.png)
Transport Rule Predicates
Applies to: Exchange Online
Topic Last Modified: 2013-02-20
In Microsoft Exchange 2013, predicates are used to create conditions and exceptions in a Transport rule. Transport rules can be applied to email messages routed through your organization.
Looking for management tasks related to Transport rules? See Manage Transport Rules.
Looking for the Exchange Server version of this topic? See Transport Rule Predicates.
Looking for the Exchange Online Protection version of this topic? See Transport Rule Predicates
Contents
Predicates and predicate properties
Transport rule conditions and exceptions consist of one or more predicates. Predicates instruct the Transport rules agent to examine a specific part of an email message, such as sender, recipients, subject, other message headers, and message body. Based on this analysis, the Transport rules agent determines whether the rule should be applied to that message. As such, predicates act as building blocks for conditions and exceptions.
To determine whether a Transport rule should be applied to a message, most predicates have one or more properties for which you must specify a value. For example, the From predicate requires that you specify the sender for the message. Some predicates don't have properties. For example, the AttachmentHasExecutableContent predicate simply inspects whether any attachment in a message has executable content, and therefore doesn't require any values.
Because some predicates examine specific fields within an email message (such as the message header fields), you must set two predicate properties. For example, when you use a predicate to inspect message headers, one predicate property specifies the header to examine, such as To, From, Received, or Content-Type, and the second property specifies the value for that message header.
To assign a value to a predicate in the Exchange admin center (EAC), you can use the drop-down lists and secondary dialog boxes that are displayed in the Transport rule dialog. These help you select the correct property types and valid values for those property types. In the Exchange Management Shell, the properties are available as parameters of the New-TransportRule and Set-TransportRule cmdlets. Property values are specified after the property name.
The following table lists the predicates available and provides the following information about each predicate:
-
The Predicate name in EAC column lists the predicate as it appears in the condition and exception lists in the EAC.
-
The Predicate name in Shell column lists the predicate name that you can use in the New-TransportRule and Set-TransportRule cmdlets. This is also the name returned by the Get-TransportRulePredicate cmdlet in the Shell.
-
The Predicate property type and Second predicate property type columns list the property types. Most property types accept specific values. To determine valid values for a property type, see the table Property types used in Transport rule predicates later in this topic.
 Note: |
|---|
|
Each predicate listed in the following table also has an equivalent exception that can be selected in the EAC. In the Shell, predicates that can be used as exceptions start with ExceptIf. For example, for the FromMemberOf predicate, the parameter that can be used as an exception in Transport rule cmdlets is called ExceptIfFromMemberOf. The same predicate object contains the logic for use in both Transport rule conditions and exceptions. Therefore, when you use the Get-TransportRulePredicate cmdlet to list predicates, exceptions aren't listed as separate predicates. |
Available predicates
| Predicate name in EAC | Predicate name in Shell | Predicate property type | Second predicate property type | Description | ||
|---|---|---|---|---|---|---|
| The sender is | | Addresses | Not applicable | | ||
| The sender is located | | FromUserScope | Not applicable | | ||
| The sender is a member of | | Addresses | Not applicable | | ||
| The sender address includes | | Words | Not applicable | | ||
| The sender address matches | | Patterns | Not applicable | | ||
| The sender is on a recipient's list | | List Type | Not applicable | | ||
| The sender's specified properties include any of these words | | Words | Not applicable | | ||
| The sender's specified properties match these text patterns | | Patterns | Not applicable | | ||
| The sender has overridden the Policy Tip | | Not applicable | Not applicable | | ||
| Sender's IP address is in the range | | IPRanges | Not applicable | | ||
| The sender's domain is | | Domain name | Not Applicable | | ||
| The recipient is | | Addresses | Not applicable |
| ||
| The recipient is located | | ToUserScope | Not applicable | | ||
| The recipient is a member of | | Addresses | Not applicable | | ||
| The recipient address includes | | Words | Not applicable | | ||
| The recipient address matches | | Patterns | Not applicable | | ||
| The recipient is on the sender's list | | List Type | Not applicable | | ||
| The recipient's specified properties include any of these words | | Words | Not applicable | | ||
| The recipient's specified properties match these text patterns | | Patterns | Not applicable | | ||
| A recipient's domain is | | Domain Name | Not applicable | | ||
| The subject or body includes | | Words | Not applicable | | ||
| The subject or body matches | | Patterns | Not applicable | | ||
| The subject includes | | Words | Not applicable | | ||
| The subject matches | | Patterns | Not applicable | | ||
| Any attachment's content includes | | Words | Not applicable | | ||
| Any attachment's content matches | | Patterns | Not applicable |
| ||
| Any attachment's content can't be inspected | | Not applicable | Not applicable | | ||
| Any attachment's file name matches | | Patterns | Not applicable | | ||
| Any attachment's file extension matches | | Words | Not applicable | | ||
| Any attachment size is greater than or equal to | | Size | Not applicable | | ||
| The message didn't complete scanning | | Not applicable | Not applicable | | ||
| Any attachment has executable content | | Not applicable | Not applicable | | ||
| Any attachment is password protected | | Not applicable | Not applicable | | ||
| The message contains sensitive information | | SensitiveInformation | Not applicable | | ||
| The To box contains | | Addresses | Not applicable | | ||
| The To box contains a member of | | Addresses | Not applicable | | ||
| The Cc box contains | | Addresses | Not applicable | | ||
| The Cc box contains a member of | | Addresses | Not applicable | | ||
| The To or Cc box contains | | Addresses | Not applicable | | ||
| The To or Cc box contains a member of | | Addresses | Not applicable | | ||
| The message size is greater than or equal to | | Size | Not applicable | | ||
| The message character set name includes any of these words | | Character Sets | Not applicable | The | ||
| The sender is one of the recipients' | | ManagementRelationship | Not applicable | | ||
| The message is between members of these groups | | Addresses ( | Addresses ( | | ||
| The manager of the sender or recipient is | | EvaluatedUser ( | Addresses ( | | ||
| The sender's and any recipient's property compares as | | ADAttribute ( | Evaluation ( | | ||
| The message type is | | MessageType | Not applicable | | ||
| The message is classified as | | Classification | Not applicable | | ||
| The message isn't marked with any classifications | | Not applicable | Not applicable | | ||
| The message has an SCL greater than or equal to | | SclValue | Not applicable | | ||
| The message importance is set to | | Importance | Not applicable | | ||
| A message header includes | | MessageHeader ( | Words ( | | ||
| A message header matches | | MessageHeader ( | Patterns ( | |
The following table lists the property types used in Transport rule predicates.
Property types used in Transport rule predicates
| Property type | Valid values | Description |
|---|---|---|
| ADAttribute | One of the Active Directory attributes available for use | The
When you use the Shell to create a Transport rule that contains a predicate which uses an Active Directory attribute, you must specify an attribute name from the preceding list followed by a colon (:) and the word or text pattern you want to match in the specified attribute. The entire notation should be enclosed in quotation marks ("). For example, to specify the attribute You can also specify multiple Active Directory attributes and value pairs. For example, " |
| Addresses | Array of Active Directory mailbox, contact, or distribution group objects | The |
| Character Sets | Array of valid character set names | The
|
| Classification | Message classification object | The |
| Domain Name | Any valid SMTP domain name | The |
| EvaluatedUser | Single value of | The |
| Evaluation | Single value of | The |
| FromUserScope | Single value of | The
|
| Importance | Single value of | The |
| IPRanges | Array of IP ranges | The |
| List Type | Single value of | The |
| ManagementRelationship | Single value of | The |
| MessageHeader | Single string | The |
| MessageType | Single message type name | The
|
| Patterns | Array or regular expressions | The |
| SclValue | Single integer | The |
| SensitiveInformation | Sensitive Information Types | The |
| Size | Single integer with quantifier such as KB or MB | The
For example, |
| ToUserScope | One of the following values:
| The
|
| Words | Array of strings | The In Exchange 2013, only instances of the word without a prefix or suffix are matched. For example, if you specify the word "contoso", the rule will fire only if an exact match is found. The following variations where the word appears as a suffix, a prefix, or between other characters (other than the space character) aren't considered an exact match:
The property isn't case-sensitive. The asterisk (*) is treated as a literal character, and not used as a wildcard character. |
