Commands › Exchange Online

Set-MalwareFilterPolicy

Exchange Online ExchangeOnlineManagement Set-*

Modify malware filter policies in your organization.

Quick start script

# Set-MalwareFilterPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MalwareFilterPolicy
$before | Format-List

# 3. Make the change (dry run first)
Set-MalwareFilterPolicy -Identity <MalwareFilterPolicyIdParameter> -WhatIf
Set-MalwareFilterPolicy -Identity <MalwareFilterPolicyIdParameter>

# 4. Verify and diff
$after = Get-MalwareFilterPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-MalwareFilterPolicy [-Identity] <MalwareFilterPolicyIdParameter>
 [-Action <MalwareFilteringAction>]
 [-AdminDisplayName <String>]
 [-BypassInboundMessages <Boolean>]
 [-BypassOutboundMessages <Boolean>]
 [-Confirm]
 [-CustomAlertText <String>]
 [-CustomExternalBody <String>]
 [-CustomExternalSubject <String>]
 [-CustomFromAddress <SmtpAddress>]
 [-CustomFromName <String>]
 [-CustomInternalBody <String>]
 [-CustomInternalSubject <String>]
 [-CustomNotifications <Boolean>]
 [-DomainController <Fqdn>]
 [-EnableExternalSenderAdminNotifications <Boolean>]
 [-EnableExternalSenderNotifications <Boolean>]
 [-EnableFileFilter <Boolean>]
 [-EnableInternalSenderAdminNotifications <Boolean>]
 [-EnableInternalSenderNotifications <Boolean>]
 [-ExternalSenderAdminAddress <SmtpAddress>]
 [-FileTypeAction <FileTypeFilteringAction>]
 [-FileTypes <String[]>]
 [-InternalSenderAdminAddress <SmtpAddress>]
 [-IsPolicyOverrideApplied <Boolean>]
 [-MakeDefault]
 [-QuarantineTag <String>]
 [-WhatIf]
 [-ZapEnabled <Boolean>]
 [<CommonParameters>]

Parameters (29)

ParameterTypeRequiredWhat it controls
-Identity MalwareFilterPolicyIdParameter yes The Identity parameter specifies the malware filter policy you want to modify. You can use any value that uniquely identifies the policy. For example:
-Action MalwareFilteringAction This parameter is available only in on-premises Exchange.
-AdminDisplayName String The AdminDisplayName parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
-BypassInboundMessages Boolean This parameter is available only in on-premises Exchange.
-BypassOutboundMessages Boolean This parameter is available only in on-premises Exchange.
-Confirm SwitchParameter The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-CustomAlertText String This parameter is available only in on-premises Exchange.
-CustomExternalBody String The CustomExternalBody parameter specifies the custom body to use in notification messages for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation marks (").
-CustomExternalSubject String The CustomExternalSubject parameter specifies the custom subject to use in notification messages for malware detections in messages from external senders. If the value contains spaces, enclose the value in quotation...
-CustomFromAddress SmtpAddress The CustomFromAddress parameter specifies the custom From address to use in notification messages for malware detections in messages from internal or external senders.
-CustomFromName String The CustomFromName parameter specifies the custom From name to use in notification messages for malware detections in messages from internal or external senders. If the value contains spaces, enclose the value in...
-CustomInternalBody String The CustomInternalBody parameter specifies the custom body to use in notification messages for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation marks (").
-CustomInternalSubject String The CustomInternalSubject parameter specifies the custom subject to use in notification messages for malware detections in messages from internal senders. If the value contains spaces, enclose the value in quotation...
-CustomNotifications Boolean The CustomNotifications parameter enables or disables the customization of notification messages for malware detections. Valid values are:
-DomainController Fqdn This parameter is available only in on-premises Exchange.
-EnableExternalSenderAdminNotifications Boolean The EnableExternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator for malware detections in messages from internal senders. Valid values are:
-EnableExternalSenderNotifications Boolean This parameter is available only in on-premises Exchange.
-EnableFileFilter Boolean This parameter is available only in the cloud-based service.
-EnableInternalSenderAdminNotifications Boolean The EnableInternalSenderAdminNotifications parameter enables or disables sending notification messages to an administrator for malware detections in messages from internal senders. Valid values are:
-EnableInternalSenderNotifications Boolean This parameter is available only in on-premises Exchange.
-ExternalSenderAdminAddress SmtpAddress The ExternalSenderAdminAddress parameter specifies the email address of the administrator who receives notifications messages for malware detections in messages from external senders.
-FileTypeAction FileTypeFilteringAction This parameter is available only in the cloud-based service.
-FileTypes String[] This parameter is available only in the cloud-based service.
-InternalSenderAdminAddress SmtpAddress The InternalSenderAdminAddress parameter specifies the email address of the administrator who receives notifications messages for malware detections in messages from internal senders.
-IsPolicyOverrideApplied Boolean This parameter is reserved for internal Microsoft use.
-MakeDefault SwitchParameter The MakeDefault switch makes this malware filter policy the default policy. You don't need to specify a value with this switch.
-QuarantineTag String This parameter is available only in the cloud-based service.
-WhatIf SwitchParameter The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.
-ZapEnabled Boolean This parameter is available only in the cloud-based service.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.