'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Configure Exchange Rules and Conditional Access in Microsoft 365
Question details
The user needs to configure Microsoft 365 to restrict mail clients, filter messages by keywords, manage bulk sending recipient limits, and handle complex shared mailbox access scenarios.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- Administering email security, access policies, and routing thresholds for an organization using Exchange Online and Microsoft Entra.
- Observed behavior
- Administrators require granular controls to block desktop and mobile clients while allowing web access, and need rules to detect keywords for spam filtering without breaking shared mailbox access.
Ensure you have the required Microsoft Entra ID P1 or P2 licenses for Conditional Access features, and verify that your account has Exchange Administrator or Global Administrator privileges.
Restrict Mail Clients Using Microsoft Entra Conditional Access
Create a Conditional Access policy to block desktop and mobile Exchange clients while allowing browser-based Outlook on the web.
Microsoft Entra Conditional Access allows you to restrict Exchange Online access by client type. This approach is highly effective for enforcing security but requires careful testing so it does not inadvertently block shared mailbox access.
Log in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
Navigate to Protection > Conditional Access > Policies, and click on 'New policy' to define your restrictions.
Under 'Target resources', choose 'Cloud apps', click 'Select apps', and search for 'Office 365 Exchange Online'.
Go to 'Conditions' > 'Client apps' and select the client types you want to block (e.g., Mobile apps and desktop clients). Set your access controls to block these while omitting 'Browser' to allow web access.
Set the 'Enable policy' toggle to 'On' (or 'Report-only' for initial testing) and click 'Create'.
Filter Messages by Keywords Using Exchange Mail Flow Rules
Configure an Exchange mail flow rule to detect specified keywords in incoming messages and automatically set the spam confidence level (SCL).
Manage Recipient Limits to Control Bulk Sending
Restrict the number of recipients a user can email at once to prevent unauthorized bulk messaging.
Looking for a Reliable Office Suite? Try WPS Office
While Microsoft 365 handles complex enterprise email routing and Conditional Access, you might also need a powerful suite for daily document creation. WPS Office provides a free, lightweight, and robust alternative for your document, spreadsheet, and presentation needs, ensuring seamless format compatibility without the heavy subscription costs.
Frequently Asked Questions
Why does my Conditional Access policy block shared mailbox access?
Shared mailboxes do not have their own separate sign-in credentials. If a Conditional Access policy blocks the primary user's access based on specific conditions (like device compliance or client type), it also blocks their ability to open the shared mailbox. You must configure exclusions or test permissions separately.
Can I limit simultaneous bulk emails using an Exchange mail flow rule?
Exchange Online does not provide a simple mail flow rule to cap simultaneous bulk messages dynamically. To control bulk sending, you must configure strict recipient limits on individual mailboxes within the Exchange Admin Center.
What licensing is required to restrict mail clients in Microsoft 365?
Restricting mail clients using Microsoft Entra Conditional Access requires a Microsoft Entra ID P1 or P2 license. These licenses are typically included in premium subscriptions like Microsoft 365 Business Premium, E3, and E5.
