Check ID: defender_antispam_outbound_policy_configured
Provider: Microsoft 365
Service: defender
Severity: LOW
Categories: email-security, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Defender for Office 365 outbound spam policies must send administrator alerts and Bcc suspicious outbound messages when a sender exceeds limits or is blocked. The assessment checks for notify limit exceeded and notify sender blocked with recipient addresses in the default policy and any applicable custom policies.

​
Risk

Absent alerts and copies, compromised mailboxes can exfiltrate data and send phishing undetected. This harms email deliverability through blocklisting and throttling (availability), undermines domain integrity, and impedes forensics by removing evidence needed to triage abusive outbound traffic.

​
Recommendation

Enable outbound spam notifications and Bcc suspicious messages to a monitored mailbox, applying them consistently to default and scoped policies. Set prudent sending limits and block actions, disable unnecessary external forwarding, and monitor alerts-aligning with least privilege and defense in depth.

​
Remediation

Set-HostedOutboundSpamFilterPolicy -Identity Default -BccSuspiciousOutboundMail true -BccSuspiciousOutboundAdditionalRecipients "&lt;INSERT-EMAIL&gt;" -NotifyOutboundSpam true -NotifyOutboundSpamRecipients “<INSERT-EMAIL>”

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_antispam_outbound_policy_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks