

The message > To box contains this person

The message > To box contains a member of this group

The message > Cc box contains this person

The message > contains a member of this group

The message > To or Cc box contains this person

The message > To or Cc box contains a member of this group

The message > size is greater than or equal to

In the EAC, you can only specify the size in kilobytes (KB).

Note: Message size limits on mailboxes are evaluated before mail flow rules' action. A message that's too large for a mailbox will be rejected before a rule with this condition is able to act on the message.

The message > character set name includes any of these words

The sender and the recipient > the sender's relationship to a recipient is

The sender and the recipient > the message is between members of these groups

For more information about using Microsoft 365 groups with this condition, see the Addresses entry in the Property types section.

The sender and the recipient > the manager of the sender or recipient is this person

Second property: Addresses

The sender and the recipient > the sender and recipient property compares as

Second property: Evaluation

The message properties > include the message type

The message properties > include this classification

Note: This condition/exception isn't available in standalone EOP environments.

The message properties > don't include any classification

Note: This condition/exception isn't available in standalone EOP environments.

The message properties > include the importance level

A message header > includes any of these words

Second property: Words

The name of the header field and the value of the header field are always used together.

A message header > matches these text patterns

Second property: Patterns

The name of the header field and the value of the header field are always used together.

• City
• Company
• Country
• CustomAttribute1 - CustomAttribute15
• Department
• DisplayName
• Email
• FaxNumber
• FirstName
• HomePhoneNumber
• Initials
• LastName
• Manager
• MobileNumber
• Notes
• Office
• OtherFaxNumber
• OtherHomePhoneNumber
• OtherPhoneNumber
• PagerNumber
• PhoneNumber
• POBox
• State
• Street
• Title
• UserLogonName
• ZipCode

In the EAC, to specify multiple words or text patterns for the same attribute, separate the values with commas. For example, the value San Francisco,Palo Alto for the City attribute looks for "City equals San Francisco" or "City equals Palo Alto".

In Exchange Online PowerShell, use the syntax "AttributeName1:Value1,Value 2 with spaces,Value3...","AttributeName2:Word4,Value 5 with spaces,Value6...", where Value is the word or text pattern that you want to match, for example, "City:San Francisco,Palo Alto" or "City:San Francisco,Palo Alto", "Department:Sales,Finance".

When you specify multiple attributes, or multiple values for the same attribute, the or operator is used. Don't use values with leading or trailing spaces.

The Country attribute requires the two-letter ISO 3166-1 country code value (for example, DE for Germany). For more information, see Country Codes - ISO 3166.

In Exchange Online PowerShell, separate the multiple values by commas.

This condition doesn't consider messages that are sent to recipient proxy addresses. It only matches messages that are sent to the recipient's primary email address.

The recipient picker in the EAC doesn't allow you to select Microsoft 365 groups from the list of recipients. But, you can enter the email address of a Microsoft 365 group in the box next to Check names, and then validate the email address by selecting Check names, which will add the group to the add box.

• Arabic/iso-8859-6
• Chinese/big5
• Chinese/euc-cn
• Chinese/euc-tw
• Chinese/gb2312
• Chinese/iso-2022-cn
• Cyrillic/iso-8859-5
• Cyrillic/koi8-r
• Cyrillic/windows-1251
• Greek/iso-8859-7
• Hebrew/iso-8859-8
• Japanese/euc-jp
• Japanese/iso-022-jp
• Japanese/shift-jis
• Korean/euc-kr
• Korean/johab
• Korean/ks_c_5601-1987
• Turkish/windows-1254
• Turkish/iso-8859-9
• Vietnamese/tcvn

In Exchange Online PowerShell, you can specify multiple domains separated by commas.

• Single IP address: For example, 192.168.1.1.
• IP address range: For example, 192.168.0.1-192.168.0.254.
• Classless InterDomain Routing (CIDR) IP address range: For example, 192.168.0.1/25.

In Exchange Online PowerShell, you can specify multiple IP addresses or ranges separated by commas.

In Exchange Online PowerShell, you use the Get-MessageClassification cmdlet to identify the message classification.

For example, use the following command to search for messages with the Company Internal classification and prepend the message subject with the value CompanyInternal: New-TransportRule "Rule Name" -HasClassification @(Get-MessageClassification "Company Internal").Identity -PrependSubject "CompanyInternal"

• Automatic reply (OOF)
• Auto-forward (AutoForward)
• Encrypted
• Calendaring
• Permission controlled (PermissionControlled)
• Voicemail
• Signed
• Approval request (ApprovalRequest)
• Read receipt (ReadReceipt)

Note: When Outlook or Outlook on the web is configured to forward a message, the ForwardingSmtpAddress property is added to the message.

In Exchange Online PowerShell, you specify multiple regular expressions separated by commas, and you enclose each regular expression within quotation marks (").
Regular Expressions used in Transport Rules are NOT case sensitive.

• Bypass spam filtering (-1)
• Integers 0 through 9

In the EAC, you can only specify the size in kilobytes (KB).

In Exchange Online PowerShell, when you enter a value, qualify the value with one of the following units:

• B (bytes)
• KB (kilobytes)
• MB (megabytes)
• GB (gigabytes)

For example, 20 MB. Unqualified values are typically treated as bytes, but small values may be rounded up to the nearest kilobyte.

• The message was sent or received over an authenticated connection AND the sender meets at least one of the following criteria: The sender is a mailbox or a mail user or a group, or a mail-enabled public folder in the organization.
• The sender's email address is in an accepted domain that's configured as an authoritative domain or in an internal relay domain, and the message was sent or received over an authenticated connection. For more information about accepted domains, see Manage accepted domains in Exchange Online.

A sender is considered to be outside the organization if either of the following conditions is true:

• The sender's email address isn't in an accepted domain.
• The sender's email address is in an accepted domain that's configured as an external relay domain.

Note: To determine whether mail contacts are considered to be inside or outside the organization, the sender's address is compared with the organization's accepted domains.

• Inside the organization (InOrganization)
• Outside the organization (NotInOrganization)

• The recipient is a mailbox, mail user, group, or mail-enabled public folder that exists inside the organization.
• The recipient's email address is in an accepted domain that's configured as an authoritative domain or in an internal relay domain, and the message was sent or received over an authenticated connection.
• The recipient's domain is in a remote domain with the IsInternal parameter being set to the value $true.

A recipient is considered to be outside the organization if either of the following conditions is true:

• The recipient's email address isn't in an accepted domain.
• The recipient's email address is in an accepted domain that's configured as an external relay domain.

However, if the text is surrounded by other characters, it isn't considered a match. For example, "contoso" doesn't match the following values:

• Acontoso
• Contosoa
• Acontosob

The asterisk (*) is treated as a literal character, and isn't used as a wildcard character.

The "at" sign (@) is also treated as a literal character. Therefore, if it's used when searching Recipient Addresses, it won't match. For example:

• @contoso.com won't match [email protected]
• contoso.com will match [email protected]

In this scenario, the correct way to set up matching patterns is to use either ExceptIfRecipientDomainIs or ExceptIfRecipientAddressMatchesPatterns