> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/anti-spam-inbound.md). # Anti-spam (inbound) Inbound anti-spam — the `HostedContentFilterPolicy` object in Exchange Online — is where junk-mail, bulk-mail, and low-confidence phishing detection is tuned for mail arriving into your client's tenant. It's a distinct policy type from outbound anti-spam even though Augmentt (matching the Microsoft Defender portal) groups both under one **Anti-spam** menu; inbound and outbound have entirely different fields and are deployed as separate policy objects. {% hint style="info" %} Inbound anti-spam requires **Defender for Office 365 Plan 1** at minimum for the full feature set covered here. See the main [Defender](/modules/secure/defender.md) page for how templates, baselines, and deployment work generally. {% endhint %} ## What you can configure **Email threshold and spam properties** * **Spam action** and **bulk threshold** (`MarkAsSpamBulkMail`, `BulkThreshold`) — whether bulk mail is scored as spam at all, and how aggressive the bulk-mail complaint-level threshold is (1–9; lower catches more). * A set of independent content-heuristic toggles that each increase a message's spam score or mark it as spam outright when present: links to info/marketing sites (`IncreaseScoreWithBizOrInfoUrls`), image links to remote sites (`IncreaseScoreWithImageLinks`), numeric IP addresses in URLs (`IncreaseScoreWithNumericIps`), URLs redirecting to unusual ports (`IncreaseScoreWithRedirectToOtherPort`), empty messages (`MarkAsSpamEmptyMessages`), JavaScript in HTML (`MarkAsSpamJavaScriptInHtml`), embedded object tags (`MarkAsSpamObjectTagsInHtml`), iframes (`MarkAsSpamFramesInHtml`), embed tags (`MarkAsSpamEmbedTagsInHtml`), form tags (`MarkAsSpamFormTagsInHtml`), web bugs/tracking pixels (`MarkAsSpamWebBugsInHtml`), sensitive-word matches (`MarkAsSpamSensitiveWordList`), a hard SPF failure (`MarkAsSpamSpfRecordHardFail`), conditional sender-ID filtering / From-address auth failure (`MarkAsSpamFromAddressAuthFail`), and backscatter / non-delivery-report abuse (`MarkAsSpamNdrBackscatter`). * **Test mode** (`TestModeAction` / `TestModeBccToRecipients`) — run the policy without actually acting on messages, optionally Bcc'ing flagged mail to a review mailbox instead. * **Blocked languages** and **blocked regions** (`EnableLanguageBlockList`/`LanguageBlockList`, `EnableRegionBlockList`/`RegionBlockList`) — mark mail as spam based on its content language or the sender's geographic origin. **Actions** * Five independent action + quarantine-policy pairs, one per detection category: **spam** (`SpamAction`/`SpamQuarantineTag`), **high-confidence spam** (`HighConfidenceSpamAction`/`HighConfidenceSpamQuarantineTag`), **phishing** (`PhishSpamAction`/`PhishQuarantineTag`), **high-confidence phishing** (`HighConfidencePhishAction`/`HighConfidencePhishQuarantineTag`), and **bulk mail** (`BulkSpamAction`/`BulkQuarantineTag`) — each can be set to Move to Junk, Quarantine, Delete, Redirect, etc. * **Intra-org messages action** (`IntraOrgFilterState`) — how internal-to-internal mail is filtered. * **Enable spam safety tips** (`InlineSafetyTipsEnabled`). * **Zero-hour auto purge (ZAP)** for spam and for phishing (`SpamZapEnabled`, `PhishZapEnabled`) — retroactively pull already-delivered mail back out of inboxes when it's later identified as spam/phishing. * **Quarantine retention period** (`QuarantineRetentionPeriod`, in days). * Optional message modifications: **add an X-header** (`AddXHeaderValue`), **prepend the subject line** (`ModifySubjectValue`), **redirect to specific recipients** (`RedirectToRecipients`). **Allowed and blocked senders** * **Allowed senders** / **allowed sender domains** (`AllowedSenders` / `AllowedSenderDomains`) and **blocked senders** / **blocked sender domains** (`BlockedSenders` / `BlockedSenderDomains`) — explicit sender-level and domain-level allow/block lists. ## Augmentt's default template Augmentt ships one out-of-the-box inbound anti-spam template: ### Anti-spam inbound - Secure Score recommendations | Setting | Value | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | | Bulk threshold | 6 | | Spam action | Move to Junk | | High-confidence spam action | Quarantine | | Phishing action | Quarantine | | High-confidence phishing action | Quarantine | | Bulk mail action | Move to Junk | | Allowed senders / domains | None configured | | Blocked senders / domains | None configured | | Zero-hour auto purge (spam, phishing) | On, On | | Inline safety tips | On | | Quarantine retention | 30 days | | All HTML/content heuristic toggles (image links, IP-in-URL, scripts, iframes, forms, embeds, web bugs, sensitive words, SPF hard fail, from-address auth fail, backscatter) | Off (Microsoft's un-tuned defaults) | | Test mode | None | This matches Microsoft's **Standard** preset tier (bulk threshold 6, Move-to-Junk on plain spam/bulk, Quarantine on higher-confidence categories) rather than **Strict** (Microsoft's Strict tier lowers the bulk threshold to 5 and quarantines plain spam instead of moving it to Junk). Augmentt does not currently ship a "more aggressive" inbound anti-spam variant matching Microsoft's Strict tier — if you need it, build one as a custom template. **Resolves posture check(s):** * **CIS\_M365 §2.1.14 — "Ensure inbound anti-spam policies do not contain allowed domains"** and Augmentt's own **INBOUND\_ANTI\_SPAM\_ALLOWED\_DOMAINS** check (evaluated directly against the tenant's live policy data, independent of Secure Score — see `evaluateInboundAntiSpamAllowedDomains` in the codebase). The default template's empty `AllowedSenderDomains` list satisfies this; adding any allowed domain later would fail it again, since an allow-listed domain bypasses spam filtering entirely and is a common spoofing vector. * **CIS\_M365 §2.1.6 — "Ensure Exchange Online Spam Policies are set to notify administrators"** — this specific check is about admin notification for blocked senders, a related but separate setting from the fields the default template configures; verify it's set in the tenant if this check is failing. {% hint style="info" %} Unlike most Defender checks, the allowed-domains check reflects the tenant's actual policy configuration as of Augmentt's last ingestion cycle rather than Secure Score's 24–72 hour cache — so it can catch up faster after a fix, though it still depends on ingestion having run. See the main [Defender](/modules/secure/defender.md) page's Compliance section. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/defender/anti-spam-inbound.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.