Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Notify Administrator of Outbound Spam [CHK-1065]

Email boxes are safeguarded against spam by Exchange Online. In some instances, forwarding notifications of blocked emails to administrators is beneficial.

Rationale

A blocked outgoing email can signal that the sender's account may have been compromised and is being used to send spam.

Fix

An automated fix is available through Attic, which can be accepted via a ticket.

To fix it yourself, follow these steps:

  1. Navigate to Microsoft 365 Defender
  2. Expand Email & Collaboration and select Policies & Rules
  3. On the Policies & Rules page, select Anti-spam under Policies
  4. Click on Anti-spam outbound policy (default)
  5. Select Edit protection settings under Notifications
  6. Check ON: Send a copy of outbound messages that exceed these limits to these users and groups and enter the desired email addresses
  7. Check ON: Notify these users and groups if a sender is blocked due to sending outbound spam and enter the desired email addresses
  8. Click on Save

Impact

Upon successful implementation of the fix, detections of outbound spam will be forwarded to the specified administrator email address, enhancing the security of your environment.

More Information

For more details, refer to the CIS Item: 4.2 (L1) Ensure Exchange Online Spam Policies are set to notify administrators (Automated) under the E3 Level 1 Profile.