> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/defender/anti-spam-outbound.md).

# Anti-spam (outbound)

Outbound anti-spam — the `HostedOutboundSpamFilterPolicy` object in Exchange Online — governs how a tenant detects and throttles a mailbox that starts sending spam or an unusually high volume of mail, which is the classic signature of a compromised account being used to blast phishing or spam to other organizations. It's a distinct policy type from inbound anti-spam, with an entirely different field set, even though Augmentt (matching the Microsoft Defender portal) groups both under one **Anti-spam** menu.

{% hint style="info" %}
Outbound anti-spam is part of standard **Exchange Online Protection** and doesn't require a Defender for Office 365 add-on license. See the main [Defender](/modules/secure/defender.md) page for how templates, baselines, and deployment work generally.
{% endhint %}

## What you can configure

* **Restrict the number of external recipients a user can send to per hour** (`RecipientLimitExternalPerHour`).
* **Restrict the number of internal recipients a user can send to per hour** (`RecipientLimitInternalPerHour`).
* **Maximum recipients per day** (`RecipientLimitPerDay`) — a rolling daily cap across all recipients.
* **Action when threshold is reached** (`ActionWhenThresholdReached`) — what happens once a user crosses the above limits: **Restrict the user from sending mail** (`BlockUser`), **restrict the user until the next day** (`BlockUserForToday`), or **alert only, no restriction** (`Alert`).
* **Automatic forwarding** (`AutoForwardingMode`) — whether the tenant allows automatic external mail forwarding at all: **Off** (never allowed — the option Microsoft and Augmentt recommend, since attackers commonly set up a silent forwarding rule after compromising a mailbox), **Automatic — system-controlled**, or **On** (always allowed).
* **Send a copy of suspicious outbound email to** (`BccSuspiciousOutboundMail` / `BccSuspiciousOutboundAdditionalRecipients`) — Bcc flagged outbound mail to a review mailbox for visibility.
* **Notify specific people if a sender is blocked from sending mail** (`NotifyOutboundSpam` / `NotifyOutboundSpamRecipients`) — alert your team's admins or a distribution list the moment a mailbox gets throttled, so a likely compromise gets eyes on it immediately rather than being noticed only when a customer complains.

## Augmentt's default template

Augmentt ships one out-of-the-box outbound anti-spam template:

### Anti-spam outbound - Secure Score recommendations

| Setting                           | Value                                           |
| --------------------------------- | ----------------------------------------------- |
| External recipient limit per hour | 500                                             |
| Internal recipient limit per hour | 1000                                            |
| Daily recipient limit             | 1000                                            |
| Action when threshold reached     | Restrict the user from sending mail (BlockUser) |
| Automatic forwarding              | Off                                             |
| Bcc suspicious outbound mail      | Off                                             |
| Bcc additional recipients         | None                                            |
| Notify on outbound spam block     | Off                                             |
| Notify recipients                 | None                                            |

These numeric limits match Microsoft's **Standard** preset tier exactly (Microsoft's **Strict** tier tightens further, to 400/hour external, 800/hour internal, 800/day). The template's limits and action satisfy CIS's recommended minimum, but note the **Notify** field is off by default — see below, this needs to be turned on separately to fully satisfy Augmentt's own compliance check for this control.

**Resolves posture check(s):**

* **CIS\_M365 §2.1.15 — "Ensure outbound anti-spam message limits are in place"** and Augmentt's own **OUTBOUND\_ANTI\_SPAM\_MESSAGE\_LIMITS** check (evaluated directly against the tenant's live policy data, independent of Secure Score — see `evaluateOutboundAntiSpamMessageLimits` in the codebase). This check actually verifies **five independent conditions**, each of which can pass at "equal to or more restrictive than" the recommended value:
  1. External recipient limit per hour ≤ 500
  2. Internal recipient limit per hour ≤ 1000
  3. Daily recipient limit ≤ 1000
  4. Action when threshold reached = Restrict the user from sending mail (`BlockUser`)
  5. **At least one notify-on-block recipient is configured**

{% hint style="warning" %}
Point 5 above means the shipped default template, deployed as-is with no notify recipients added, will **not** fully satisfy this check — the numeric limits and action pass, but the notify condition needs at least one recipient added during deployment (or an edit afterward) to close it out. Add your MSP's alerting mailbox or a distribution list to **Notify specific people if a sender is blocked from sending mail** when you deploy this template.
{% endhint %}

## Deploying and troubleshooting

Deployment mechanics are the same across Defender policy types — see the main [Defender](/modules/secure/defender.md) page. Because this check is evaluated live against ingested tenant data rather than Secure Score's cache, a fix here can show as compliant faster than the usual 24–72 hour Secure Score window — but it still depends on Augmentt's own ingestion cycle having run since the change.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/defender/anti-spam-outbound.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.