Commands › Exchange Online

New-AntiPhishPolicy

Exchange Online ExchangeOnlineManagement New-*

Create antiphish policies in your cloud-based organization.

Quick start script

# New-AntiPhishPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-AntiPhishPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-AntiPhishPolicy -Name <String> -WhatIf
New-AntiPhishPolicy -Name <String>

# 4. Verify and diff
$after = Get-AntiPhishPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-AntiPhishPolicy [-Name] <String>
 [-AdminDisplayName <String>]
 [-AuthenticationFailAction <SpoofAuthenticationFailAction>]
 [-Confirm]
 [-DmarcQuarantineAction <SpoofDmarcQuarantineAction>]
 [-DmarcRejectAction <SpoofDmarcRejectAction>]
 [-Enabled <Boolean>]
 [-EnableFirstContactSafetyTips <Boolean>]
 [-EnableMailboxIntelligence <Boolean>]
 [-EnableMailboxIntelligenceProtection <Boolean>]
 [-EnableOrganizationDomainsProtection <Boolean>]
 [-EnableSimilarDomainsSafetyTips <Boolean>]
 [-EnableSimilarUsersSafetyTips <Boolean>]
 [-EnableSpoofIntelligence <Boolean>]
 [-EnableTargetedDomainsProtection <Boolean>]
 [-EnableTargetedUserProtection <Boolean>]
 [-EnableUnauthenticatedSender <Boolean>]
 [-EnableUnusualCharactersSafetyTips <Boolean>]
 [-EnableViaTag <Boolean>]
 [-ExcludedDomains <MultiValuedProperty>]
 [-ExcludedSenders <MultiValuedProperty>]
 [-HonorDmarcPolicy <Boolean>]
 [-ImpersonationProtectionState <ImpersonationProtectionState>]
 [-MailboxIntelligenceProtectionAction <ImpersonationAction>]
 [-MailboxIntelligenceProtectionActionRecipients <MultiValuedProperty>]
 [-MailboxIntelligenceQuarantineTag <String>]
 [-MakeDefault]
 [-PhishThresholdLevel <Int32>]
 [-PolicyTag <String>]
 [-RecommendedPolicyType <RecommendedPolicyType>]
 [-SimilarUsersSafetyTipsCustomText <String>]
 [-SpoofQuarantineTag <String>]
 [-TargetedDomainActionRecipients <MultiValuedProperty>]
 [-TargetedDomainProtectionAction <ImpersonationAction>]
 [-TargetedDomainQuarantineTag <String>]
 [-TargetedDomainsToProtect <MultiValuedProperty>]
 [-TargetedUserActionRecipients <MultiValuedProperty>]
 [-TargetedUserProtectionAction <ImpersonationAction>]
 [-TargetedUserQuarantineTag <String>]
 [-TargetedUsersToProtect <MultiValuedProperty>]
 [-UnusualCharactersSafetyTipsCustomText <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (42)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies a unique name for the antiphish policy. If the value contains spaces, enclose the value in quotation marks (").
-AdminDisplayName	String		The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
-AuthenticationFailAction	SpoofAuthenticationFailAction		This setting is part of spoof protection.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DmarcQuarantineAction	SpoofDmarcQuarantineAction		This setting is part of spoof protection.
-DmarcRejectAction	SpoofDmarcRejectAction		This setting is part of spoof protection.
-Enabled	Boolean		This parameter is reserved for internal Microsoft use.
-EnableFirstContactSafetyTips	Boolean		The EnableFirstContactSafetyTips parameter specifies whether to enable or disable the safety tip that's shown when recipients first receive an email from a sender or do not often receive email from a sender. Valid values are:
-EnableMailboxIntelligence	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableMailboxIntelligenceProtection	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableOrganizationDomainsProtection	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableSimilarDomainsSafetyTips	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableSimilarUsersSafetyTips	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableSpoofIntelligence	Boolean		This setting is part of spoof protection.
-EnableTargetedDomainsProtection	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableTargetedUserProtection	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableUnauthenticatedSender	Boolean		This setting is part of spoof protection.
-EnableUnusualCharactersSafetyTips	Boolean		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-EnableViaTag	Boolean		This setting is part of spoof protection.
-ExcludedDomains	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-ExcludedSenders	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-HonorDmarcPolicy	Boolean		This setting is part of spoof protection.
-ImpersonationProtectionState	ImpersonationProtectionState		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-MailboxIntelligenceProtectionAction	ImpersonationAction		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-MailboxIntelligenceProtectionActionRecipients	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-MailboxIntelligenceQuarantineTag	String		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-MakeDefault	SwitchParameter		The MakeDefault switch makes this antiphish policy the default antiphish policy. You don't need to specify a value with this switch.
-PhishThresholdLevel	Int32		This setting is part of advanced settings and is available only in Microsoft Defender for Office 365.
-PolicyTag	String		This parameter is reserved for internal Microsoft use.
-RecommendedPolicyType	RecommendedPolicyType		The RecommendedPolicyType parameter is used for Standard and Strict policy creation as part of [Preset security policies](https://learn.microsoft.com/defender-office-365/preset-security-policies). Don't use this...
-SimilarUsersSafetyTipsCustomText	String		This parameter is reserved for internal Microsoft use.
-SpoofQuarantineTag	String		The SpoofQuarantineTag specifies the quarantine policy that's used on messages that are quarantined by spoof intelligence (the AuthenticationFailAction parameter value is Quarantine). You can use any value that...
-TargetedDomainActionRecipients	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedDomainProtectionAction	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedDomainQuarantineTag	String		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedDomainsToProtect	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedUserActionRecipients	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedUserProtectionAction	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedUserQuarantineTag	String		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-TargetedUsersToProtect	MultiValuedProperty		This setting is part of impersonation protection and is available only in Microsoft Defender for Office 365.
-UnusualCharactersSafetyTipsCustomText	String		This parameter is reserved for internal Microsoft use.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.