malwareFilterRules

Malware Filter Rules. Rules scoping malware filter policies to recipients or domains. The malwareFilterRules entity set lives under /exchange/v1.0/malwareFilterRules in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/malwareFilterRules`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-MalwareFilterRule, Set-MalwareFilterRule, New-MalwareFilterRule, Remove-MalwareFilterRule, Enable-MalwareFilterRule, Disable-MalwareFilterRule

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/malwareFilterRules`	List malwareFilterRules entries.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/malwareFilterRules`	Create a new malwareFilterRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	`ThreatPolicy.ReadWrite`	Enterprise
GET	`/exchange/v1.0/malwareFilterRules/{key}`	Get a single malwareFilterRules entry by Identity.	`ThreatPolicy.Read`	Community
PATCH	`/exchange/v1.0/malwareFilterRules/{key}`	Partial update of the malwareFilterRules at /malwareFilterRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when `name` is in the body).	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/malwareFilterRules/{key}`	Remove the malwareFilterRules at /malwareFilterRules/{key}. Returns 204 with no body.	`ThreatPolicy.ReadWrite`	Enterprise
POST	`/exchange/v1.0/malwareFilterRules/{key}/disable`	POST /malwareFilterRules/{key}/disable - bound action via Disable-MalwareFilterRule. Returns 204.	`ThreatPolicy.ReadWrite`	Enterprise
POST	`/exchange/v1.0/malwareFilterRules/{key}/enable`	POST /malwareFilterRules/{key}/enable - bound action via Enable-MalwareFilterRule. Returns 204.	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/malwareFilterRules

List malwareFilterRules entries.

Backing cmdlet: Get-MalwareFilterRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
`state`	query	string		Server-side filter by rule enablement state (Get-MalwareFilterRule -State). One of: Enabled \| Disabled.

List malwareFilterRules

Stub auto-generated example for the malwareFilterRules collection. Backing cmdlet: Get-MalwareFilterRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/malwareFilterRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#malwareFilterRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/malwareFilterRules

Create a new malwareFilterRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`malwareFilterPolicy`	body		yes
`name`	body		yes
`comments`	body
`enabled`	body
`exceptIfRecipientDomainIs`	body
`exceptIfSentTo`	body
`exceptIfSentToMemberOf`	body
`priority`	body
`recipientDomainIs`	body
`sentTo`	body
`sentToMemberOf`	body
`dryRun`	query	bool (switch)

Create fails when MalwareFilterPolicy is missing

New-MalwareFilterRule requires both Name and MalwareFilterPolicy. Omitting MalwareFilterPolicy is rejected with a 400 before the cmdlet runs.

POST /exchange/v1.0/malwareFilterRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-malwareFilterRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'malwareFilterPolicy' field is required.",
    "target": "malwareFilterPolicy"
  },
  "correlationId": "0HN7Q9A1B2C3D-0000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a malware filter rule

Creates a malware filter rule via New-MalwareFilterRule. A rule binds an existing malware filter policy to recipient conditions; Name and MalwareFilterPolicy are required.

POST /exchange/v1.0/malwareFilterRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-malwareFilterRules",
  "malwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "enabled": true,
  "comments": "Applies the Exonaut malware policy to the contoso.com recipient domain.",
  "priority": 0,
  "recipientDomainIs": [
    "contoso.com"
  ],
  "sentTo": [
    "user@contoso.com"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/malwareFilterRules/exonaut-sample-malwareFilterRules

{
  "Id": "exonaut-sample-malwareFilterRules",
  "Identity": "exonaut-sample-malwareFilterRules",
  "Name": "exonaut-sample-malwareFilterRules",
  "MalwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "Enabled": true,
  "Priority": 0,
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "SentTo": [
    "user@contoso.com"
  ],
  "State": "Enabled"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/malwareFilterRules/{key}

Get a single malwareFilterRules entry by Identity.

Backing cmdlet: Get-MalwareFilterRule. Role: ThreatPolicy.Read (Community).

Get a single malwareFilterRules entry

Stub auto-generated example for GET /malwareFilterRules/{key}. Backing cmdlet: Get-MalwareFilterRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#malwareFilterRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

PATCH /exchange/v1.0/malwareFilterRules/{key}

Partial update of the malwareFilterRules at /malwareFilterRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`comments`	body
`exceptIfRecipientDomainIs`	body
`exceptIfSentTo`	body
`exceptIfSentToMemberOf`	body
`malwareFilterPolicy`	body
`name`	body
`priority`	body
`recipientDomainIs`	body
`sentTo`	body
`sentToMemberOf`	body
`dryRun`	query	bool (switch)

Update a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - partial update via Set-MalwareFilterRule. Only the supplied fields are passed to the cmdlet; the post-Set entity is returned.

PATCH /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "priority": 1,
  "comments": "Lowered priority; widened recipient scope to contoso.com.",
  "recipientDomainIs": [
    "contoso.com"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-malwareFilterRules",
  "Identity": "exonaut-sample-malwareFilterRules",
  "Name": "exonaut-sample-malwareFilterRules",
  "MalwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "Priority": 1,
  "Comments": "Lowered priority; widened recipient scope to contoso.com.",
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "State": "Enabled"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/malwareFilterRules/{key}

Remove the malwareFilterRules at /malwareFilterRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - removes the rule via Remove-MalwareFilterRule. Returns 204 with no body.

DELETE /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/malwareFilterRules/{key}/disable

POST /malwareFilterRules/{key}/disable - bound action via Disable-MalwareFilterRule. Returns 204.

Backing cmdlet: Disable-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Disable a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - bound action that disables the rule via Disable-MalwareFilterRule. Returns 204 with no body.

POST /exchange/v1.0/malwareFilterRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/malwareFilterRules/{key}/enable

POST /malwareFilterRules/{key}/enable - bound action via Enable-MalwareFilterRule. Returns 204.

Backing cmdlet: Enable-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Enable a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - bound action that enables the rule via Enable-MalwareFilterRule. Returns 204 with no body.

POST /exchange/v1.0/malwareFilterRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.