Built-in security features details

Anti-spam and anti-malware protection

The built-in security features as an add-on for organizations running their mailboxes on-premises delivers cloud-based spam and malware filtering that safeguards inbound and outbound email. These protections are enabled by default, so administrators don’t need to deploy or maintain on-premises filtering engines but they can still tailor filtering policies to meet their organization’s needs.

Looking for information about all built-in security features? See Built-in security features for cloud mailboxes service description.

Anti-malware protection

Our built-in security features utilize multiple anti-malware engines to deliver comprehensive, multilayered protection against all known forms of malware. Messages transported through the service are thoroughly scanned for viruses and spyware, any message found to be infected is immediately deleted. In addition, notifications may be issued to senders or administrators when an infected message is removed and not delivered. Administrators also have the option to replace infected attachments with either default or custom notification messages alerting recipients to the presence of malware.

Note

Anti-malware scanning can't be disabled.

As an add-on for on-premises mailboxes, the service only scans inbound and outbound messages that are routed by the service and does not scan messages sent from a sender in your organization to a recipient in your organization. However, for another layer of defense, you can pair the service with the built-in anti-malware protection capabilities of Exchange Server, which scans internal messages for malware.

For Exchange Online customers and built-in security features that's included in Exchange Enterprise CAL with Services for on-premises Exchange customers, it scans inbound and outbound messages that are routed by the service, as well as internal messages sent from a sender in your organization to a recipient in your organization.

For more information, see Anti-malware protection for email in Microsoft 365 and Anti-malware protection FAQ.

Customize anti-malware policies

You can configure the default policy for company-wide settings. For greater granularity, you can also create custom anti-malware policies and apply them to specified users, groups, or domains in your organization. Custom policies always take precedence over the default policy, but you can change the priority (that is, the running order) of your custom policies. For more information, see Configure anti-malware policies for email.

Anti-spam protection

The built-in security feature uses proprietary anti-spam technology to help achieve high accuracy rates. It provides strong connection filtering and spam filtering on all inbound messages. Outbound spam filtering is also always enabled if you use the service for sending outbound email, helping to protect organizations using the service and their intended recipients.

For more information, see Anti-spam protection and Anti-spam protection FAQ.

Customize anti-spam policies

Spam filtering is automatically enabled for all inbound and outbound email messages that are processed by the built-in security features for cloud mailboxes. You can't completely disable spam filtering, but you can modify specific company-wide settings in your default anti-spam policy. For greater granularity, you can also create custom anti-spam policies and apply them to specific users, groups, or domains in your organization. By default, custom policies take precedence over the default policy, but you can change the priority (running order) of your custom policies as needed.

For more information, see the following topics:

Important

In hybrid deployments, you need to configure two mail flow rules (also known as transport rules) in your on-premises Exchange organization to detect the built-in security feature spam filtering headers that are added to messages. For details, see Deliver cloud-detected spam to the Junk Email folder in on-premises mailboxes.

Anti-spoofing protection

The anti-spoofing technology in baseline security features specifically examines forgery of the From header in the message body (used to display the message sender in email clients). When there is high confidence that the From header is forged, the message is identified as spoofed.

For more information, see Anti-spoofing protection.

Quarantine

By default, built-in security features sends phishing messages and messages that contain malware directly to quarantine. Spam and bulk mail is sent to the user's Junk Email folder, unless an admin configures an anti-spam policy to send these messages to quarantine instead. Depending on why the message was quarantined, admins and end users can view and manage messages in quarantine.

For more information, see Quarantined email messages.

Report messages to Microsoft for analysis

The submission feature allows admins and end users to easily report items that they believe were incorrectly classified as junk (false positives) or missed by the filters (false negatives). Depending on the results of the analysis, we can then adjust the filtering stack to help reduce the number and impact of junk email messages filtered or allowed by the service.

For more information, see Report messages and files to Microsoft.

Feature availability

To view feature availability across plans, standalone options, and on-premises solutions, see Built in security features for cloud mailboxes service description.

Additional resources

Documentation

Training modules

  • Last updated on