MC265759 – (Updated) Microsoft Defender for Office 365: Extending Secure by Default for Exchange Transport Rules (ETRs)

Microsoft Exchange Logo

*For this entry exists the more relevant or more recent entry MC267137

check before: 2021-07-14


Advanced Threat Protection - Office 365, Defender, Exchange, Microsoft Defender for Office 365, Microsoft Information Protection, Office 365 general, Outlook


Online, World tenant



Change type:

Admin impact, Feature update, Updated message


Updated September 30, 2021: We have updated the rollout timeline below. Thank you for your patience.
Microsoft believes it’s critical to keep our customers secure by default. We have determined that legacy overrides tend to be too broad and cause more harm than good. As a security service, we believe it's imperative that we act on your behalf to prevent your users from being compromised. This means these legacy overrides will no longer be honored for email messages we believe are malicious. We already apply this approach with malware messages and now we have extended it to messages with high confidence phish verdicts. We have been taking a very deliberate approach to rolling out these changes in phases to ensure customers are not surprised and there are no negative side effects. We began to rollout Secure by Default for high confidence phishing messages by the override type starting in December 2020 (Roadmap ID 60827). Today, we’re at a point in our Secure by Default journey where the following overrides are not honored for malicious emails (malware or high confidence phish emails):

Allowed sender lists or allowed domain lists (anti-spam policies)
Outlook Safe Senders
IP Allow List (connection filtering)
We are now extending Secure by Default to cover high confidence phishing messages for the remaining legacy override type, Exchange mail flow rules (also known as transport rule or ETRs).
[Key Points]
Timing: We will begin rolling out Secure by Default for ETRs starting at the end of August (previously early August) and complete rollout by end of October (previously the end of September).
Action: Review and assess impact.

Change Category:


Release Phase:
General Availability



the free basic plan is required to see all details. Sign up here

A plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to please choose a plan.

Last updated 1 week ago

Login to your account

Welcome Back, We Missed You!