DFO Default Anti-Spam (Outbound) policy exclusions

Ernest Aduboffour 30 Reputation points
2026-10-26T20:20:00.35+00:00

We have the default Anti-Spam policy configured, along with the custom Anti-spam policy targeting high-volume senders with a higher priority. We need to exclude a specific mailbox from being blocked and added the necessary exclusion. However, the mailbox is still being added to the Restricted entities list after sending bulk emails that exceed the configured threshold.

Could you appreciate any recommendations on how to prevent this mailbox from being restricted while maintaining the existing anti-spam protections for other users.

Microsoft 365 and Office | Microsoft 365 Defender | Other | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rukshan edirisinghe 2,365 Reputation points
    2026-10-27T03:11:37.18+00:00

    Hi @Ernest Aduboffour

    What you're seeing usually comes from how outbound spam policies fall through. The default outbound policy applies to all senders and can't have exclusions. Only custom policies can be scoped. Protection stops at the first (highest priority) policy that matches the sender. So if you excluded the mailbox from your high-volume custom policy, it drops down to the default policy, whose lower limits restrict it again.

    The cleaner setup is to give that mailbox its own policy:

    1. In the Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam.
    2. Create a new outbound spam policy that applies only to that mailbox.
    3. Set its recipient limits to cover the mailbox's real volume (0 means "use the service defaults", and the maximum is 10,000).
    4. For the action when the user exceeds the limits, pick No action, alert only if you never want it blocked, or keep a restriction and rely on the higher limits.
    5. Move this policy to priority 0, above your high-volume policy.
    6. If the mailbox is still on Restricted entities (https://security.microsoft.com/restrictedusers), release it there.

    Keep in mind that Exchange Online's own service-wide sending limits still apply. For real bulk mailings, a dedicated bulk email service is the safer route.

    Roughly how many recipients a day does this mailbox send to?

    If the mailbox stops getting restricted, please consider accepting it as the answer. If it's still added to Restricted entities after this, let me know and I'll be happy to keep helping.

    Reference:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.