Configure End-User Spam Notifications in EOP


Applies to: Exchange Online Protection

Topic Last Modified: 2014-07-14

This topic is for Exchange Online Protection (EOP) standalone customers who are protecting on-premises mailboxes. Exchange Online customers who are protecting cloud-hosted mailboxes should read the following topic instead: Configure End-User Spam Notifications in Exchange Online.

You can configure end-user spam notifications for the default company-wide content filter policy or for custom content filter policies that are applied to domains. Enabling end-user spam notification messages lets your end users self-manage their own spam-quarantined messages. End-user spam notifications cannot be used with policies applied to users or groups, or to a policy with exceptions.

End-user spam notifications contain a list of all spam-quarantined messages that the end user has received during a time period that you configure (you can specify a value between 1 and 15 days). You can also configure the language in which the notification message is written.

After receiving a notification message, end users can click to move the spam email to their inbox, or report the spam email as Not Junk, in which case it will be sent to the Microsoft Spam Analysis Team. For more information about how to manage spam-quarantined items after receiving a notification message, see Use end-user spam notifications to release and report spam-quarantined messages.

Estimated time to complete: 5 minutes

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the “Anti-spam” entry in the Feature permissions in EOP topic.

For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

  1. In the Exchange admin center (EAC), navigate to Protection > Content filter.

  2. Select the content filter policy for which you want to enable end-user spam notifications (they are disabled by default).

  3. In the right pane, where the summary information about your policy appears, click the Configure End-user spam notifications link.

  4. In the subsequent dialog box, you can configure the following options:

    1. Enable end-user spam notifications   Select this check box in order to enable end-user spam notifications for this policy. (Conversely, if this policy is enabled, you can clear this check box in order to disable end-user spam notifications for this policy.)

    2. Send end-user spam notifications every (days)   Specify how often to send end-user spam notifications. The default is 3 days. You can specify between 1 and 15 days. If you specify 7 days, for example, the notification will include a list of all messages intended for that user within the past 7 days that were sent to the spam quarantine instead.

    3. Notification language   Using the drop-down list, select the language in which to write end-user spam notifications for this policy.

  5. Click save. A summary of your content filter policy settings, including your end-user spam notification settings, appears in the right pane.

  • End-user spam notifications will only be functional for content filter policies that are enabled.

  • End-user spam notifications are only sent once per day. The delivery time of the notification cannot be guaranteed for any specific customer and is not configurable.

Tip: If you want to test end-user spam notifications by sending them to a limited set of users before fully implementing them, create a custom content filter policy that enables end-user spam notifications for the domains in which the users reside. Then, in the EAC, under Mail flow > rules, create a transport rule to block messages from (the email address that sends notifications) with exceptions for the users who you want to receive the notifications. The following image is an example of creating an exception for two users (SaraD and AlexD) from domain

Transport rule to test end-user spam notifications