Question

Your organization uses Defender for Office 365. A user is a member of two groups. The 'Executives' group is targeted by a custom anti-spam policy with priority 0 that quarantines high-confidence spam. The 'Sales' group is targeted by a different custom anti-spam policy with priority 1 that delivers high-confidence spam to the Junk Email folder. A high-confidence spam message arrives for a user who belongs to both groups. How is the message handled?

Accepted Answer

The message is quarantined because the policy with priority 0 is applied.

Answer

The message is delivered to the Junk Email folder because the priority 1 policy is more permissive.

Answer

Both policies are merged, and the most restrictive action across all matching policies is applied.

Answer

The default anti-spam policy is used because the user matches more than one custom policy.