Creating Mail Flow (Transport) Rules in Exchange Online –

Mail flow rules (also called transport rules) inspect messages as they pass through Exchange Online and act on them when conditions match. Every rule has four parts:

Typical uses: adding disclaimers, tagging external mail, blocking risky attachments, routing mail for approval, journaling copies, and bypassing or forcing spam filtering.

Applies to: Exchange Online (Microsoft 365), managed through the Exchange admin center (EAC) or Exchange Online PowerShell.

Prerequisites

You need the Transport Rules role in Exchange Online, or the Exchange Administrator role in Microsoft Entra ID.

• Exchange Online role: Transport Rules, included by default in the Organization Management, Compliance Management, and Records Management role groups.
• Entra ID role: Exchange Administrator (preferred) or Global Administrator. Use the least-privileged role that works.
• Access: The new EAC at https://admin.exchange.microsoft.com, or Exchange Online PowerShell (Install-Module ExchangeOnlineManagement, then Connect-ExchangeOnline).
• Limits: A tenant can hold up to 300 mail flow rules. Check the current Exchange Online limits page before planning large rule sets.
• DLP note: Data loss prevention conditions are now managed in Microsoft Purview DLP policies, not in mail flow rules.

Create a rule in the Exchange admin center

The EAC wizard is the fastest way to build a single rule. Go to Mail flow > Rules, or open https://admin.exchange.microsoft.com/#/transportrules directly.

1. Select + Add a rule, then pick a template (for example Apply disclaimers or Restrict managing access) or Create a new rule for a blank rule.
2. Set rule conditions
   • Name: Use a clear, searchable name, such as ORG - External sender warning.
   • Apply this rule if: Choose a condition category, then the specific condition (for example The sender > is external/internal > Outside the organization).
   • Add more conditions with +. All conditions must match (AND logic).
   • Do the following: Choose one or more actions.
   • Except if: Add exceptions to exclude specific senders, domains, or messages.
   • Select Next.
3. Set rule settings
   • Rule mode: Choose Enforce, or Test without Policy Tips to log matches without acting.
   • Severity: Sets the level shown in reports (Low, Medium, High).
   • Activate / Deactivate this rule on: Optional start and end dates.
   • Stop processing more rules: Prevents lower-priority rules from running on matching messages.
   • Defer the message if rule processing doesn’t complete: Keeps mail from bypassing the rule if evaluation fails.
   • Match sender address in message: Header, Envelope, or Header or envelope.
   • Comments: Record the owner, ticket number, and purpose.
   • Select Next.
4. On Review and finish, check the summary and select Finish, then Done.
5. New rules are created disabled. Select the rule and turn on Enable or disable rule.

The rule now appears in the list. Use Move up / Move down to set its priority (0 runs first).

Create a rule with Exchange Online PowerShell

PowerShell is best for repeatable, scripted, or bulk rule changes. Connect first:

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Create a rule with New-TransportRule. Conditions, exceptions (ExceptIf...), and actions are parameters:

New-TransportRule -Name "ORG - External sender warning" `
  -FromScope NotInOrganization `
  -SentToScope InOrganization `
  -PrependSubject "[EXTERNAL] " `
  -Mode Enforce `
  -Priority 0 `
  -Comments "Owner: IT Messaging. Ticket CHG-1234."

Verify it:

Get-TransportRule -Identity "ORG - External sender warning" | Format-List Name,State,Mode,Priority,Description

Useful cmdlets: Get-TransportRule, Set-TransportRule, Enable-TransportRule, Disable-TransportRule, Remove-TransportRule, Get-TransportRulePredicate, and Get-TransportRuleAction (lists available conditions and actions).

Common rule examples

These five rules cover most requests. Replace names, domains, and addresses with your own, and test before enforcing.

1. External sender warning banner

New-TransportRule -Name "ORG - External banner" `
  -FromScope NotInOrganization -SentToScope InOrganization `
  -ApplyHtmlDisclaimerLocation Prepend `
  -ApplyHtmlDisclaimerText "<p style='background:#FFEB9C;padding:6px'>CAUTION: This email came from outside the organization.</p>" `
  -ApplyHtmlDisclaimerFallbackAction Wrap

Microsoft also offers a built-in external tag in Outlook (Set-ExternalInOutlook -Enabled $true), which avoids altering the message body.

2. Outbound disclaimer

New-TransportRule -Name "ORG - Outbound disclaimer" `
  -FromScope InOrganization -SentToScope NotInOrganization `
  -ApplyHtmlDisclaimerLocation Append `
  -ApplyHtmlDisclaimerText "<p>This message is confidential...</p>" `
  -ApplyHtmlDisclaimerFallbackAction Wrap

3. Block risky attachment types (inbound)

New-TransportRule -Name "ORG - Block risky attachments" `
  -FromScope NotInOrganization `
  -AttachmentExtensionMatchesWords "exe","js","vbs","iso","scr" `
  -RejectMessageReasonText "This attachment type is blocked by policy." `
  -RejectMessageEnhancedStatusCode "5.7.1"

The anti-malware policy’s common attachments filter is often a better first choice for this.

4. Send a copy (Bcc) of a user’s mail to another mailbox

New-TransportRule -Name "ORG - Bcc CFO mail to archive" `
  -From "cfo@contoso.com" `
  -BlindCopyTo "finance-archive@contoso.com"

5. Bypass spam filtering for a trusted partner (use sparingly)

New-TransportRule -Name "ORG - Trust partner domain" `
  -SenderDomainIs "partner.com" `
  -HeaderContainsMessageHeader "Authentication-Results" `
  -HeaderContainsWords "dmarc=pass" `
  -SetSCL -1

Never bypass filtering on sender domain alone; senders are easily spoofed. Pair it with an authentication check as above, or with the partner’s IP range (-SenderIpRanges).

Testing, priority, and modes

Run every new rule in test mode first, confirm matches in message trace, then switch to Enforce.

1. Create or set the rule in test mode: Set-TransportRule "<name>" -Mode Audit.
2. Send test messages that should and should not match.
3. In the EAC, go to Mail flow > Message trace, open a test message, and look for a transport rule event.
4. Switch to enforcement: Set-TransportRule "<name>" -Mode Enforce.

Priority: Rules run in order from 0 (highest). A message can match several rules unless one has Stop processing more rules set. Put the most restrictive rules at the top.

Propagation: Changes can take up to 30 minutes to apply across the service. Wait before concluding a rule doesn’t work.

Managing rules

Edit, disable, back up, and remove rules from Mail flow > Rules or PowerShell.

Back up all rules before major changes:

$file = Export-TransportRuleCollection
[System.IO.File]::WriteAllBytes("C:\Backup\Rules.xml", $file.FileData)

Restore from backup (this replaces all existing rules):

Import-TransportRuleCollection -FileData ([System.IO.File]::ReadAllBytes("C:\Backup\Rules.xml"))

Troubleshooting and best practices

Most rule problems come from scope, priority, or propagation delay. Check these in order.

Best practices:

• Scope tightly. State the direction (inbound, outbound, internal) in every rule.
• Name consistently. A prefix plus purpose, such as ORG - Outbound disclaimer, makes rules easy to find and audit.
• Document in Comments. Record owner, ticket, and date in each rule.
• Test before enforcing. Use Audit mode and message trace.
• Avoid broad allow rules. Setting SCL to -1 on sender domain alone opens a spoofing path.
• Prefer purpose-built features. Use anti-spam, anti-malware, and Defender policies, or Purview DLP, where they fit; keep mail flow rules for what those can’t do.
• Export a backup before bulk changes.