Understanding Enterprise Spam and Virus Filter with Exchange Online Protection

If you have not received an EOP ESN spam summary message recently, you can log directly into Office 365 to check. The Exchange Online Protection service can display a list of flagged messages.

1.  Log in to Spam and Virus Filtering via My Pitt (my.pitt.edu) -or- go to the Security and Compliance Center at protection.office.com.  Select Home, Threat Management, Review, and then click Quarantine.
2. To further review flagged messages:

• Filter or sort by Bulk, or Phish type using the menu.
• Perform an Advanced Search to filter through messages by specific sender address, send date, subject line, or expiration date.
• Release to your inbox.
• Release and Report to your inbox and to Microsoft for further review.

The Exchange Online Protection service sends a spam summary message to your inbox on a periodic basis. If your account receives a large number of spam messages, these messages will arrive about once a week. If you don't receive as many, the notifications will arrive less frequently.

1. Open the spam notification message. It will always originate from the address EOP ESN and will have the subject line Spam Notification.
2. For each message, you can choose Release to Inbox or Report as Not Junk. Note: Clicking Report as Not Junk does NOT add the sender of the message to your Approved/Safe Senders list.

Note: If you have not received an EOP ESN spam summary message recently and are concerned that an email you are expecting has been flagged, consider logging directly into the Office 365 Quarantine web interface to check. This process is detailed in the next section.

There are different ways to flag a spam message that is delivered to your inbox, depending on whether you use the Pitt Email (Outlook) webpage to manage your mail or an Outlook client installed on your PC.

1. Log in to Pitt Email (Outlook) via My Pitt (my.pitt.edu).
2. Find the listing for the junk message in the inventory of messages on the inbox view. Click on the line for the message so that it is highlighted and then click the check box that appears to the left of the sender's description.
3. Click on the down arrow icon next to Junk in the ribbon of commands that are above the inbox listings. Select Junk from the drop-down choices to move the message to your spam quarantine listing.

el Title - Delete the panel if not needed

Content goes here

You can also manage your Exchange Online Protection junk mail directly from your Outlook email client running on your PC or laptop. However, in order to effectively interact with Exchange Online Protection, you may need to download and install the Microsoft Junk Reporting Tool> first.

It is important to install the Microsoft Junk Reporting tool because it ensures that any messages that you flag will be processed by the Exchange Online Protection service. All current versions of the Outlook mail client for desktop and laptop PCs feature some kind of junk mail management, but this message routing is performed by the client. If you rely solely on the built-in junk mail features of your Outlook desktop/laptop PC application, you will be able to mark messages as junk. However, they will be moved to a folder in your Office 365 mail, not the Exchange Online Protection quarantine area. They will also not be purged after seven days, and Microsoft will not benefit from the tagging of the mail as spam as part of their continuous effort to identify suspect senders and content.

You can add email addresses to your list of Safe Senders to make certain messages from that address are never quarantined by Exchange Online Protection. You can also add email addresses or domains to the blocked senders list to ensure that messages from that address never make it to your inbox.

1. Log in to Pitt Email (Outlook) via My Pitt (my.pitt.edu).
2. Click the gear icon in the upper right-hand corner of the browser window.
3. Under Settings, type block, then click the Block or Allow setting that displays below your search term.
4. Place a check in the box next to Trust email from my Contacts and click Save.
    

5. To flag future messages from an individual sender, enter the offending from address (for example, user@emailprovider.com) in the field under the pencil and trash can icon under Blocked Senders. Click the plus sign icon to the right of the field to add it to the list below and then click the Save link at the top of the page to save the changes. Adding just a domain name (for example, emailprovider.com) will quarantine messages from the entire domain, so be careful with this option.

6. You can add an email address to the Safe Senders and Recipients field to ensure that future messages from the address are not flagged as spam by Exchange Online Protection. Enter the address in the field below the pencil and trash can icon. Click the plus sign icon to add the address to the list below. Then click the Save icon at the top of the page. Adding just a domain name in this field will have no effect.

Note: To edit an existing email address in either the Blocked Senders or Safe Senders and Recipients fields, click the address to highlight it, then click the pencil icon. You can also click the trash can icon to remove an email address from either field.

Block a Sender with Outlook (Desktop Email Client)

1. Right-click the message in Outlook and select Junk.
2. Choose whether to block the sender or never block the sender. You can also choose to block the sender's domain.
3. Your list of safe/blocked senders will be updated accordingly.

Selecting the option to trust your email contacts ensure that email messages sent by people in your Contacts list will not be quarantined as spam. You can select Trust Contacts from your Outlook email client (Windows or Mac), or you can use the Outlook Web App via My Pitt (Windows or Mac).

Trust Contacts with Outlook (Desktop Email Client)

1. Right-click any message in Outlook, hover over Junk, and select Junk Email Options.
2. Click the Safe Senders tab.
3. Place a check in the box next to Also trust e-mail from my Contacts.
4. Click OK.

Why are fewer messages being quarantined in the new spam filter?

Microsoft actively blocks known spam sites. Spam messages are automatically stopped even before they get to Pitt.

How do I manage my spam filter settings from a Webmail account?

Use Outlook Web Access to manage your filter settings.

Can I read mail messages that have been quarantined?

Yes. Your Spam and Virus Message Center enables you to preview the contents of a quarantined message to help determine whether it is spam or a legitimate message. Just click the Preview email message… link in the right-hand column.

Can I release more than one message at a time?

Yes. Hold down the CTRL key and click each message you want to release. Then click the Release Message (envelope) icon to release the messages.

How do I delete the spam messages that have been quarantined?

You cannot delete these messages. They will remain in quarantine for 30 days and then expire.

Are spam messages deleted from my Message Center after I release them and report them as not junk?

No. Spam messages will remain in quarantine for 30 days, even after you release them. They will then expire automatically and be removed from your Message Center.

Can I re-release a message from the spam filter?

No, once a message has been released from the spam filter, it's delivered to your email inbox. It cannot be released again. You will receive an error message if you try to do so.

How long will quarantined messages remain in my Message Center?

Quarantined email messages will remain in your Message Center for 30 days, unless you choose to release them earlier.

I forward my University email to another address. If I release a quarantined message, will it also be sent to my forwarding address?

Yes.

How long will quarantined messages remain in my Message Center?

Quarantined email messages will remain in your Message Center for 30 days, unless you choose to release them earlier.

I forward my University email to another address. Will the weekly spam summary be sent to my forwarding address?

Yes.

I don't want to receive a weekly email summary of spam. Can I turn it off?

No. It is not possible to turn off the summary email for individual students, faculty, or staff. However, you may create a rule in Outlook that automatically sends these messages to your Deleted Items folder (or another location). For details, refer to our help sheet Creating Rules in Outlook.

Can I customize how strict or lenient my spam filtering settings are?

General spam filtering settings cannot be customized. If you receive a spam message that should have been quarantined, you can report it to Microsoft.

However, you can customize your bulk mail filtering settings. Bulk mail is a unique category of email that some people consider to be spam and others do not. Many organizations use bulk mail services to send advertisements or deliver newsletters. You can choose how aggressively you want the University’s spam filtering service to filter your email for bulk mail:

1. Log in to Manage My Account (Accounts Management) via My Pitt (my.pitt.edu).
2. Click the Email & Messaging and then Set Email Preferences.
3. Click the Filtering tab and follow the instructions.

How do I report a spam messages that did not get quarantined (i.e., a false negative)?

There are several ways to do this. If you logged in to your Pitt Email (Outlook) account through My Pitt and are using the web interface, you can report spam by simply right-clicking the message you want to report, selecting Mark as Junk, and clicking Report. You can also send the email to junk@office365.microsoft.com. To do this, create a new, blank message and attach the spam message to it. Paste the original subject from the spam message into your Subject line and leave the message body blank. You can find out more about reporting spam via Microsoft'swebsite.