Commands › Exchange Online
New-HostedContentFilterPolicy
Create spam filter policies (content filter policies) in your cloud-based organization.
Quick start script
# New-HostedContentFilterPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org
# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-HostedContentFilterPolicy
$before | Format-List
# 3. Make the change (dry run first)
New-HostedContentFilterPolicy -Name <String> -WhatIf
New-HostedContentFilterPolicy -Name <String>
# 4. Verify and diff
$after = Get-HostedContentFilterPolicy
Compare-Object ($before | Out-String) ($after | Out-String)Syntax
New-HostedContentFilterPolicy [-Name] <String>
[-AddXHeaderValue <String>]
[-AdminDisplayName <String>]
[-AllowedSenderDomains <MultiValuedProperty>]
[-AllowedSenders <MultiValuedProperty>]
[-BlockedSenderDomains <MultiValuedProperty>]
[-BlockedSenders <MultiValuedProperty>]
[-BulkMovesEnabled <BulkMovesEnabled>]
[-BulkQuarantineTag <String>]
[-BulkSpamAction <SpamFilteringAction>]
[-BulkThreshold <Int32>]
[-Confirm]
[-DownloadLink <Boolean>]
[-EnableEndUserSpamNotifications <Boolean>]
[-EnableLanguageBlockList <Boolean>]
[-EnableRegionBlockList <Boolean>]
[-EndUserSpamNotificationCustomFromAddress <SmtpAddress>]
[-EndUserSpamNotificationCustomFromName <String>]
[-EndUserSpamNotificationCustomSubject <String>]
[-EndUserSpamNotificationFrequency <Int32>]
[-EndUserSpamNotificationLanguage <EsnLanguage>]
[-EndUserSpamNotificationLimit <Int32>]
[-HighConfidencePhishAction <PhishFilteringAction>]
[-HighConfidencePhishQuarantineTag <String>]
[-HighConfidenceSpamAction <SpamFilteringAction>]
[-HighConfidenceSpamQuarantineTag <String>]
[-IncreaseScoreWithBizOrInfoUrls <SpamFilteringOption>]
[-IncreaseScoreWithImageLinks <SpamFilteringOption>]
[-IncreaseScoreWithNumericIps <SpamFilteringOption>]
[-IncreaseScoreWithRedirectToOtherPort <SpamFilteringOption>]
[-InlineSafetyTipsEnabled <Boolean>]
[-IntraOrgFilterState <IntraOrgFilterState>]
[-LanguageBlockList <MultiValuedProperty>]
[-MarkAsSpamBulkMail <SpamFilteringOption>]
[-MarkAsSpamEmbedTagsInHtml <SpamFilteringOption>]
[-MarkAsSpamEmptyMessages <SpamFilteringOption>]
[-MarkAsSpamFormTagsInHtml <SpamFilteringOption>]
[-MarkAsSpamFramesInHtml <SpamFilteringOption>]
[-MarkAsSpamFromAddressAuthFail <SpamFilteringOption>]
[-MarkAsSpamJavaScriptInHtml <SpamFilteringOption>]
[-MarkAsSpamNdrBackscatter <SpamFilteringOption>]
[-MarkAsSpamObjectTagsInHtml <SpamFilteringOption>]
[-MarkAsSpamSensitiveWordList <SpamFilteringOption>]
[-MarkAsSpamSpfRecordHardFail <SpamFilteringOption>]
[-MarkAsSpamWebBugsInHtml <SpamFilteringOption>]
[-ModifySubjectValue <String>]
[-PhishQuarantineTag <String>]
[-PhishSpamAction <SpamFilteringAction>]
[-PhishZapEnabled <Boolean>]
[-QuarantineRetentionPeriod <Int32>]
[-RecommendedPolicyType <RecommendedPolicyType>]
[-RedirectToRecipients <MultiValuedProperty>]
[-RegionBlockList <MultiValuedProperty>]
[-SpamAction <SpamFilteringAction>]
[-SpamQuarantineTag <String>]
[-SpamZapEnabled <Boolean>]
[-TestModeAction <SpamFilteringTestModeAction>]
[-TestModeBccToRecipients <MultiValuedProperty>]
[-WhatIf]
[<CommonParameters>]Parameters (59)
| Parameter | Type | Required | What it controls |
|---|---|---|---|
| -Name | String | yes | The Name parameter specifies a unique name for the spam filter policy. If the value contains spaces, enclose the value in quotation marks ("). |
| -AddXHeaderValue | String | The AddXHeaderValue parameter specifies the X-header name (not value) to add to spam messages when a spam filtering verdict parameter is set to the value AddXHeader. The following spam filtering verdict parameters... | |
| -AdminDisplayName | String | The AdminDisplayName parameter specifies a description for the policy. The maximum length is 256 characters. If the value contains spaces, enclose the value in quotation marks ("). | |
| -AllowedSenderDomains | MultiValuedProperty | The AllowedSenderDomains parameter specifies trusted domains that bypass spam filtering. Messages from senders in these domains are stamped with `SFV:SKA` in the `X-Forefront-Antispam-Report` header. The spam... | |
| -AllowedSenders | MultiValuedProperty | The AllowedSenders parameter specifies a list of trusted senders that bypass spam filtering. Messages from these senders are stamped with `SFV:SKA` in the `X-Forefront-Antispam-Report` header. The SCL value stamped... | |
| -BlockedSenderDomains | MultiValuedProperty | The BlockedSenderDomains parameter specifies domains that are always marked as spam sources. Messages from senders in these domains are stamped with `SFV:SKB` in the `X-Forefront-Antispam-Report` header. The SCL... | |
| -BlockedSenders | MultiValuedProperty | The BlockedSenders parameter specifies senders that are always marked as spam sources. Messages from these senders are stamped with `SFV:SKB` in the `X-Forefront-Antispam-Report` header. The SCL value stamped on the... | |
| -BulkMovesEnabled | BulkMovesEnabled | **Note**: This parameter is currently in Preview, isn't available in all organizations, and is subject to change. | |
| -BulkQuarantineTag | String | The BulkQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as bulk email (the BulkSpamAction parameter value is Quarantine). You can use any value that uniquely... | |
| -BulkSpamAction | SpamFilteringAction | The BulkSpamAction parameter specifies the action to take on messages that are marked as bulk email (also known as gray mail) based on the bulk complaint level (BCL) of the message, and the BCL threshold you... | |
| -BulkThreshold | Int32 | The BulkThreshold parameter specifies the BCL on messages that triggers the action specified by the BulkSpamAction parameter (greater than or equal to the specified BCL value). A valid value is an integer from 1 to... | |
| -Confirm | SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding. | |
| -DownloadLink | Boolean | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EnableEndUserSpamNotifications | Boolean | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EnableLanguageBlockList | Boolean | The EnableLanguageBlockList parameter enables or disables marking messages that were written in specific languages as spam. Valid values are: | |
| -EnableRegionBlockList | Boolean | The EnableRegionBlockList parameter enables or disables marking messages that are sent from specific countries or regions as spam. Valid values are: | |
| -EndUserSpamNotificationCustomFromAddress | SmtpAddress | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EndUserSpamNotificationCustomFromName | String | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EndUserSpamNotificationCustomSubject | String | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EndUserSpamNotificationFrequency | Int32 | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EndUserSpamNotificationLanguage | EsnLanguage | This parameter is deprecated and no longer used. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -EndUserSpamNotificationLimit | Int32 | This parameter is reserved for internal Microsoft use. End-user quarantine notifications are controlled by quarantine policies as specified by the \*QuarantineTag parameters. | |
| -HighConfidencePhishAction | PhishFilteringAction | The HighConfidencePhishAction parameter specifies the action to take on messages that are marked as high confidence phishing (not phishing). Phishing messages use fraudulent links or spoofed domains to get personal... | |
| -HighConfidencePhishQuarantineTag | String | The HighConfidencePhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence phishing (the HighConfidencePhishAction parameter value is Quarantine).... | |
| -HighConfidenceSpamAction | SpamFilteringAction | The HighConfidenceSpamAction parameter specifies the action to take on messages that are marked as high confidence spam (not spam, bulk email, phishing, or high confidence phishing). Valid values are: | |
| -HighConfidenceSpamQuarantineTag | String | The HighConfidenceSpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as high confidence spam (the HighConfidenceSpamAction parameter value is Quarantine). You can... | |
| -IncreaseScoreWithBizOrInfoUrls | SpamFilteringOption | The IncreaseScoreWithBizOrInfoUrls parameter increases the spam score of messages that contain links to .biz or .info domains. Valid values are: | |
| -IncreaseScoreWithImageLinks | SpamFilteringOption | The IncreaseScoreWithImageLinks parameter increases the spam score of messages that contain image links to remote websites. Valid values are: | |
| -IncreaseScoreWithNumericIps | SpamFilteringOption | The IncreaseScoreWithNumericIps parameter increases the spam score of messages that contain links to IP addresses. Valid values are: | |
| -IncreaseScoreWithRedirectToOtherPort | SpamFilteringOption | The IncreaseScoreWithRedirectToOtherPort parameter increases the spam score of messages that contain links that redirect to TCP ports other than 80 (HTTP), 8080 (alternate HTTP), or 443 (HTTPS). Valid values are: | |
| -InlineSafetyTipsEnabled | Boolean | The InlineSafetyTipsEnabled parameter specifies whether to enable or disable safety tips that are shown to recipients in messages. Valid values are: | |
| -IntraOrgFilterState | IntraOrgFilterState | The IntraOrgFilterState parameter specifies whether to enable anti-spam filtering for messages sent between internal users (users in the same organization). The action that's configured in the policy for the... | |
| -LanguageBlockList | MultiValuedProperty | The LanguageBlockList parameter specifies the email content languages that are marked as spam when the EnableLanguageBlockList parameter value is $true. A valid value is a supported uppercase ISO 639-1 two-letter... | |
| -MarkAsSpamBulkMail | SpamFilteringOption | The MarkAsSpamBulkMail parameter allows spam filtering to act on bulk email messages. Valid values are: | |
| -MarkAsSpamEmbedTagsInHtml | SpamFilteringOption | The MarkAsSpamEmbedTagsInHtml parameter marks a message as spam when the message contains HTML \<embed\> tags. Valid values are: | |
| -MarkAsSpamEmptyMessages | SpamFilteringOption | The MarkAsSpamEmptyMessages parameter marks a message as spam when the message contains no subject, no content in the message body, and no attachments. Valid values are: | |
| -MarkAsSpamFormTagsInHtml | SpamFilteringOption | The MarkAsSpamFormTagsInHtml parameter marks a message as spam when the message contains HTML \<form\> tags. Valid values are: | |
| -MarkAsSpamFramesInHtml | SpamFilteringOption | The MarkAsSpamFramesInHtml parameter marks a message as spam when the message contains HTML \<frame\> or \<iframe\> tags. Valid values are: | |
| -MarkAsSpamFromAddressAuthFail | SpamFilteringOption | The MarkAsSpamFromAddressAuthFail parameter marks a message as spam when Sender ID filtering encounters a hard fail. This setting combines an Sender Policy Framework (SPF) check with a Sender ID check to help protect... | |
| -MarkAsSpamJavaScriptInHtml | SpamFilteringOption | The MarkAsSpamJavaScriptInHtml parameter marks a message as spam when the message contains JavaScript or VBScript. Valid values are: | |
| -MarkAsSpamNdrBackscatter | SpamFilteringOption | The MarkAsSpamNdrBackscatter parameter marks a message as spam when the message is a non-delivery report (also known as an NDR or bounce messages) sent to a forged sender (known as *backscatter*). Valid values are: | |
| -MarkAsSpamObjectTagsInHtml | SpamFilteringOption | The MarkAsSpamObjectTagsInHtml parameter marks a message as spam when the message contains HTML \<object\> tags. Valid values are: | |
| -MarkAsSpamSensitiveWordList | SpamFilteringOption | The MarkAsSpamSensitiveWordList parameter marks a message as spam when the message contains words from the sensitive words list. Microsoft maintains a dynamic but non-editable list of words that are associated with... | |
| -MarkAsSpamSpfRecordHardFail | SpamFilteringOption | The MarkAsSpamSpfRecordHardFail parameter marks a message as spam when SPF record checking encounters a hard fail. Valid values are: | |
| -MarkAsSpamWebBugsInHtml | SpamFilteringOption | The MarkAsSpamWebBugsInHtml parameter marks a message as spam when the message contains web bugs (also known as web beacons). Valid values are: | |
| -ModifySubjectValue | String | The ModifySubjectValue parameter specifies the text to prepend to the existing subject of messages when a spam filtering verdict parameter is set to the value ModifySubject. The following spam filtering verdict... | |
| -PhishQuarantineTag | String | The PhishQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as phishing (the PhishSpamAction parameter value is Quarantine). You can use any value that uniquely... | |
| -PhishSpamAction | SpamFilteringAction | The PhishSpamAction parameter specifies the action to take on messages that are marked as phishing (not high confidence phishing). Phishing messages use fraudulent links or spoofed domains to get personal... | |
| -PhishZapEnabled | Boolean | The PhishZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect phishing in already delivered messages in Exchange Online mailboxes. Valid values are: | |
| -QuarantineRetentionPeriod | Int32 | The QuarantineRetentionPeriod parameter specifies the number of days that spam messages remain in quarantine when a spam filtering verdict parameter is set to the value Quarantine. All spam filtering verdict... | |
| -RecommendedPolicyType | RecommendedPolicyType | The RecommendedPolicyType parameter is used for Standard and Strict policy creation as part of [Preset security policies](https://learn.microsoft.com/defender-office-365/preset-security-policies). Don't use this... | |
| -RedirectToRecipients | MultiValuedProperty | The RedirectToRecipients parameter specifies the email addresses of replacement recipients when a spam filtering verdict parameter is set to the value Redirect. The following spam filtering verdict parameters can use... | |
| -RegionBlockList | MultiValuedProperty | The RegionBlockList parameter specifies the source countries or regions that are marked as spam when the EnableRegionBlockList parameter value is $true. A valid value is a supported ISO 3166-1 two-letter country code: | |
| -SpamAction | SpamFilteringAction | The SpamAction parameter specifies the action to take on messages that are marked as spam (not high confidence spam, bulk email, phishing, or high confidence phishing). Valid values are: | |
| -SpamQuarantineTag | String | The SpamQuarantineTag parameter specifies the quarantine policy that's used on messages that are quarantined as spam (the SpamAction parameter value is Quarantine). You can use any value that uniquely identifies the... | |
| -SpamZapEnabled | Boolean | The SpamZapEnabled parameter enables or disables zero-hour auto purge (ZAP) to detect spam in already delivered messages in Exchange Online mailboxes. Valid values are: | |
| -TestModeAction | SpamFilteringTestModeAction | The TestModeAction parameter specifies the additional action to take on messages when one or more IncreaseScoreWith\* or MarkAsSpam\* ASF parameters are set to the value Test. Valid values are: | |
| -TestModeBccToRecipients | MultiValuedProperty | The TestModeBccToRecipients parameter specifies the blind carbon copy (Bcc) recipients to add to spam messages when the TestModeAction ASF parameter is set to the value BccMessage. | |
| -WhatIf | SwitchParameter | The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch. |
Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.