Commands › Exchange Online

New-ATPBuiltInProtectionRule

Exchange Online ExchangeOnlineManagement New-*

**Note**: Don't use this cmdlet. This cmdlet is used by the system to create the one and only rule for the Built-in protection preset security policy during the creation of the organization. You can't use this cmdlet if a rule for the Built-in protection preset security policy already exists. The Remove-ATPBuiltInProtectionRule cmdlet is not available to remove rules. Use the New-ATPBuiltInProtectionRule cmdlet to create the rule for the Built-in protection preset security policy that effectively provides default policies for Safe Links and Safe Attachments in Microsoft Defender for Office 365

Quick start script

# New-ATPBuiltInProtectionRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ATPBuiltInProtectionRule
$before | Format-List

# 3. Make the change (dry run first)
New-ATPBuiltInProtectionRule -SafeAttachmentPolicy <SafeAttachmentPolicyIdParameter> -SafeLinksPolicy <SafeLinksPolicyIdParameter> -WhatIf
New-ATPBuiltInProtectionRule -SafeAttachmentPolicy <SafeAttachmentPolicyIdParameter> -SafeLinksPolicy <SafeLinksPolicyIdParameter>

# 4. Verify and diff
$after = Get-ATPBuiltInProtectionRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-ATPBuiltInProtectionRule -SafeAttachmentPolicy <SafeAttachmentPolicyIdParameter> -SafeLinksPolicy <SafeLinksPolicyIdParameter>
 [-Comments <String>]
 [-Confirm]
 [-ExceptIfRecipientDomainIs <Word[]>]
 [-ExceptIfSentTo <RecipientIdParameter[]>]
 [-ExceptIfSentToMemberOf <RecipientIdParameter[]>]
 [-Name <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (9)

Parameter	Type	Required	What it controls
-SafeAttachmentPolicy	SafeAttachmentPolicyIdParameter	yes	The SafeAttachmentPolicy parameter specifies the Safe Attachments policy that's associated with the Built-in preset security policy. Use the following command to identify the policy: `Get-SafeAttachmentPolicy \|...
-SafeLinksPolicy	SafeLinksPolicyIdParameter	yes	The SafeLinksPolicy parameter specifies the Safe Links policy that's associated with the Built-in preset security policy. Use the following command to identify the policy: `Get-SafeLinksPolicy \| Where-Object...
-Comments	String		The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-ExceptIfRecipientDomainIs	Word[]		The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.
-ExceptIfSentTo	RecipientIdParameter[]		The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient. For example:
-ExceptIfSentToMemberOf	RecipientIdParameter[]		The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of groups. You can use any value that uniquely identifies the group. For example:
-Name	String		The Name parameter specifies a unique name for the rule. The maximum length is 64 characters.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.