Week 3, Day 4 — Transport rules & email compliance

Day 3 review & the policy enforcement gap

• Ask: "Safe Attachments and Safe Links protect against malware and malicious URLs. What do they not protect against?" — prime the answer: business policy violations, legal disclaimers, data leakage through unmonitored forwarding, or email that needs to be retained for compliance
• Ask: "Can a user turn off Safe Links on their own device? Can they bypass the executive protection anti-phishing policy?" — answer: no to both. Now ask — "Can a user configure their email client to auto-forward all email to an external Gmail address?" — answer: yes, unless a transport rule prevents it
• Frame the day: transport rules are the policy enforcement layer that operates at the mail flow level — above the content of any message, applied before delivery, and immune to user configuration. They enforce business rules that security filters don't cover.

Exchange transport rules — the mail flow policy engine

Transport rules (also called mail flow rules) are condition-action pairs that Exchange evaluates on every message passing through the system. They operate before the message reaches the mailbox and cannot be bypassed by end users.

• The rule model — conditions, exceptions, and actions — every transport rule has three components: a condition (what triggers the rule), an optional exception (what excludes a message from the rule), and an action (what happens to the message). Multiple conditions in a rule are evaluated with AND logic by default. Rules are evaluated in priority order — lower number = higher priority. When a rule fires with a "stop processing" action, subsequent rules are skipped.
• Common conditions: sender is, recipient is, sender domain is, message is sent to outside the organisation, subject contains, attachment extension is, message size is greater than, sender IP range.
• Common actions:

• Disclaimers — HTML and fallback behaviour — disclaimer text supports HTML formatting including links and styled text. Critical setting: the fallback action when the disclaimer cannot be added (e.g. encrypted message). Options are Wrap (create a new message with the original as an attachment), Ignore (deliver without disclaimer), or Reject. Wrap is the correct choice for most environments.
• Auto-forwarding — a significant data leakage risk — users can configure inbox rules or Outlook settings to automatically forward all email to external addresses. This is a significant data exfiltration vector. A transport rule can detect and block auto-forwarded messages by checking for the auto-forward message header or by blocking outbound mail where the sender and the original sender differ.
• MRM retention tags — introduction — Messaging Records Management (MRM) tags are labels that control how long email is kept before being deleted or archived. Applied to folders or individual messages. The Default MRM Policy applies to all mailboxes. More granular retention will be covered in Week 8 with Microsoft Purview, but the MRM foundation is set here in Exchange.

Lab 3-D: Building transport rules for Lakeview Logistics

Students create five transport rules covering the most important real-world mail flow policy scenarios: a legal disclaimer, an external email warning banner, auto-forward blocking, a finance approval CC rule, and a large attachment notification. All rules are tested by sending real messages.

• Step 1 — Outbound legal disclaimer (15 min)
  In the EAC: Mail flow → Rules → + Add a rule → Apply disclaimers. Configure:
  · Name: LL — Outbound Legal Disclaimer
  · Condition: The sender is located → Inside the organisation
  · Exception: The recipient is located → Inside the organisation
  · Action: Append a disclaimer → At the bottom of the message
  · Disclaimer text: See HTML below
  · Fallback action: Wrap
  · Priority: 0 (highest — runs first)
  
  Disclaimer HTML:
  <p style="font-size:10px;color:#666666;font-family:Arial;">This email and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the sender immediately and delete it from your system. Lakeview Logistics accepts no liability for any loss or damage arising from the use of this email or its attachments.</p>
• Step 2 — External email warning banner (10 min)
  Create a second rule:
  · Name: LL — External Email Warning
  · Condition: The sender is located → Outside the organisation
  · Action: Prepend a disclaimer → At the top of the message
  · Disclaimer text: <p style="background:#FFF3CD;padding:8px;border-left:4px solid #856404;font-family:Arial;font-size:11px;"><strong>⚠ EXTERNAL EMAIL:</strong> This message was sent from outside Lakeview Logistics. Do not click links or open attachments unless you are expecting this email and trust the sender.</p>
  · Fallback: Wrap
  · Priority: 1
• Step 3 — Block auto-forwarding to external addresses (10 min)
  Create a third rule:
  · Name: LL — Block External Auto-Forward
  · Condition: The message type is → Auto-forward
  · Action: Block the message → Reject the message and include an explanation: "Auto-forwarding to external email addresses is not permitted by Lakeview Logistics policy."
  · Priority: 2
• Step 4 — Finance approval CC rule (10 min)
  Create a fourth rule:
  · Name: LL — Finance Approval CC
  · Condition: The sender is a member of → LL-Finance (security group)
  AND The message subject includes → "Payment Approval" OR "Invoice Approval" OR "Wire Transfer"
  · Action: Add recipients to the Cc box → accounts@[yoursubdomain]
  · Priority: 3
  
  This ensures any Finance team message with these subject keywords is automatically copied to the Accounts Payable shared mailbox for audit purposes.
• Step 5 — Large attachment notification (10 min)
  Create a fifth rule:
  · Name: LL — Large Attachment Notify
  · Condition: The message size is greater than or equal to → 10 MB
  · Action: Notify the sender with a Policy Tip: "This message contains a large attachment (10 MB or more). Consider using SharePoint or OneDrive to share large files instead."
  · Priority: 4
  · Mode: Audit — do not block the message, only notify
• Step 6 — Test all five rules (10 min)
  Test each rule by sending a real message from a tenant mailbox:
  · Rule 1: Send an email from Sarah Chen to your personal email — verify the legal disclaimer appears at the bottom
  · Rule 2: Send an email from your personal email to Sarah Chen — verify the external warning banner appears at the top
  · Rule 3: Attempt to set up an auto-forward rule in Outlook Online for Sarah Chen's mailbox to an external address — verify the forwarded messages are rejected
  · Rule 4: Send an email from Priya Nair (Finance) with subject "Payment Approval — Supplier X" — verify accounts@ appears in Cc
  · Rule 5: Send an email with a large attachment (or simulate with a large inline image) — verify the policy tip notification appears

⭐ Bonus: Transport rules via PowerShell & MRM retention tags

Reflection & preview

• Ask: "The auto-forward blocking rule fires on all auto-forwarded messages. A legitimate business partner has set up an auto-forward from their server to yours for a mailing list. It gets blocked. How do you fix this without disabling the rule for everyone?" — surface the exception condition mechanism
• Ask: "The Finance CC rule adds accounts@ to every email with 'Payment Approval' in the subject. A Finance user sends a draft internally to a colleague for review with that subject line. What happens?" — surface the condition refinement needed: add an exception for internal recipients
• Ask: "A user complains they keep getting the external email warning banner on emails from a trusted partner. They ask you to turn the rule off. What do you do instead?" — surface the sender domain exception approach
• Collect exit ticket: describe the conditions, exceptions, and actions for a transport rule that automatically redirects any outbound email containing the words "confidential" or "sensitive" in the subject to a compliance review mailbox — but only for messages sent to external recipients
• Preview Day 5: Week 3 assessment — a simulated mail delivery failure. Students diagnose the root cause using Message Trace and DNS tools, remediate the configuration, and document the response. Bring your Lab Journal with all entries complete and ensure your DNS health is showing green.