Use Transport Rules to Silently Copy Messages to an Auditor

 

Applies to: Office 365 for enterprises, Live@edu

Topic Last Modified: 2011-01-17

For regulatory or business reasons, your organization may be required to send copies of specific e-mail messages to an auditor. For example, you may be required to alert an auditor if a user receives a picture attachment. If the auditor determines the message was inappropriate, he or she can follow-up with the sender or the recipient.

Silently send copies of specific e-mail messages to an auditor

First, you create a transport rule that adds the auditor to the message as a Bcc recipient. The process is the same no matter what conditions you want to use in the rule. For more information about how to configure the transport rule for specific scenarios, see the "Conditions" section later in this topic.

  1. In the Exchange Control Panel, select Manage My Organization > Mail Control > Rules.

  2. Click New. Enter the following information in the New Rule window:

    1. Click "More Options...".

    2. * If...   Enter one of the conditions described below under Conditions.

    3. * Do the following   Select "Add recipients..." and "To the Bcc box". In the Address Book window, select the auditor and click OK.

    4. Name of rule   Accept the default name, or enter a unique, descriptive name for the rule.

  3. Click Save.

Conditions

Now let's configure the conditions for the following scenarios:

The sender is from a specific domain

Suppose you want to moderate e-mail communication for all senders in the domain contoso.com and any subdomains, such as students.contoso.com. Specify the following condition in the transport rule:

  • * If...   Select "the sender..." and "address matches any of these text patterns". In the Specify Words or Phrases window, type contoso.com$ and then click OK. Note the dollar sign ( $ ) after contoso.com. The $ character indicates that the preceding pattern-matching string must exist at the end of the text string. For example, contoso.com$ matches adam@contoso.com and kim@research.contoso.com, but doesn't match kim@contoso.com.au.

The sender is external

Specify the following condition in the transport rule:

  • * If...   Select "the sender..." and "is external/internal". In the Select Scope window, select "Outside the organization", and then click OK.

Return to top

The message contains an attachment that exceeds a certain size

Specify the following condition in the transport rule:

  • * If...   Select "any attachment..." and "is larger than or equal to". In the Attachment Size Limit (KB) window, enter the maximum size of the attachment in kilobytes, and then click OK.

The message contains an attachment

Specify the following condition in the transport rule:

  • * If...   Select "any attachment..." and "is larger than or equal to". In the Attachment Size Limit (KB) window, enter 0, and then click OK.

Return to top

The message contains a file attachment that contains pictures

Specify the following condition in the transport rule:

  • * If...   Select "any attachment..." and "file name matches these text patterns". In the Specify Words or Phrases window, type the following words. Click Add Add after each word:

    • $.jpe*g   The asterisk character ( * ) matches zero or more instances of the previous character. For example, jpe*g matches jpg and jpeg.

    • $.tiff

    • $.png

    • $.gif

    • $.bmp

    When you are finished, click OK.

    Note   This list contains commonly-used picture file formats. However, other attachment types, for example, Microsoft Office Word documents, might also contain pictures. Also, this rule only looks for the name of the attached file. If the file extension of the attachment is altered, for example, if a .bmp file is attached as a .bm_ file, the rule won't catch the message.

Return to top

The message is sent from a suspected bully to an alleged victim in a Live@edu organization

In Live@edu, you can use the anti-bullying supervision policy to help prevent harassment or bullying by preventing a suspected bully from sending e-mail messages to an alleged victim. For more information, see Configure the Anti-Bullying Supervision Policy.

When the suspected bully is defined on an alleged victim's mailbox, messages sent by the bully to the victim are rejected with the non-delivery report (NDR) 550 5.7.1 that says "You're not allowed to send e-mail to this person." You can augment this behavior with a transport rule that also silently copies the message to an auditor. The following two steps are required.

  1. Define the suspected bully on the alleged victim's mailbox as follows:

    1. In the Exchange Control Panel, select Manage My Organization > Users & Groups > Mailboxes.

    2. In the Mailboxes list, select the mailbox of the alleged victim, and then click Details.

    3. On the Mailbox page, in the Mail Control section under Add people who aren't allowed to send e-mail to this user, click Add.

    4. On the Add an e-mail address to the mailbox's supervision list, enter the e-mail address of the suspected bully. It can be an internal or external e-mail address. When you're finished, click OK.

    5. On the Mailbox page, click Save.

  2. Configure the transport rule to silently copy the auditor when the suspected bully sends e-mail to the alleged victim as follows:

    • In the transport rule, specify the following condition:

      * If...   Select "The sender..." and "is on the recipient's supervision list". In the Select the Recipient's List window, select "Reject", and click OK.

 
Related help topics
Loading...
No resources were found.