Review spam messages in Office 365

Question

We've just migrated to Office 365, and there's a report on our dashboard that's saying that almost 90% of our incoming mail has been filtered as spam. This seems potentially alarming, and I'd like to review some of the messages. However, I see no messages in any user's junk mail folders, and none in quarantine. None of the reporting (message trace, etc...) seems to have any way to filter to just spam messages.

I opened a ticket with Microsoft, and they just said yes, there's no report that will do this. But I shouldn't worry about it, because probably all the users just already deleted the junk out of their junk folders.

I don't find this a particularly acceptable answer - anyone found any way to do this?

Answer 1

Alright - finally got an actually somewhat useful answer for this. To have spam still go to users' junk folders but also be available for central review, do the following:

• Log in as an admin to your O365 portal
• Go to Admin > Exchange > Mail Flow > Rules
• Click the plus sign and select "Create a New Rule"
• For "Apply this rule if...", add a condition. Select "The message properties > Include an SCL greater than or equal to", and give it the value of 5. This is the Spam Confidence Level, and 5 is the default threshold they use to flag as spam.
• For "Do the following" select what action you would like to take with the spam messages (note that this is in addition to what's being done in your content filter - i.e. send to junk or quarantine or whatever). I selected "Bcc the message to" and then an account I just use for email administration.

Again, this is in addition to the content filter, so I have that (under Protection > Content Filter) set to send them to the users' Junk folder. Then the above steps also bcc that junk mail into an account where I can go review at leisure. This still allows the users to monitor and manage their own junk mail, since they generally know better than me what's spam in some cases - i.e. if they've signed up for email lists, etc... However, having it central allows me to scan for patterns so I can whitelist when necessary or just generally ensure that filtering seems to be doing what it should.