# Mail flow rules apply rights protection to sensitive messages
Without mail flow rules, organizations depend on users to manually apply sensitivity labels or encrypt messages.
Source: https://maester.dev/docs/tests/ZTA.35029
## Overview
Without mail flow rules, organizations depend on users to manually apply sensitivity labels or encrypt messages. This approach can lead to inconsistencies and errors, which may result in sensitive emails being sent without proper protection and increase the risk of unauthorized access and data exfiltration.
Mail flow rules help automatically add encryption and set permissions for emails that meet certain conditions, such as:
- Mail sent to people outside the company
- Mail that contains sensitive information
- Mail that must follow department-based requirements
This ensures that important messages are protected without relying on users to manually secure them.
## Remediation
- [Set up Message Encryption and mail flow rules to use Microsoft Purview Message Encryption](https://learn.microsoft.com/purview/set-up-new-message-encryption-capabilities?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#next-steps-define-mail-flow-rules-to-use-microsoft-purview-message-encryption)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data |
| Category | Information Protection |
| Product | [Exchange Online](/docs/tests/products/exchange) |
| Feature | Mail flow |
| Area | Data protection |
| Licence | RMS_S_PREMIUM2, Microsoft 365 E5 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.