Custom Rule to qurantine emails in M365 based on total Number of Recipients
Lately we have been getting thousands of emails from Gmail which have pdfs and links. Last week we were hit with around 1.5 million emails which the ATP could not stop( we have A5 license). We created rules which says if attachment has specific name example Oddname.pdf then delete the email.
We are not in position to block gmail domain or block all emails which has pdf attachments.
Can we have a custom rule which based on number of recipients. Example —>if email has more then 100 recipients and gmail.com domain then quarantine the email or delete them.
Lately we have been getting thousands of emails from Gmail which have pdfs and links. Last week we were hit with around 1.5 million emails which the ATP could not stop( we have A5 license). We created rules which says if attachment has specific name example Oddname.pdf then delete the email. We are not in position to block gmail domain or block all emails which has pdf attachments. Can we have a custom rule which based on number of recipients. Example —>if email has more then 100 recipients and gmail.com domain then quarantine the email or delete them. Read More