Create a new spam filter
You can edit the default spam filter, but I recommend creating a new one for testing purposes that applies to only you or a select group of beta users.
In your Exchange Admin Center, under Protection, click Spam Filter. Click the plus sign (+) to create a new filter. Name it whatever you like. Set both “Spam” and “High confidence spam” to “Quarantine message.” You’ll ultimately get a red message that advises you to configure end-user spam notifications.
You’ll need to first fill out the rest of the form to your liking, and the “Applied To” section near the bottom is mandatory. You can apply this new spam filter to specific recipients by name, domain, or group membership. You can also add exceptions and additional criteria to your heart’s content before you click Save.
2. Configure end-user spam notification
Turning on notifications is really easy, so Microsoft put the control in a really stupid place to make sure you don’t get bored. You might notice, once you save your new filter, that the pane on the right mentions “End-user spam notifications: Disabled” for that filter. Can you double-click on your new filter and enable them? Of course not.
What you need to do is highlight the Default filter and click “Configure end-user spam notifications…” on the right.
In here, just tick the only box available and fill in a number for however many days you want between notifications. Choose your language and hit Save. Yes, this applies to your custom filters. No, I don’t know why the control is in the Default filter. Yes, your custom filters will still say “End-user spam notifications: Disabled.” Why? Just because.
3. Read the notification emails
After a day has gone by, your test users will receive their first notification email fromquarantine@messaging.microsoft.com. It’s helpfully subjected “Spam Notification” with the number of messages quarantined.
Each message contains the following elements of each message:
· Sender’s alleged email address
· Email subject line
· Date and time in UTC (Coordinated Universal Time)
· Size in bytes
· “Release to Inbox” link
· “Report as Not Junk” link
The email address is “alleged” because most spammers aren’t using genuine email accounts. It’s trivially easy to forge the Sender field, so it should never be taken as gospel.
The subject line, if my current notifications are at all representative, will likely be something about Gwen Stefani and/or Blake Shelton.
The date and time are shown in UTC, the standard for electronic communications. It’s generally equivalent to Greenwich Mean Time (GMT), so unless your users are in western Africa, Portugal, the British Isles, or Iceland, they’ll need to do some conversion.
The size is just a clue to the message’s legitimacy. A phishing email can be a single sentence with a spoofed email address of a trusted contact, under 10KB, or it could be that person just saying hi. A message over 100KB could be a perfectly safe HTML message with lots of formatting, or it could be an advertisement.
If you suspect a quarantined message is actually wanted, click the “Release to Inbox” link. That will open a webpage that says, “Spam message was released from quarantine.” It’ll show up in your inbox soon, but will not influence future spam detections. (Occasionally this webpage throws a certificate error or is not found or something. In my experience, the message is usually released anyway.)
The “Report as Not Junk” link tells Microsoft that, well, this message is not junk. It will become one tiny data point in their massive spam-detecting engine but will not automatically be delivered. “Report as Not Junk” and “Release to Inbox” are completely separate.
4. Inform your users
After you set up your notification frequency, spam-detection level, or other criteria, make sure to communicate with your users about these spam-notification emails. You might still need to add senders to allow and block lists on an administrative level, but users will get a summary of quarantined messages right in their inbox. They can even move the actual messages to their inbox.
This solution isn’t right for everyone — that’s why I suggest creating a new spam filter for testing. Since it can be customized by group or individual email address, you can expand and edit it for just the users who want it.
