Advanced Spam Filter (ASF) settings in EOP

• 5/22/2020
• 6 minutes to read
• • 
  • 
  • 
  • 
  • 
  • +3

In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, the Advanced Spam Filter (ASF) settings in anti-spam policies (also known as spam filter policies or content filter policies) allow admins to mark messages as spam based on specific message properties. ASF specifically targets these properties because they're commonly found in spam. Depending on the property, ASF detections will either mark the message as Spam or High confidence spam.

The following sections describe the ASF settings and options that are available in anti-spam policies in the Security & Compliance Center, and in Exchange Online PowerShell or standalone EOP PowerShell (New-HostedContentFilterPolicy and Set-HostedContentFilterPolicy). For more information, see Configure anti-spam policies in EOP.

Enable, disable, or test ASF settings

For each ASF setting, the following options are available in anti-spam policies:

• On: ASF adds the corresponding X-header field to the message, and either marks the message as Spam (SCL 5 or 6 for Increase spam score settings) or High confidence spam (SCL 9 for Mark as spam settings).

• Off: The ASF setting is disabled. This is the default value, and we recommend that you don't change it.

• Test: ASF adds the corresponding X-header field to the message. What happens to the message is determined by the Test mode options (TestModeAction) value:

  • None: Message routing and delivery is unaffected by the ASF detection. The message is still subject to other types of filtering and rules in EOP.

  • Add default X-header text (AddXHeader): The X-header value X-CustomSpam: This message was filtered by the custom spam filter option is added to the message. You can use this value in Inbox rules or mail flow rules (also known as transport rules) to affect the routing and delivery of the message.

  • Send Bcc message (BccMessage): The specified email addresses (the TestModeBccToRecipients parameter value in PowerShell) are added to the Bcc field of the message, and the message is delivered to the Bcc recipients. In the Security & Compliance Center, you separate multiple email addresses by semicolons ( ; ). In PowerShell, you separate multiple email addresses by commas.

  Notes:

  • Test mode is not available for the following ASF settings:

    • Conditional Sender ID filtering: hard fail (MarkAsSpamFromAddressAuthFail)

    • NDR backscatter(MarkAsSpamNdrBackscatter)

    • SPF record: hard fail (MarkAsSpamSpfRecordHardFail)

  • The same test mode action is applied to all ASF settings that are set to Test. You can't configure different test mode actions for different ASF settings.

Increase spam score settings

The following ASF settings set the spam confidence level (SCL) of detected messages to 5 or 6, which corresponds to the Spam filter verdict and the corresponding action in anti-spam policies.

Mark as spam settings

The following ASF settings set the SCL of detected messages to 9, which corresponds to the High confidence spam filter verdict and the corresponding action in anti-spam policies.