Commands › Exchange Online

New-MalwareFilterRule

Exchange Online ExchangeOnlineManagement New-*

Create malware filter rules in your organization.

Quick start script

# New-MalwareFilterRule — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MalwareFilterRule
$before | Format-List

# 3. Make the change (dry run first)
New-MalwareFilterRule -Name <String> -MalwareFilterPolicy <MalwareFilterPolicyIdParameter> -WhatIf
New-MalwareFilterRule -Name <String> -MalwareFilterPolicy <MalwareFilterPolicyIdParameter>

# 4. Verify and diff
$after = Get-MalwareFilterRule
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-MalwareFilterRule [-Name] <String> -MalwareFilterPolicy <MalwareFilterPolicyIdParameter>
 [-Comments <String>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-Enabled <Boolean>]
 [-ExceptIfRecipientDomainIs <Word[]>]
 [-ExceptIfSentTo <RecipientIdParameter[]>]
 [-ExceptIfSentToMemberOf <RecipientIdParameter[]>]
 [-Priority <Int32>]
 [-RecipientDomainIs <Word[]>]
 [-SentTo <RecipientIdParameter[]>]
 [-SentToMemberOf <RecipientIdParameter[]>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	Required	What it controls
-Name	String	yes	The Name parameter specifies a unique name for the malware filter rule.
-MalwareFilterPolicy	MalwareFilterPolicyIdParameter	yes	The MalwareFilterPolicy parameter specifies the malware filter policy that's associated with the malware filter rule.
-Comments	String		The Comments parameter specifies informative comments for the rule, such as what the rule is used for or how it has changed over time. The length of the comment can't exceed 1024 characters.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-Enabled	Boolean		The Enabled parameter enables or disables the malware filter rule. Valid input for this parameter is $true or $false. The default value is $true.
-ExceptIfRecipientDomainIs	Word[]		The ExceptIfRecipientDomainIs parameter specifies an exception that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.
-ExceptIfSentTo	RecipientIdParameter[]		The ExceptIfSentTo parameter specifies an exception that looks for recipients in messages. You can use any value that uniquely identifies the recipient. For example:
-ExceptIfSentToMemberOf	RecipientIdParameter[]		The ExceptIfSentToMemberOf parameter specifies an exception that looks for messages sent to members of distribution groups, mail-enabled security groups, or sent to Microsoft 365 Groups. You can use any value that...
-Priority	Int32		The Priority parameter specifies a priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't...
-RecipientDomainIs	Word[]		The RecipientDomainIs parameter specifies a condition that looks for recipients with email addresses in the specified domains. You can specify multiple domains separated by commas.
-SentTo	RecipientIdParameter[]		The SentTo parameter specifies a condition that looks for recipients in messages. You can use any value that uniquely identifies the recipient. For example:
-SentToMemberOf	RecipientIdParameter[]		The SentToMemberOf parameter specifies a condition that looks for messages sent to members of distribution groups, mail-enabled security groups, or sent to Microsoft 365 Groups. You can use any value that uniquely...
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.