Do teams groups follow spam rules?

[thecomputerguy]

I have a client who has a couple Teams setup at info@ accounting@ and those accounts seem to just BREED spam ... they have the option enabled to allow external senders to mail to the group and the group email gets forwarded to the main people in the company and they are complaining of the amount of spam coming through these accounts.

I've investigated myself and the amount of spam being sent to info@ accounting@ is ungodly.

 

[YeOldeStonecat]

365 licenses a "per user"
Shared mailboxes are protected under the highest license of the user(s) accessing it (members).
(I'm 99% fairly sure that's still the case)

Are you policies pointed to just the user accounts...or to the entire domain?

Also remember....common names (like info@, acct@, etc)....are well known by spammers and simply POUNDED by spam via truckloads. So...while you might see a lot of spam making it through, truckloads of it are likely rejected or quarantined or junked...based on whatever you policies are set to.

Have you dialed up the policies? What are they set to?

 

[thecomputerguy]

365 licenses a "per user"
Shared mailboxes are protected under the highest license of the user(s) accessing it (members).
(I'm 99% fairly sure that's still the case)

Are you policies pointed to just the user accounts...or to the entire domain?

Also remember....common names (like info@, acct@, etc)....are well known by spammers and simply POUNDED by spam via truckloads. So...while you might see a lot of spam making it through, truckloads of it are likely rejected or quarantined or junked...based on whatever you policies are set to.

Have you dialed up the policies? What are they set to?

Spam rules are set to the PDF you sent me a couple years ago for Threat policies, to a tee ... this one



Is this is a matter of bumping up the bulk email anti-spam policy?

 

[thecomputerguy]

365 licenses a "per user"
Shared mailboxes are protected under the highest license of the user(s) accessing it (members).
(I'm 99% fairly sure that's still the case)

Are you policies pointed to just the user accounts...or to the entire domain?

Also remember....common names (like info@, acct@, etc)....are well known by spammers and simply POUNDED by spam via truckloads. So...while you might see a lot of spam making it through, truckloads of it are likely rejected or quarantined or junked...based on whatever you policies are set to.

Have you dialed up the policies? What are they set to?

Policies are set to cover the domain

 

[YeOldeStonecat]

Yeah those policies are a little old now. You can tighten them up a bit, the setting of 5 is OK....but there may be some other settings that are still on default? Expand the specific ones....

 

[Sky-Knight]

Those policies are VERY old now. You can use those rules, they do work... but they've also got 1000 knobs to turn to get right.

I'd just deploy the Standard Security preset you can find in the Defender panel. Make sure the targeting is correct (by default it's all domains, all mailboxes) and walk away.

M365 addresses and shared mailboxes are defended at whatever license level the users in the groups are as Stonecat mentioned. And even if you don't have any Defender for O365 anywhere, that's still a better place to configure filtering. The "ATP" process is no longer really valid anymore.