Commands › Exchange Online

New-MalwareFilterPolicy

Exchange Online ExchangeOnlineManagement New-*

Create malware filter policies in your organization.

Quick start script

# New-MalwareFilterPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MalwareFilterPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-MalwareFilterPolicy -Name <String> -WhatIf
New-MalwareFilterPolicy -Name <String>

# 4. Verify and diff
$after = Get-MalwareFilterPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-MalwareFilterPolicy [-Name] <String>
 [-Action <MalwareFilteringAction>]
 [-AdminDisplayName <String>]
 [-BypassInboundMessages <Boolean>]
 [-BypassOutboundMessages <Boolean>]
 [-Confirm]
 [-CustomAlertText <String>]
 [-CustomExternalBody <String>]
 [-CustomExternalSubject <String>]
 [-CustomFromAddress <SmtpAddress>]
 [-CustomFromName <String>]
 [-CustomInternalBody <String>]
 [-CustomInternalSubject <String>]
 [-CustomNotifications <Boolean>]
 [-DomainController <Fqdn>]
 [-EnableExternalSenderAdminNotifications <Boolean>]
 [-EnableExternalSenderNotifications <Boolean>]
 [-EnableFileFilter <Boolean>]
 [-EnableInternalSenderAdminNotifications <Boolean>]
 [-EnableInternalSenderNotifications <Boolean>]
 [-ExternalSenderAdminAddress <SmtpAddress>]
 [-FileTypeAction <FileTypeFilteringAction>]
 [-FileTypes <String[]>]
 [-InternalSenderAdminAddress <SmtpAddress>]
 [-QuarantineTag <String>]
 [-RecommendedPolicyType <RecommendedPolicyType>]
 [-WhatIf]
 [-ZapEnabled <Boolean>]
 [<CommonParameters>]

Parameters (28)

ParameterTypeRequiredWhat it controls
-Name String yes The Name parameter specifies the unique name of the malware filter policy. If the value contains spaces, enclose the value in quotation marks (").
-Action MalwareFilteringAction This parameter is available only in on-premises Exchange.
-AdminDisplayName String The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
-BypassInboundMessages Boolean This parameter is available only in on-premises Exchange.
-BypassOutboundMessages Boolean This parameter is available only in on-premises Exchange.
-Confirm SwitchParameter The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-CustomAlertText String This parameter is available only in on-premises Exchange.
-CustomExternalBody String The CustomExternalBody parameter specifies the custom body to use in notification messages for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks (").
-CustomExternalSubject String The CustomExternalSubject parameter specifies the custom subject to use in notification messages for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation...
-CustomFromAddress SmtpAddress The CustomFromAddress parameter specifies the custom From address to use in notification messages for malware detections in messages from internal or external senders.
-CustomFromName String The CustomFromName parameter specifies the custom From name to use in notification messages for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in...
-CustomInternalBody String The CustomInternalBody parameter specifies the custom body to use in notification messages for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks (").
-CustomInternalSubject String The CustomInternalSubject parameter specifies the custom subject to use in notification messages for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation...
-CustomNotifications Boolean The CustomNotifications parameter enables or disables the customization of notification messages for malware detections. Valid values are:
-DomainController Fqdn This parameter is available only in on-premises Exchange.
-EnableExternalSenderAdminNotifications Boolean The EnableExternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator for malware detections in messages from internal senders. Valid values are:
-EnableExternalSenderNotifications Boolean This parameter is available only in on-premises Exchange.
-EnableFileFilter Boolean This parameter is available only in the cloud-based service.
-EnableInternalSenderAdminNotifications Boolean The EnableInternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator for malware detections in messages from internal senders. Valid values are:
-EnableInternalSenderNotifications Boolean This parameter is available only in on-premises Exchange.
-ExternalSenderAdminAddress SmtpAddress The ExternalSenderAdminAddress parameter specifies the email address of the administrator who receives notifications messages for malware detections in messages from external senders.
-FileTypeAction FileTypeFilteringAction This parameter is available only in the cloud-based service.
-FileTypes String[] This parameter is available only in the cloud-based service.
-InternalSenderAdminAddress SmtpAddress The InternalSenderAdminAddress parameter specifies the email address of the administrator who receives notifications messages for malware detections in messages from internal senders.
-QuarantineTag String This parameter is available only in the cloud-based service.
-RecommendedPolicyType RecommendedPolicyType This parameter is available only in the cloud-based service.
-WhatIf SwitchParameter The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.
-ZapEnabled Boolean This parameter is available only in the cloud-based service.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.