Set outbound sending limits and notify administrators of blocked senders

Description

Every outbound spam filter policy that applies to users has:

• an external message limit of {{ external_limit_per_hour }} recipients per hour (RecipientLimitExternalPerHour);
• an internal message limit of {{ internal_limit_per_hour }} recipients per hour (RecipientLimitInternalPerHour);
• a daily limit of {{ daily_limit }} recipients (RecipientLimitPerDay);
• Restrict the user from sending mail when a limit is reached (ActionWhenThresholdReached BlockUser), so an administrator must unblock the account;
• notifications on: Notify these users and groups if a sender is blocked due to sending outbound spam (NotifyOutboundSpam) and Send a copy of suspicious outbound messages (BccSuspiciousOutboundMail), both to {{ outbound_alert_recipients }}.

Rationale

Sending a burst of messages is a typical sign of a compromised account used for spam or internal phishing. Explicit limits stop it earlier than the service defaults, BlockUser makes sure the account is reviewed before it can send again, and notifications bring the event to the security team even if alert policies are not watched.

Impact

Users who legitimately send to many recipients (newsletters, HR announcements) can hit the limits; use a dedicated policy with higher limits for those mailboxes, or a bulk mail service. Blocked users must be released from Restricted entities by an administrator.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Anti-spam and open Anti-spam outbound policy (Default) and every custom outbound policy. Check Message limits, Restriction placed on users who reach the message limit and Notifications.
3. In Exchange Online PowerShell (read-only):

   Get-HostedOutboundSpamFilterPolicy | Format-List Name, RecipientLimitExternalPerHour, RecipientLimitInternalPerHour,
     RecipientLimitPerDay, ActionWhenThresholdReached, NotifyOutboundSpam, NotifyOutboundSpamRecipients,
     BccSuspiciousOutboundMail, BccSuspiciousOutboundAdditionalRecipients
   

4. Fail if a limit is 0 (service default) or higher than the parameter, if the action is not BlockUser, or if the notifications are off or have no recipient. Higher limits are acceptable only in a custom policy scoped to named mass senders.

Remediation

1. In the Defender portal, open the outbound policy > Edit protection settings (Security Administrator), set the three limits and Restrict the user from sending mail, select both notification options with the recipients, and save.
2. PowerShell equivalent:

   Set-HostedOutboundSpamFilterPolicy -Identity Default -RecipientLimitExternalPerHour 500 -RecipientLimitInternalPerHour 1000 `
     -RecipientLimitPerDay 1000 -ActionWhenThresholdReached BlockUser `
     -NotifyOutboundSpam $true -NotifyOutboundSpamRecipients [email protected] `
     -BccSuspiciousOutboundMail $true -BccSuspiciousOutboundAdditionalRecipients [email protected]
   

Rollback

Set the limits back to 0 and ActionWhenThresholdReached to BlockUserForToday.

References

• Configure outbound spam policies in EOP Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-103) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-001 Block automatic forwarding of mail to external recipients
• related CB-M365-AUDIT-008 Turn on key Microsoft 365 alert policies and route them to a monitored destination

People and lifecycle