Most email fraud against small and mid-sized businesses does not need malware. It needs one convincing message, one busy person in accounts payable, and one changed bank account number. Exchange Online mail flow rules are a simple, built-in way to put guardrails around those moments, and good Exchange Online mail flow rules security work takes an afternoon, not a project.
This article covers the rules I set up most often, the risky rules I remove most often, and how to test them so you do not break normal email.
What mail flow rules are (and are not)
Mail flow rules, also called transport rules, act on messages while they are in transit through Exchange Online, before they reach a mailbox. That is the key difference from Outlook inbox rules, which run after delivery and only for one user. A mail flow rule applies to the whole organization, or to whichever senders and recipients you choose.
Each rule has conditions (for example, the sender is outside the organization), optional exceptions, and actions (for example, prepend a warning to the message). You manage them in the Exchange admin center at admin.exchange.microsoft.com under Mail flow > Rules.
Mail flow rules are not a replacement for anti-phishing protection. Microsoft Defender for Office 365 (Plan 1 is included in Business Premium) does the heavy lifting with impersonation protection, Safe Links, and Safe Attachments. Mail flow rules are the extra layer that reflects how your business actually pays bills and shares data.
Five mail flow rules that quietly stop fraud
1. Warn on external messages that mention payments
Invoice and payment fraud depends on urgency. A visible warning slows people down at exactly the right moment.
Condition: the sender is located outside the organization, and the subject or body includes words such as “wire”, “bank details”, “remittance”, “updated account”, “ACH”, or “payment change”.
Action: apply a disclaimer that prepends a short, plain warning: “This message is from outside the company and mentions payment details. Verify any change by phone using a number you already have on file.”
Keep the wording short. Long banners get ignored.
2. Flag external senders using your executives’ names
A classic trick is an email from a free webmail account with the display name set to your managing partner or CEO.
Condition: the sender is outside the organization, and the message header From contains the names of your leadership team.
Action: prepend a warning such as “This message uses the name of a company leader but came from an outside address.”
Defender for Office 365 user impersonation protection does this more intelligently, so if you have applied the Standard or Strict preset policy with your executives listed as protected users, this rule is a backup rather than the main control.
3. Block auto-forwarded mail to external recipients
When an attacker compromises a mailbox, an inbox rule that forwards everything to an outside address is one of the most common next steps. The cleanest control is the outbound anti-spam policy in the Defender portal, with automatic forwarding set to Off – Forwarding is disabled. A mail flow rule can then handle the documented exceptions, for example allowing one shared mailbox to forward to an outsourced bookkeeper. When one control allows forwarding and another blocks it, the block usually wins, so design your exceptions carefully.
4. Tag external email clearly
Exchange Online has a native external sender tag for Outlook, turned on with the Set-ExternalInOutlook cmdlet in Exchange Online PowerShell. It shows an “External” label in supported Outlook clients without altering the message body. I prefer it to old-style subject prefixes like “[EXTERNAL]”, which break reply threads and annoy staff.
5. Stop sensitive data leaving to personal addresses
If your Purview data loss prevention policies are not ready yet, a simple interim rule helps:
Condition: the recipient domain is a common free webmail provider, and the message has an attachment.
Action: notify the sender with a policy tip, or require a business justification, or send a copy to a compliance mailbox.
This catches the well-meaning employee who emails client files home to work over the weekend. Move this logic into a proper DLP policy when you can.
Risky rules to look for and remove
When I review a tenant, the dangerous rules are usually old ones nobody remembers creating.
Rule pattern
Why it is risky
What to do
Sets spam confidence level (SCL) to -1 for a sender domain
Bypasses spam and phishing filtering for anything claiming to be from that domain
Remove, or limit to authenticated senders only
Bypasses filtering for an IP range “for the copier”
Often too broad, and the range may no longer belong to you
Replace with a connector scoped to that device
Redirects or blind copies mail to an external address
May be a leftover from a migration, or a sign of compromise
Confirm the business owner or delete
Rules with no description or owner
Nobody knows whether they are still needed
Document or disable
A rule that bypasses filtering is the mail equivalent of propping open a fire door. It was convenient once. It is now a risk.
How to create and test a rule safely
In the Exchange admin center, go to Mail flow > Rules and select Add a rule.
Give it a clear name, for example “SEC – External payment warning”, so security rules are easy to find later.
Set the conditions, exceptions, and actions.
Under rule settings, set the mode to Test without policy tips first. The rule is evaluated and logged but does not change mail.
Set a severity (Low, Medium, or High) so matches appear in mail flow reports.
After a few days, review the matches in the Exchange transport rule report in the Defender portal. Adjust words that cause false positives.
Switch the mode to Enforce. New or changed rules can take a while to apply across the service, so test with a real message afterward.
Write the rule’s purpose and owner in its description.
Rule order matters. Rules run by priority, and a rule with “Stop processing more rules” will prevent later rules from acting. Keep security rules near the top.
Keeping rules under control
Mail flow rules are powerful, which means they deserve a light change process. Review them every quarter. Export the list with Get-TransportRule in Exchange Online PowerShell and keep a copy. Any new rule that bypasses filtering or sends mail outside the company should need a second person to approve it.
No. Mail flow rules run in Exchange Online while a message is in transit and can apply to the whole organization. Inbox rules run in a single user’s mailbox after delivery. Attackers often abuse inbox rules, while admins use mail flow rules for policy.
Do mail flow rules need a special license?
Mail flow rules are part of Exchange Online and available in all business plans that include Exchange Online. Advanced protections such as impersonation detection and Safe Links need Defender for Office 365.
How many mail flow rules should a small business have?
Fewer than you think. Five to ten well-documented rules is typical for a 20 to 500 person firm. If you have dozens, many are probably leftovers that should be reviewed.
Not sure what your existing rules are doing? Get a free Microsoft 365 security assessment and we will review your mail flow rules, forwarding settings, and email protection.
Most email fraud against small and mid-sized businesses does not need malware. It needs one convincing message, one busy person in accounts payable, and one changed bank account number. Exchange Online mail flow rules are a simple, built-in way to put guardrails around those moments, and good Exchange Online mail flow rules security work takes an afternoon, not a project.
This article covers the rules I set up most often, the risky rules I remove most often, and how to test them so you do not break normal email.
What mail flow rules are (and are not)
Mail flow rules, also called transport rules, act on messages while they are in transit through Exchange Online, before they reach a mailbox. That is the key difference from Outlook inbox rules, which run after delivery and only for one user. A mail flow rule applies to the whole organization, or to whichever senders and recipients you choose.
Each rule has conditions (for example, the sender is outside the organization), optional exceptions, and actions (for example, prepend a warning to the message). You manage them in the Exchange admin center at
admin.exchange.microsoft.comunderMail flow > Rules.Mail flow rules are not a replacement for anti-phishing protection. Microsoft Defender for Office 365 (Plan 1 is included in Business Premium) does the heavy lifting with impersonation protection, Safe Links, and Safe Attachments. Mail flow rules are the extra layer that reflects how your business actually pays bills and shares data.
Five mail flow rules that quietly stop fraud
1. Warn on external messages that mention payments
Invoice and payment fraud depends on urgency. A visible warning slows people down at exactly the right moment.
Keep the wording short. Long banners get ignored.
2. Flag external senders using your executives’ names
A classic trick is an email from a free webmail account with the display name set to your managing partner or CEO.
Fromcontains the names of your leadership team.Defender for Office 365 user impersonation protection does this more intelligently, so if you have applied the Standard or Strict preset policy with your executives listed as protected users, this rule is a backup rather than the main control.
3. Block auto-forwarded mail to external recipients
When an attacker compromises a mailbox, an inbox rule that forwards everything to an outside address is one of the most common next steps. The cleanest control is the outbound anti-spam policy in the Defender portal, with automatic forwarding set to Off – Forwarding is disabled. A mail flow rule can then handle the documented exceptions, for example allowing one shared mailbox to forward to an outsourced bookkeeper. When one control allows forwarding and another blocks it, the block usually wins, so design your exceptions carefully.
4. Tag external email clearly
Exchange Online has a native external sender tag for Outlook, turned on with the
Set-ExternalInOutlookcmdlet in Exchange Online PowerShell. It shows an “External” label in supported Outlook clients without altering the message body. I prefer it to old-style subject prefixes like “[EXTERNAL]”, which break reply threads and annoy staff.5. Stop sensitive data leaving to personal addresses
If your Purview data loss prevention policies are not ready yet, a simple interim rule helps:
This catches the well-meaning employee who emails client files home to work over the weekend. Move this logic into a proper DLP policy when you can.
Risky rules to look for and remove
When I review a tenant, the dangerous rules are usually old ones nobody remembers creating.
A rule that bypasses filtering is the mail equivalent of propping open a fire door. It was convenient once. It is now a risk.
How to create and test a rule safely
Mail flow > Rulesand select Add a rule.Rule order matters. Rules run by priority, and a rule with “Stop processing more rules” will prevent later rules from acting. Keep security rules near the top.
Keeping rules under control
Mail flow rules are powerful, which means they deserve a light change process. Review them every quarter. Export the list with
Get-TransportRulein Exchange Online PowerShell and keep a copy. Any new rule that bypasses filtering or sends mail outside the company should need a second person to approve it.For a full review of your mail protection, see our Defender for Office 365 service, or start with a Microsoft 365 security assessment. If you are ready to replace interim rules with real data protection, our DLP policy configuration service builds Purview policies that do the job properly. Microsoft documents the full set of conditions and actions in mail flow rules in Exchange Online.
Frequently asked questions
Are mail flow rules the same as inbox rules?
No. Mail flow rules run in Exchange Online while a message is in transit and can apply to the whole organization. Inbox rules run in a single user’s mailbox after delivery. Attackers often abuse inbox rules, while admins use mail flow rules for policy.
Do mail flow rules need a special license?
Mail flow rules are part of Exchange Online and available in all business plans that include Exchange Online. Advanced protections such as impersonation detection and Safe Links need Defender for Office 365.
How many mail flow rules should a small business have?
Fewer than you think. Five to ten well-documented rules is typical for a 20 to 500 person firm. If you have dozens, many are probably leftovers that should be reviewed.
Not sure what your existing rules are doing? Get a free Microsoft 365 security assessment and we will review your mail flow rules, forwarding settings, and email protection.