{
	"id": "cb4b3cc3-9639-4c49-94d3-84d3dd900431",
	"created_at": "2026-04-06T00:12:28.343659Z",
	"updated_at": "2026-04-10T13:11:24.071685Z",
	"deleted_at": null,
	"sha1_hash": "deb4b17f54c25d37981522111cc3d1791db38ab9",
	"title": "Manage mail flow rules in Exchange Online",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 109497,
	"plain_text": "Manage mail flow rules in Exchange Online\r\nBy AshaIyengar21\r\nArchived: 2026-04-05 16:36:59 UTC\r\nIn cloud-based organizations, you can use Exchange mail flow rules (also known as transport rules) to look for\r\nspecific conditions on messages that pass through your organization and take action on them.\r\nThis article shows you how to create, copy, adjust the order, enable or disable, delete, import or export rules, and\r\nmonitor rule usage.\r\nTip\r\nTo ensure that your rules work the way you expect, ensure that you thoroughly test each rule and interactions\r\nbetween rules.\r\nWhat do you need to know before you begin?\r\nEstimated time to complete each procedure: 5 minutes.\r\nFor information about how to access the Exchange admin center (EAC), see Exchange admin center in\r\nExchange Online. To connect to Exchange Online PowerShell, see Connect to Exchange Online\r\nPowerShell.\r\nYou need to be assigned permissions before you can perform these procedures. To see what permissions\r\nyou need, see the \"Mail flow\" entry in Feature permissions in Exchange Online.\r\nFor information about keyboard shortcuts that may apply to the procedures in this article, see Keyboard\r\nshortcuts for the Exchange admin center.\r\nTip\r\nHaving problems? Ask for help in the Exchange Online forum at Exchange Online.\r\nCreate a mail flow rule\r\nYou can create a mail flow rule in the EAC or in PowerShell. In the EAC, you can also create a mail flow rule by\r\ncopying an existing rule.\r\nNote\r\nAfter you create or copy a mail flow rule, it might take 30 minutes or more for the new rule to be applied to\r\nemails.\r\nUse the EAC to create a mail flow rule\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 1 of 10\n\nThe EAC allows you to create mail flow rules by selecting a template or starting from scratch.\r\n1. In the new EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to\r\nthe Rules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, create the rule by using one of the following options:\r\nThe new rule wizard opens.\r\n3. On the Set rule conditions page, enter a unique name for the rule in the Name box, and then select the\r\nconditions, exceptions, and actions for the rule:\r\nApply this rule if...: Select a condition from the list.\r\nDo the following...: Select an action from the list.\r\nExcept if...: Use this setting to specify any exceptions to the rule. The available exceptions are\r\nidentical to the available conditions.\r\nWhen you're finished on the Set rule conditions page, select Next.\r\n4. On the Set rule settings page, configure the following settings:\r\nRule mode: Select one of the following values:\r\nEnforce: Turn on the rule and start processing messages immediately. All actions on the rule\r\nare taken.\r\nTest with Policy Tips: Turn on the rule, and any Policy Tip actions ( Notify the sender with\r\na Policy Tip) are sent, but no actions related to message delivery are taken.\r\nTest without Policy Tips: Only the Generate incident report action is enforced. No actions\r\nrelated to message delivery are taken.\r\nSeverity: Select a severity level for this rule. Rule matches are grouped by severity level in activity\r\nreports. Severity level is just a filter to make the reports easier to use. The severity level has no\r\nimpact on the priority that the rule is processed in.\r\nNot specified\r\nLow\r\nMedium\r\nHigh\r\nNot audit: Rule matches don't appear in rule reports.\r\nActivate this rule on and Deactivate this rule on: Use these settings to turn the rule on and off for\r\na specific time period. If you create the rule before Activate this rule on date, the rule is enabled\r\nbut it isn't processed. After the Deactivate this rule on date, the rule remains enabled but it isn't\r\nprocessed.\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 2 of 10\n\nStop processing more rules: Use this setting to prevent additional rules from being applied to the\r\nmessage after this rule. If a message is processed by this rule, no subsequent rules are processed for\r\nthat message.\r\nDefer the message if rule processing doesn't complete: Specify how the message should be\r\nhandled if rule processing can't finish. By default, the rule is ignored and processing of the message\r\nby other rules continues. If you select this option, the message is resubmitted for processing.\r\nMatch sender address in message: Specify which email address is evaluated by conditions or\r\nexceptions that inspect the sender's email address:\r\nHeader: Only the message headers are examined.\r\nEnvelope: Only the SMTP message envelope is examined.\r\nHeader or envelope: Both the message headers and SMTP message envelope are examined.\r\nComments: Add an optional comment to the rule.\r\nWhen you're finished on the Set rule settings page, select Next.\r\n5. On the Review and finish page, verify the settings. Select Back or use the Edit rule conditions or Edit\r\nrule settings links to modify the settings.\r\nWhen you're finished on the Review and finish page, select Finish.\r\n6. On the confirmation page, select Done.\r\nUse Exchange Online PowerShell to create a mail flow rule\r\nThe following example creates a new mail flow rule that prepends the text External message to Sales DG: to\r\nthe Subject line of external messages that are sent to the Sales Department distribution group:\r\nNew-TransportRule -Name \"Mark messages from the Internet to Sales DG\" -FromScope NotInOrganization -SentTo \"Sal\r\nFor detailed syntax and parameter information, see New-TransportRule.\r\nNote\r\nThe parameters and action used in the previous example are for illustration only. Review all the available mail\r\nflow rule conditions and actions to determine which ones meet your requirements.\r\nUse the EAC to copy a mail flow rule\r\n1. In the new EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to\r\nthe Rules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, select the rule by selecting the radio button that appears next to the Status value, and\r\nthen select the Duplicate action that appears.\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 3 of 10\n\n3. In the Make a copy of \"\u003cRule Name\u003e\" flyout that opens, the values on the Conditions and Settings tabs\r\nare filled in with the settings of the copied rule. The default name is Copy of \u003cRule Name\u003e. You can\r\nchange any of the rule settings. The available settings are identical to creating a new rule as explained in\r\nthe Use the EAC to create a mail flow rule section.\r\n4. When you finished editing the settings of the rule, select Make copy at the bottom of the flyout.\r\n5. In the confirmation flyout that opens, select Duplicate.\r\n6. In the success flyout that opens, select Close X.\r\nHow do you know that you've successfully created a mail flow rule?\r\nTo verify that you've successfully created a mail flow rule, do either of the following steps:\r\nOn the Rules page in the EAC at https://admin.exchange.microsoft.com/#/transportrules, verify that the\r\nmail flow rule you created or copied is listed.\r\nIn Exchange Online PowerShell, replace \u003cNew Rule Name\u003e with the name of the rule that you created or\r\ncopied and run the following command:\r\nGet-TransportRule -Identity \"\u003cNew Rule Name\u003e\"\"\r\nView or modify a mail flow rule\r\nNote\r\nAfter you modify a mail flow rule, it might take 30 minutes or more for the updated rule to be applied to emails.\r\nUse the EAC to view or modify a mail flow rule\r\n1. In the new EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to\r\nthe Rules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, select a rule from the list by clicking anywhere in the row other than the round\r\ncheckbox next to the name.\r\n3. In the details flyout that opens you can see the existing settings and make changes by selecting Edit rule\r\nconditions and Edit rule settings at the top of the flyout. The available settings are identical to creating a\r\nnew rule as explained in the Use the EAC to create a mail flow rule section.\r\nUse Exchange Online PowerShell to view or modify a mail flow rule\r\nThe following example returns a summary list of all mail flow rules in the organization:\r\nGet-TransportRule\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 4 of 10\n\nTo view the detailed information about a specific mail flow rule, provide the unique identifier for the rule (for\r\nexample, Name, DistinguishedName, or GUID). It's helpful to send the output to the Format-List cmdlet to\r\nformat the properties.\r\nThe following example returns all the properties of the specified mail flow rule:\r\nGet-TransportRule -Identity \"Sender is a member of marketing\" | Format-List\r\nThe following example adds an exception to the existing rule named \"Sender is a member of marketing\" so that it\r\ndoesn't apply to messages sent by the user Kelly Rollin:\r\nSet-TransportRule -Identity \"Sender is a member of marketing\" -ExceptIfFrom \"Kelly Rollin\"\r\nFor detailed syntax and parameter information, see Set-TransportRule.\r\nHow do you know that you've successfully modified a mail flow rule?\r\nTo verify that you've successfully modified a mail flow rule, do either of the following steps:\r\nOn the Rules page in the EAC at https://admin.exchange.microsoft.com/#/transportrules, select the rule\r\nthat you modified by clicking anywhere in the row other than the radio button next to the Status value. In\r\nthe details flyout that opens, confirm the settings.\r\nIn Exchange Online PowerShell, replace \u003cRule Name\u003e with the name of the rule that you modified and run\r\nthe following command:\r\nGet-TransportRule -Identity \"\u003cRule Name\u003e\" | Format-List Name,ExceptIfFrom\r\nSet the priority of a mail flow rule\r\nOn the Rules page in the EAC, mail flow rules are shown in the order that they're processed. The rule at the top of\r\nthe list has the Priority value 0 and is processed first.\r\nUse the EAC to set the priority of a rule\r\n1. In the EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to the\r\nRules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, select a rule by selecting the radio button next to the Status value, and then select the\r\nMove up or Move down actions to move the rule up or down the list.\r\nUse Exchange Online PowerShell to set the priority of a rule\r\nThe following example sets the priority of the specified mail flow rule to 2:\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 5 of 10\n\nSet-TransportRule -Identity \"Sender is a member of Marketing\" -Priority \"2\"\r\nFor detailed syntax and parameter information, see Set-TransportRule.\r\nHow do you know that you've successfully set the priority of a mail flow rule\r\nTo verify that you've successfully set the priority of a mail flow rule, do either of the following steps:\r\nOn the Rules page in the EAC at https://admin.exchange.microsoft.com/#/transportrules, verify the order\r\nof the rules.\r\nIn Exchange Online PowerShell, run the following command:\r\nGet-TransportRule | Format-List Name,Priority\r\nEnable or disable a mail flow rule\r\nBy default, the status of mail flow rule is disabled when you create them using EAC. This is done so that you can\r\nreview the rule one more time before finally enabling it. You can enable the rule after the rule creation is\r\ncomplete.\r\nUse the EAC to enable or disable a mail flow rule\r\n1. In the EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to the\r\nRules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, select the rule by clicking anywhere in the row other than the radio button next to the\r\nname. The Status value of the rule is Enabled or Disabled.\r\n3. In the details flyout that opens, use the toggle in the Enable or disable rule section near the top of the\r\nflyout to enable or disable the rule.\r\nUse Exchange Online PowerShell to enable or disable a mail flow rule\r\nThe following example disables the specified mail flow rule:\r\nDisable-TransportRule -Identity \"Sender is a member of marketing\"\r\nThe following example enables the specified mail flow rule:\r\nEnable-TransportRule -Identity \"Sender is a member of marketing\"\r\nFor detailed syntax and parameter information, see Disable-TransportRule and Enable-TransportRule.\r\nHow do you know you've successfully enabled or disabled a mail flow rule?\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 6 of 10\n\nTo verify that you've successfully enabled or disabled a mail flow rule, do either of the following steps:\r\nOn the Rules page in the EAC at https://admin.exchange.microsoft.com/#/transportrules, verify the value\r\nin the Status column.\r\nIn Exchange Online PowerShell, run the following command to return a list of all rules in your\r\norganization along with their status values:\r\nGet-TransportRule | Format-Table Name,State\r\nRemove a mail flow rule\r\nUse the EAC to remove a mail flow rule\r\n1. In the EAC at https://admin.exchange.microsoft.com, go to Mail flow \u003e Rules. Or, to go directly to the\r\nRules page, use https://admin.exchange.microsoft.com/#/transportrules.\r\n2. On the Rules page, select the rule by selecting the radio button next to the Status value, and then select the\r\nDelete action that appears.\r\n3. In the confirmation flyout that opens, select Confirm.\r\nUse Exchange Online PowerShell to remove a mail flow rule\r\nThe following example removes the specified mail flow rule:\r\nRemove-TransportRule -Identity \"Sender is a member of marketing\"\r\nFor detailed syntax and parameter information, see Remove-TransportRule.\r\nHow do you know that you've successfully removed a mail flow rule?\r\nTo verify that you've successfully removed the mail flow rule, do either of the following steps:\r\nOn the Rules page of the EAC at https://admin.exchange.microsoft.com/#/transportrules, verify that the\r\nrule you removed is no longer listed.\r\nIn Exchange Online PowerShell, run the following command and verify that the rule you removed is no\r\nlonger listed:\r\nGet-TransportRule\r\nMonitor rule usage\r\nYou can check the number of times each rule is matched by using Exchange Transport Rule report in the EAC.\r\nFor a rule to be included in the report, a rule can't have the Severity value Not audit (all other values are OK).\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 7 of 10\n\nYou can view the report online, or download report data to a .csv file.\r\nNote\r\nWhile most data is in the report within 24 hours, some data may take as long as 5 days to appear.\r\n1. In the EAC at https://admin.exchange.microsoft.com, go to Reports \u003e Mail flow. Or, to go directly to the\r\nMail flow reports page, use https://admin.exchange.microsoft.com/#/reports/mailflowreportsmain.\r\n2. On the Mail flow reports page, find and select Exchange Transport Rule report.\r\nFor details about the report, see Exchange transport rule report in the new Exchange admin center in Exchange\r\nOnline.\r\nImport or export a mail flow rule collection in Exchange Online\r\nUse the Export-TransportRuleCollection cmdlet in Exchange Online PowerShell to export all of the mail flow\r\nrules in the organization to an XML file. For more information, see Export-TransportRuleCollection.\r\nThe Import-TransportRuleCollection cmdlet will be deprecated from Exchange Online PowerShell. To\r\nmanually import a mail flow rules collection XML file in Exchange Online PowerShell, do the following steps:\r\n1. Back up all existing mail flow rules using the Export-TransportRuleCollection cmdlet (the next step\r\nremoves all existing mail flow rules, just like the Import-TransportRuleCollection cmdlet did). For\r\nexample:\r\n$file = Export-TransportRuleCollection\r\n[System.IO.File]::WriteAllBytes('C:\\MailFlowRuleCollections\\BackupRuleCollection.xml', $file.FileData)\r\n2. Remove all existing mail flow rules in the organization by running the following command:\r\nGet-TransportRule | foreach {Remove-TransportRule $_.Guid -Confirm:$false}\r\n3. Copy the following text into Notepad:\r\nif ((Get-TransportRule).Count -ne 0)\r\n{\r\n Write-Host \"Please remove your current mail flow rules first.\"\r\n return\r\n}\r\n[xml]$xml = Get-Content \"C:\\MailFlowRuleCollections\\RuleCollectionToImport.xml\"\r\n$rulesToImport = $xml.SelectNodes(\"//rules/rule\")\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 8 of 10\n\nif ($rulesToImport.Count -eq 0)\r\n{\r\n Write-Host \"There are no mail flow rules to be imported.\"\r\n return\r\n}\r\nWrite-Host \"Importing $($rulesToImport.Count) mail flow rules.\"\r\n$index = 0\r\nforeach ($rule in $rulesToImport)\r\n{\r\n $index++\r\n Write-Host \"Importing rule '$($rule.Name)' $index/$($rulesToImport.Count).\"\r\n Invoke-Expression $($rule.version.commandBlock.InnerText) | Out-Null\r\n}\r\n4. Update the following line with the path and filename of the mail flow rule XML collection that you want to\r\nimport:\r\n[xml]$xml = Get-Content \"C:\\MailFlowRuleCollections\\RuleCollectionToImport.xml\"\r\n5. Save the file as .ps1 in a location that's easy for you to find (for example, C:\\Data\\Import-Rules.ps1 ).\r\n6. In PowerShell, use the following syntax to run the script:\r\n\u0026 \"\u003cPath to script file\u003e\\\u003cFileName\u003e.ps1\"\r\nFor example:\r\n\u0026 \"C:\\Data\\Import-Rules.ps1\"\r\nNeed more help?\r\nMail flow rules (transport rules) in Exchange Online\r\nMail flow rule conditions and exceptions (predicates) in Exchange Online\r\nMail flow rule actions in Exchange Online\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 9 of 10\n\nJournal, transport, and inbox rule limits\r\nSource: https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nhttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules\r\nPage 10 of 10",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules"
	],
	"report_names": [
		"manage-mail-flow-rules"
	],
	"threat_actors": [],
	"ts_created_at": 1775434348,
	"ts_updated_at": 1775826684,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/deb4b17f54c25d37981522111cc3d1791db38ab9.pdf",
		"text": "https://archive.orkl.eu/deb4b17f54c25d37981522111cc3d1791db38ab9.txt",
		"img": "https://archive.orkl.eu/deb4b17f54c25d37981522111cc3d1791db38ab9.jpg"
	}
}