Anti-spam (hosted content filter) policies are configured with recommended thresholds and actions

Overview

Anti-spam policies (also called hosted content filter policies) decide what Exchange Online Protection does with inbound messages that the spam filter classifies as spam, high-confidence spam, phishing, high-confidence phishing, or bulk — quarantine the message, move it to the user’s Junk Email folder, or deliver it untouched. Threat actors abuse over-permissive anti-spam configurations in two predictable ways. They slip credential-harvesting and malware-laden messages below a loose bulk-complaint threshold so the messages reach inboxes that should have rejected them; and they exploit the per-policy allowed-sender list — a single domain added to fix a one-time deliverability complaint bypasses spam, spoofing, and most phishing checks for every future message from that domain, so when the domain is later compromised or impersonated, phishing flows in without inspection. Microsoft’s documented recommendation is to quarantine high-confidence verdicts with admin-only release, keep the bulk threshold low enough that genuine bulk traffic is filtered, and never use the per-policy allow lists for routine exceptions — narrow, time-bounded entries belong in the Tenant Allow/Block List, where they can be reviewed and expired. Some teams worry that strict quarantine actions will lose legitimate vendor mail; the recommended quarantine policies route everything to admin review first, so messages can be released without the recipient ever seeing them.

Remediation

• Anti-spam protection in EOP
• Configure anti-spam policies in EOP
• Set-HostedContentFilterPolicy
• Bulk complaint level (BCL) values
• Recommended anti-spam settings

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Medium
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Anti-spam
Area	Email and collaboration protection
ATT&CK	T1566 Phishing
Licence	EXCHANGE_S_STANDARD
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.