End User Features for Exchange Online Protection (EOP)

When an email message goes through EOP it is assigned a spam score, which is determined by a set of rules. EOP spam scoring is set from 0-9. Emails with a spam score 0-4 are considered as not spam. Emails with a spam score 5-6 are considered likely spam. Emails with a spam score 7-9 are considered highly likely spam/phishing.

Score 0-4:

Mail given a score of 0-4 will end up in a user’s inbox (or elsewhere if the user has a rule set up in OWA/Outlook).

Score 5-6:

This means that EOP considers this as Spam, and will add a {SPAM!} tag in the subject line. It will also deliver these emails to your Junk email folder. If these tagged emails are received in your Inbox, follow the steps below to ensure that they are moved to your Junk email folder:

In OWA: Click on the gear icon (top right corner), Mail, under the Accounts drop-down select block or allow, and click to “Automatically filter junk email”

Outlook Screenshot

In Outlook: Click Home, Click the Junk dropdown, and choose Junk E-mail Options. Increase desired junk email protection

Outlook Screenshot

Score 7-9:

Mail given a score of 7-9 will be put into a “Quarantine” which the users will receive as a “Quarantine Digest” everyday. These emails will always come from quarantine@messaging.microsoft.com. Emails will retained for 30 days only. Take extra care in reviewing these emails in the digest before releasing them as EOP highly suspects that these are malicious or dangerous. In this Digest, users can choose to 1) release the email to the user’s inbox or 2) release the email and report it as a false positive. Note that emails in Quarantine never go to the user’s inbox, unless the user chooses to release it to their inbox. An example of the Digest is below:

Outlook Screenshot

If you wish to not receive these Digest emails, you may right-click on the email, select Junk, and choose to Block Sender. This will send the emails to your junk folder, instead of your inbox. 

Last Modified: 5/11/2018