Configure end-user spam notifications in EOP
This topic is for Exchange Online Protection (EOP) standalone customers who are protecting on-premises mailboxes. Exchange Online customers who are protecting cloud-hosted mailboxes should read the following topic instead: Configure end-user spam notifications in Exchange Online.
You can configure end-user spam notifications for the default company-wide content filter policy or for custom content filter policies that are applied to domains. Enabling end-user spam notification messages lets your end users self-manage their own spam-quarantined messages. End-user spam notifications cannot be used with policies applied to users or groups, or to a policy with exceptions.
End-user spam notifications contain a list of all spam-quarantined messages that the end user has received during a time period that you configure (you can specify a value between 1 and 15 days). You can also configure the language in which the notification message is written.
After receiving a notification message, end users can choose from the following options:
Preview the message if you would like to preview the content or header prior to taking action.
Download the message if you would like to review the message and attachments (if any) on your device prior to taking action.
Release if the message isn’t spam and you want Office 365 to send the message to your mailbox.
Release & Allow Sender if the message isn’t spam and you want Office 365 to add the sender to your safe senders and recipients list for future emails. Keep in mind that your admin may have other organization wide allow/block configurations that override your safe sender list.
Release & Report, if the message isn’t spam and you want to send the message to your mailbox and report it to Microsoft for analysis.
Block if you want Office 365 to add the sender to your blocked senders list.
What do you need to know before you begin?
Estimated time to complete: 5 minutes
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Anti-spam" entry in the Feature permissions in EOP topic.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.
Use the EAC to configure end-user spam notifications
In the Exchange admin center (EAC), navigate to Protection > Content filter.
Select the content filter policy for which you want to enable end-user spam notifications (they are disabled by default).
In the right pane, where the summary information about your policy appears, click the Configure End-user spam notifications link.
In the subsequent dialog box, you can configure the following options:
Enable end-user spam notifications Select this check box in order to enable end-user spam notifications for this policy. (Conversely, if this policy is enabled, you can clear this check box in order to disable end-user spam notifications for this policy.)
Send end-user spam notifications every (days) Specify how often to send end-user spam notifications. The default is 3 days. You can specify between 1 and 15 days. If you specify 7 days, for example, the notification will include a list of all messages intended for that user within the past 7 days that were sent to the spam quarantine instead.
Notification language Using the drop-down list, select the language in which to write end-user spam notifications for this policy.
Click save. A summary of your content filter policy settings, including your end-user spam notification settings, appears in the right pane.
End-user spam notifications will only be functional for content filter policies that are enabled. > End-user spam notifications are only sent once per day. The delivery time of the notification cannot be guaranteed for any specific customer and is not configurable.
Tip: If you want to test end-user spam notifications by sending them to a limited set of users before fully implementing them, create a custom content filter policy that enables end-user spam notifications for the domains in which the users reside. Then, in the EAC, under Mail flow > rules, create a transport rule to block messages from firstname.lastname@example.org (the email address that sends notifications) with exceptions for the users who you want to receive the notifications. The following image is an example of creating an exception for two users (SaraD and AlexD) from domain Contoso.com:
For more information
We'd love to hear your thoughts. Choose the type you'd like to provide:
Our feedback system is built on GitHub Issues. Read more on our blog.