transportRules

Mail Flow Rules. Rules that inspect and act on messages while in transit. The transportRules entity set lives under /exchange/v1.0/transportRules in the Mail flow category.

Fact	Value
Path	`/exchange/v1.0/transportRules`
Category	Mail flow
Tier	Tier 3, Mail flow
Read role	`MailFlow.Read.All` (Community)
Write role	`MailFlow.ReadWrite.All` (Pro)
Backing cmdlets	Get-TransportRule, Set-TransportRule, New-TransportRule, Remove-TransportRule, Enable-TransportRule, Disable-TransportRule

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/transportRules`	List transportRules entries.	`MailFlow.Read`	Community
POST	`/exchange/v1.0/transportRules`	POST /transportRules - creates a transport rule via New-TransportRule. Returns 201 + Location.	`MailFlow.ReadWrite`	Pro
GET	`/exchange/v1.0/transportRules/{key}`	Get a single transportRules entry by Identity.	`MailFlow.Read`	Community
PATCH	`/exchange/v1.0/transportRules/{key}`	PATCH /transportRules/{key} - partial update via Set-TransportRule. Returns 200 + updated entity.	`MailFlow.ReadWrite`	Pro
DELETE	`/exchange/v1.0/transportRules/{key}`	DELETE /transportRules/{key} - destructive, no soft-delete.	`MailFlow.ReadWrite`	Pro
POST	`/exchange/v1.0/transportRules/{key}/disable`	POST /transportRules/{key}/disable - bound action via Disable-TransportRule. Returns 204.	`MailFlow.ReadWrite`	Pro
POST	`/exchange/v1.0/transportRules/{key}/enable`	POST /transportRules/{key}/enable - bound action via Enable-TransportRule. Optional ?mode=Audit\|AuditAndNotify\|Enforce maps to -Mode. Returns 204.	`MailFlow.ReadWrite`	Pro

GET /exchange/v1.0/transportRules

List transportRules entries.

Backing cmdlet: Get-TransportRule. Role: MailFlow.Read (Community).

Parameter	In	Type	Description
`filter`	query	string	Optional: server-side OPATH filter (Get-TransportRule -Filter) over the synthesized Description property, which aggregates a rule’s conditions, exceptions, actions and their values. Uses the syntax “Description -like ‘Text’” - e.g. “Description -like ‘192.168.1.1’”. Not expressible via $filter on the POCO.
`state`	query	string	Filter the results by enabled or disabled rules. Maps -State on Get-TransportRule. Valid values: Enabled \| Disabled.
`excludeConditionActionDetails`	query	bool (switch)	Hide specific details from the results: when true, the Description, Conditions, and Actions properties (and configured condition/exception/action values) are blank. Maps -ExcludeConditionActionDetails on Get-TransportRule.
`all`	query	bool (switch)	Return all results instead of the EXO default of 1000. Maps -ResultSize Unlimited on Get-TransportRule; prevents silent truncation in large tenants.

List transport rules

Returns the tenant’s mail-flow transport rules, ordered by priority. Backed by the Get-TransportRule cmdlet; each entry exposes the rule’s conditions, exceptions, and actions.

GET /exchange/v1.0/transportRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#transportRules",
  "value": [
    {
      "Id": "[Redirect & Forward combo]",
      "ADComparisonAttribute": null,
      "ADComparisonOperator": null,
      "ActivationDate": null,
      "AddManagerAsRecipientType": null,
      "AddToRecipients": [],
      "AnyOfCcHeader": [],
      "AnyOfCcHeaderMemberOf": [],
      "AnyOfRecipientAddressContainsWords": [],
      "AnyOfRecipientAddressMatchesPatterns": [],
      "AnyOfToCcHeader": [
        "M365_Group_1@contoso.com"
      ],
      "AnyOfToCcHeaderMemberOf": [],
      "AnyOfToHeader": [],
      "AnyOfToHeaderMemberOf": [],
      "ApplyClassification": null,
      "ApplyHtmlDisclaimerFallbackAction": null,
      "ApplyHtmlDisclaimerLocation": null,
      "ApplyHtmlDisclaimerText": null,
      "ApplyOME": false,
      "ApplyRightsProtectionCustomizationTemplate": null,
      "ApplyRightsProtectionTemplate": null,
      "AttachmentContainsWords": [],
      "AttachmentExtensionMatchesWords": [],
      "AttachmentHasExecutableContent": false,
      "AttachmentIsPasswordProtected": false,
      "AttachmentIsUnsupported": false,
      "AttachmentMatchesPatterns": [],
      "AttachmentNameMatchesPatterns": [],
      "AttachmentProcessingLimitExceeded": false,
      "AttachmentPropertyContainsWords": [],
      "AttachmentSizeOver": null,
      "BetweenMemberOf1": [],
      "BetweenMemberOf2": [],
      "BlindCopyTo": [],
      "Comments": null,
      "ContentCharacterSetContainsWords": [],
      "CopyTo": [],
      "DeleteMessage": false,
      "Disconnect": false,
      "DlpPolicy": null,
      "DomainController": null,
      "Enabled": false,
      "ExceptIfADComparisonAttribute": null,
      "ExceptIfADComparisonOperator": null,
      "ExceptIfAnyOfCcHeader": [],
      "ExceptIfAnyOfCcHeaderMemberOf": [],
      "ExceptIfAnyOfRecipientAddressContainsWords": [],
      "ExceptIfAnyOfRecipientAddressMatchesPatterns": [],
      "ExceptIfAnyOfToCcHeader": [],
      "ExceptIfAnyOfToCcHeaderMemberOf": [],
      "ExceptIfAnyOfToHeader": [],
      "ExceptIfAnyOfToHeaderMemberOf": [],
      "ExceptIfAttachmentContainsWords": [],
      "ExceptIfAttachmentExtensionMatchesWords": [],
      "ExceptIfAttachmentHasExecutableContent": false,
      "ExceptIfAttachmentIsPasswordProtected": false,
      "ExceptIfAttachmentIsUnsupported": false,
      "ExceptIfAttachmentMatchesPatterns": [],
      "ExceptIfAttachmentNameMatchesPatterns": [],
      "ExceptIfAttachmentProcessingLimitExceeded": false,
      "ExceptIfAttachmentPropertyContainsWords": [],
      "ExceptIfAttachmentSizeOver": null,
      "ExceptIfBetweenMemberOf1": [],
      "ExceptIfBetweenMemberOf2": [],
      "ExceptIfContentCharacterSetContainsWords": [],
      "ExceptIfFrom": [],
      "ExceptIfFromAddressContainsWords": [],
      "ExceptIfFromAddressMatchesPatterns": [],
      "ExceptIfFromMemberOf": [],
      "ExceptIfFromScope": null,
      "ExceptIfHasClassification": null,
      "ExceptIfHasNoClassification": false,
      "ExceptIfHasSenderOverride": false,
      "ExceptIfHeaderContainsMessageHeader": null,
      "ExceptIfHeaderContainsWords": [],
      "ExceptIfHeaderMatchesMessageHeader": null,
      "ExceptIfHeaderMatchesPatterns": [],
      "ExceptIfManagerAddresses": [],
      "ExceptIfManagerForEvaluatedUser": null,
      "ExceptIfMessageContainsDataClassifications": [],
      "ExceptIfMessageSizeOver": null,
      "ExceptIfMessageTypeMatches": null,
      "ExceptIfRecipientADAttributeContainsWords": [],
      "ExceptIfRecipientADAttributeMatchesPatterns": [],
      "ExceptIfRecipientAddressContainsWords": [],
      "ExceptIfRecipientAddressMatchesPatterns": [],
      "ExceptIfRecipientDomainIs": [],
      "ExceptIfRecipientInSenderList": [],
      "ExceptIfSCLOver": null,
      "ExceptIfSenderADAttributeContainsWords": [],
      "ExceptIfSenderADAttributeMatchesPatterns": [],
      "ExceptIfSenderDomainIs": [],
      "ExceptIfSenderInRecipientList": [],
      "ExceptIfSenderIpRanges": [],
      "ExceptIfSenderManagementRelationship": null,
      "ExceptIfSentTo": [],
      "ExceptIfSentToMemberOf": [],
      "ExceptIfSentToScope": null,
      "ExceptIfSubjectContainsWords": [],
      "ExceptIfSubjectMatchesPatterns": [],
      "ExceptIfSubjectOrBodyContainsWords": [],
      "ExceptIfSubjectOrBodyMatchesPatterns": [],
      "ExceptIfWithImportance": null,
      "ExcludeConditionActionDetails": false,
      "ExpiryDate": null,
      "From": [],
      "FromAddressContainsWords": [],
      "FromAddressMatchesPatterns": [],
      "FromMemberOf": [],
      "FromScope": null,
      "GenerateIncidentReport": null,
      "GenerateNotification": null,
      "HasClassification": null,
      "HasNoClassification": false,
      "HasSenderOverride": false,
      "HeaderContainsMessageHeader": null,
      "HeaderContainsWords": [],
      "HeaderMatchesMessageHeader": null,
      "HeaderMatchesPatterns": [],
      "IncidentReportContent": [],
      "IncidentReportOriginalMail": null,
      "LogEventText": null,
      "ManagerAddresses": [],
      "ManagerForEvaluatedUser": null,
      "MessageContainsDataClassifications": [],
      "MessageSizeOver": null,
      "MessageTypeMatches": null,
      "Mode": "Enforce",
      "ModerateMessageByManager": false,
      "ModerateMessageByUser": [],
      "Name": "[Redirect & Forward combo]",
      "NotifySender": null,
      "PrependSubject": null,
      "Priority": 0,
      "Quarantine": false,
      "RecipientADAttributeContainsWords": [],
      "RecipientADAttributeMatchesPatterns": [],
      "RecipientAddressContainsWords": [],
      "RecipientAddressMatchesPatterns": [],
      "RecipientAddressType": "Resolved",
      "RecipientDomainIs": [],
      "RecipientInSenderList": [],
      "RedirectMessageTo": [
        "forward@contoso.com"
      ],
      "RejectMessageEnhancedStatusCode": null,
      "RejectMessageReasonText": null,
      "RemoveHeader": null,
      "RemoveOME": false,
      "RemoveOMEv2": false,
      "RemoveRMSAttachmentEncryption": false,
      "RouteMessageOutboundConnector": null,
      "RouteMessageOutboundRequireTls": false,
      "RuleErrorAction": "Ignore",
      "RuleSubType": "None",
      "SCLOver": null,
      "SenderADAttributeContainsWords": [],
      "SenderADAttributeMatchesPatterns": [],
      "SenderAddressLocation": "HeaderOrEnvelope",
      "SenderDomainIs": [],
      "SenderInRecipientList": [],
      "SenderIpRanges": [],
      "SenderManagementRelationship": null,
      "SentTo": [],
      "SentToMemberOf": [],
      "SentToScope": null,
      "SetAuditSeverity": null,
      "SetHeaderName": null,
      "SetHeaderValue": null,
      "SetSCL": null,
      "SmtpRejectMessageRejectStatusCode": null,
      "SmtpRejectMessageRejectText": null,
      "State": "Enabled",
      "StopRuleProcessing": true,
      "SubjectContainsWords": [],
      "SubjectMatchesPatterns": [],
      "SubjectOrBodyContainsWords": [],
      "SubjectOrBodyMatchesPatterns": [],
      "UseLegacyRegex": false,
      "WithImportance": null,
      "Actions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RedirectMessageAction Microsoft.Exchange.MessagingPolicies.Rules.Tasks.StopRuleProcessingAction",
      "Conditions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.AnyOfToCcHeaderPredicate",
      "ContentMatchesPrompt": null,
      "ContentMatchesPromptVerdict": null,
      "CreatedBy": "Ayla Kol",
      "Description": "If the message:\r\n\tincludes any of these recipients in the To or Cc box: 'M365_Group_1@contoso.com'\r\nTake the following actions:\r\n\tRedirect the message to 'forward@contoso.com'\r\n\tand Stop processing more rules\r\n",
      "DistinguishedName": "CN=[Redirect & Forward combo],CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "DlpPolicyId": "00000000-0000-0000-0000-000000000000",
      "ExceptIfContentMatchesPrompt": null,
      "ExceptIfContentMatchesPromptVerdict": null,
      "ExceptIfMessageContainsAllDataClassifications": null,
      "Exceptions": null,
      "Guid": "d09deb47-9e15-4d79-bfcb-9d9bda3ed447",
      "Identity": "[Redirect & Forward combo]",
      "ImmutableId": "d09deb47-9e15-4d79-bfcb-9d9bda3ed447",
      "IsRuleConfigurationSupported": true,
      "LastModifiedBy": "Ayla Kol",
      "ManuallyModified": false,
      "MessageContainsAllDataClassifications": null,
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "RegexSize": 0,
      "RuleConfigurationUnsupportedReason": "",
      "RuleVersion": "14.0.0.0",
      "SenderNotificationType": null,
      "Size": 381,
      "WhenChanged": "2026-03-30T17:53:26+03:00"
    },
    {
      "Id": "External email banner",
      "ADComparisonAttribute": null,
      "ADComparisonOperator": null,
      "ActivationDate": null,
      "AddManagerAsRecipientType": null,
      "AddToRecipients": [],
      "AnyOfCcHeader": [],
      "AnyOfCcHeaderMemberOf": [],
      "AnyOfRecipientAddressContainsWords": [],
      "AnyOfRecipientAddressMatchesPatterns": [],
      "AnyOfToCcHeader": [],
      "AnyOfToCcHeaderMemberOf": [],
      "AnyOfToHeader": [],
      "AnyOfToHeaderMemberOf": [],
      "ApplyClassification": null,
      "ApplyHtmlDisclaimerFallbackAction": "Ignore",
      "ApplyHtmlDisclaimerLocation": "Prepend",
      "ApplyHtmlDisclaimerText": "<table border=1 cellspacing=0 cellpadding=0 align=\"left\" width=\"100%\">\n    <tr>\n        <td style=\"background:#9C6500;padding:5pt 2pt 5pt 2pt\"></td>\n        <td width=\"100%\" cellpadding=\"7px 6px 7px 15px\"\n            style=\"background:#FFEB9C;padding:5pt 4pt 5pt 12pt;word-wrap:break-word\">\n            <div style=\"color:#222222;font-size:12pt; font-family:Calibri;\">\n                <span style=\"color:#9C6500; font-weight:bold;\"><strong><u>CAUTION:</strong></u></span>\n                This email originated from outside of Contoso. Do not click links or open attachments unless you\n                recognize the sender and know the content is safe.\n                <br>\n                If you are unsure, send this email as an attachment using the \"Report\" Button or using\n                Crtl+Alt+F (or Ctrl+Alt+O for Spanish) to\n                <a href=\"mailto:SecOps@contoso.com\">SecOps@contoso.com</a>\n                 | \n                <a href=\"https://contoso.service-now.com/sp/?id=kb_article_view&sysparm_article=KB0012345\">\n                    Deutsch / other Languages\n                </a>\n            </div>\n        </td>\n    </tr>\n</table>\n<br><br><br>",
      "ApplyOME": false,
      "ApplyRightsProtectionCustomizationTemplate": null,
      "ApplyRightsProtectionTemplate": null,
      "AttachmentContainsWords": [],
      "AttachmentExtensionMatchesWords": [],
      "AttachmentHasExecutableContent": false,
      "AttachmentIsPasswordProtected": false,
      "AttachmentIsUnsupported": false,
      "AttachmentMatchesPatterns": [],
      "AttachmentNameMatchesPatterns": [],
      "AttachmentProcessingLimitExceeded": false,
      "AttachmentPropertyContainsWords": [],
      "AttachmentSizeOver": null,
      "BetweenMemberOf1": [],
      "BetweenMemberOf2": [],
      "BlindCopyTo": [],
      "Comments": "7th March 2025 | Ayla Kol | External mail banner",
      "ContentCharacterSetContainsWords": [],
      "CopyTo": [],
      "DeleteMessage": false,
      "Disconnect": false,
      "DlpPolicy": null,
      "DomainController": null,
      "Enabled": false,
      "ExceptIfADComparisonAttribute": null,
      "ExceptIfADComparisonOperator": null,
      "ExceptIfAnyOfCcHeader": [],
      "ExceptIfAnyOfCcHeaderMemberOf": [],
      "ExceptIfAnyOfRecipientAddressContainsWords": [],
      "ExceptIfAnyOfRecipientAddressMatchesPatterns": [],
      "ExceptIfAnyOfToCcHeader": [],
      "ExceptIfAnyOfToCcHeaderMemberOf": [],
      "ExceptIfAnyOfToHeader": [],
      "ExceptIfAnyOfToHeaderMemberOf": [],
      "ExceptIfAttachmentContainsWords": [],
      "ExceptIfAttachmentExtensionMatchesWords": [],
      "ExceptIfAttachmentHasExecutableContent": false,
      "ExceptIfAttachmentIsPasswordProtected": false,
      "ExceptIfAttachmentIsUnsupported": false,
      "ExceptIfAttachmentMatchesPatterns": [],
      "ExceptIfAttachmentNameMatchesPatterns": [],
      "ExceptIfAttachmentProcessingLimitExceeded": false,
      "ExceptIfAttachmentPropertyContainsWords": [],
      "ExceptIfAttachmentSizeOver": null,
      "ExceptIfBetweenMemberOf1": [],
      "ExceptIfBetweenMemberOf2": [],
      "ExceptIfContentCharacterSetContainsWords": [],
      "ExceptIfFrom": [],
      "ExceptIfFromAddressContainsWords": [],
      "ExceptIfFromAddressMatchesPatterns": [],
      "ExceptIfFromMemberOf": [],
      "ExceptIfFromScope": null,
      "ExceptIfHasClassification": null,
      "ExceptIfHasNoClassification": false,
      "ExceptIfHasSenderOverride": false,
      "ExceptIfHeaderContainsMessageHeader": null,
      "ExceptIfHeaderContainsWords": [],
      "ExceptIfHeaderMatchesMessageHeader": null,
      "ExceptIfHeaderMatchesPatterns": [],
      "ExceptIfManagerAddresses": [],
      "ExceptIfManagerForEvaluatedUser": null,
      "ExceptIfMessageContainsDataClassifications": [],
      "ExceptIfMessageSizeOver": null,
      "ExceptIfMessageTypeMatches": null,
      "ExceptIfRecipientADAttributeContainsWords": [],
      "ExceptIfRecipientADAttributeMatchesPatterns": [],
      "ExceptIfRecipientAddressContainsWords": [],
      "ExceptIfRecipientAddressMatchesPatterns": [],
      "ExceptIfRecipientDomainIs": [],
      "ExceptIfRecipientInSenderList": [],
      "ExceptIfSCLOver": null,
      "ExceptIfSenderADAttributeContainsWords": [],
      "ExceptIfSenderADAttributeMatchesPatterns": [],
      "ExceptIfSenderDomainIs": [],
      "ExceptIfSenderInRecipientList": [],
      "ExceptIfSenderIpRanges": [],
      "ExceptIfSenderManagementRelationship": null,
      "ExceptIfSentTo": [
        "alex.rivera@contoso.com"
      ],
      "ExceptIfSentToMemberOf": [],
      "ExceptIfSentToScope": null,
      "ExceptIfSubjectContainsWords": [],
      "ExceptIfSubjectMatchesPatterns": [],
      "ExceptIfSubjectOrBodyContainsWords": [],
      "ExceptIfSubjectOrBodyMatchesPatterns": [],
      "ExceptIfWithImportance": null,
      "ExcludeConditionActionDetails": false,
      "ExpiryDate": null,
      "From": [],
      "FromAddressContainsWords": [],
      "FromAddressMatchesPatterns": [],
      "FromMemberOf": [],
      "FromScope": "NotInOrganization",
      "GenerateIncidentReport": null,
      "GenerateNotification": null,
      "HasClassification": null,
      "HasNoClassification": false,
      "HasSenderOverride": false,
      "HeaderContainsMessageHeader": null,
      "HeaderContainsWords": [],
      "HeaderMatchesMessageHeader": null,
      "HeaderMatchesPatterns": [],
      "IncidentReportContent": [],
      "IncidentReportOriginalMail": null,
      "LogEventText": null,
      "ManagerAddresses": [],
      "ManagerForEvaluatedUser": null,
      "MessageContainsDataClassifications": [],
      "MessageSizeOver": null,
      "MessageTypeMatches": null,
      "Mode": "Enforce",
      "ModerateMessageByManager": false,
      "ModerateMessageByUser": [],
      "Name": "External email banner",
      "NotifySender": null,
      "PrependSubject": null,
      "Priority": 1,
      "Quarantine": false,
      "RecipientADAttributeContainsWords": [],
      "RecipientADAttributeMatchesPatterns": [],
      "RecipientAddressContainsWords": [],
      "RecipientAddressMatchesPatterns": [],
      "RecipientAddressType": "Resolved",
      "RecipientDomainIs": [],
      "RecipientInSenderList": [],
      "RedirectMessageTo": [],
      "RejectMessageEnhancedStatusCode": null,
      "RejectMessageReasonText": null,
      "RemoveHeader": null,
      "RemoveOME": false,
      "RemoveOMEv2": false,
      "RemoveRMSAttachmentEncryption": false,
      "RouteMessageOutboundConnector": null,
      "RouteMessageOutboundRequireTls": false,
      "RuleErrorAction": "Ignore",
      "RuleSubType": "None",
      "SCLOver": null,
      "SenderADAttributeContainsWords": [],
      "SenderADAttributeMatchesPatterns": [],
      "SenderAddressLocation": "HeaderOrEnvelope",
      "SenderDomainIs": [],
      "SenderInRecipientList": [],
      "SenderIpRanges": [],
      "SenderManagementRelationship": null,
      "SentTo": [],
      "SentToMemberOf": [],
      "SentToScope": "InOrganization",
      "SetAuditSeverity": null,
      "SetHeaderName": null,
      "SetHeaderValue": null,
      "SetSCL": null,
      "SmtpRejectMessageRejectStatusCode": null,
      "SmtpRejectMessageRejectText": null,
      "State": "Enabled",
      "StopRuleProcessing": true,
      "SubjectContainsWords": [],
      "SubjectMatchesPatterns": [],
      "SubjectOrBodyContainsWords": [],
      "SubjectOrBodyMatchesPatterns": [],
      "UseLegacyRegex": false,
      "WithImportance": null,
      "Actions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.ApplyHtmlDisclaimerAction Microsoft.Exchange.MessagingPolicies.Rules.Tasks.StopRuleProcessingAction",
      "Conditions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToScopePredicate Microsoft.Exchange.MessagingPolicies.Rules.Tasks.FromScopePredicate",
      "ContentMatchesPrompt": null,
      "ContentMatchesPromptVerdict": null,
      "CreatedBy": "Ayla Kol",
      "Description": "If the message:\r\n\tIs sent to 'Inside the organization'\r\n\tand Is received from 'Outside the organization'\r\nTake the following actions:\r\n\tPrepend the message with the disclaimer '<table border=1 cellspacing=0 cellpadding=0 align=\"left\" width=\"100%\">\n    <tr>\n        <td style=\"background:#9C6500;padding:5pt 2pt 5pt 2pt\"></td>\n        <td width=\"100%\" cellpadding=\"7px 6px 7px 15px\"\n            style=\"background:#FFEB9C;padding:5pt 4pt 5pt 12pt;word-wrap:break-word\">\n            <div style=\"color:#222222;font-size:12pt; font-family:Calibri;\">\n                <span style=\"color:#9C6500; font-weight:bold;\"><strong><u>CAUTION:</strong></u></span>\n                This email originated from outside of Contoso. Do not click links or open attachments unless you\n                recognize the sender and know the content is safe.\n                <br>\n                If you are unsure, send this email as an attachment using the \"Report\" Button or using\n                Crtl+Alt+F (or Ctrl+Alt+O for Spanish) to\n                <a href=\"mailto:SecOps@contoso.com\">SecOps@contoso.com</a>\n                 | \n                <a href=\"https://contoso.service-now.com/sp/?id=kb_article_view&sysparm_article=KB0012345\">\n                    Deutsch / other Languages\n                </a>\n            </div>\n        </td>\n    </tr>\n</table>\n<br><br><br>'. If the disclaimer can't be applied, take no action.\r\n\tand Stop processing more rules\r\nExcept if the message:\r\n\tIs sent to 'alex.rivera@contoso.com'\r\n",
      "DistinguishedName": "CN=External email banner,CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "DlpPolicyId": "00000000-0000-0000-0000-000000000000",
      "ExceptIfContentMatchesPrompt": null,
      "ExceptIfContentMatchesPromptVerdict": null,
      "ExceptIfMessageContainsAllDataClassifications": null,
      "Exceptions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate",
      "Guid": "5cf3f121-8263-4a5c-9c88-9726e3851a85",
      "Identity": "External email banner",
      "ImmutableId": "5cf3f121-8263-4a5c-9c88-9726e3851a85",
      "IsRuleConfigurationSupported": true,
      "LastModifiedBy": "Ayla Kol",
      "ManuallyModified": false,
      "MessageContainsAllDataClassifications": null,
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "RegexSize": 0,
      "RuleConfigurationUnsupportedReason": "",
      "RuleVersion": "14.0.0.0",
      "SenderNotificationType": null,
      "Size": 2177,
      "WhenChanged": "2026-03-30T17:46:58+03:00"
    },
    {
      "Id": "External recipient MailTip",
      "ADComparisonAttribute": null,
      "ADComparisonOperator": null,
      "ActivationDate": null,
      "AddManagerAsRecipientType": null,
      "AddToRecipients": [],
      "AnyOfCcHeader": [],
      "AnyOfCcHeaderMemberOf": [],
      "AnyOfRecipientAddressContainsWords": [],
      "AnyOfRecipientAddressMatchesPatterns": [],
      "AnyOfToCcHeader": [],
      "AnyOfToCcHeaderMemberOf": [],
      "AnyOfToHeader": [],
      "AnyOfToHeaderMemberOf": [],
      "ApplyClassification": null,
      "ApplyHtmlDisclaimerFallbackAction": "Ignore",
      "ApplyHtmlDisclaimerLocation": "Append",
      "ApplyHtmlDisclaimerText": "[Contoso]",
      "ApplyOME": false,
      "ApplyRightsProtectionCustomizationTemplate": null,
      "ApplyRightsProtectionTemplate": null,
      "AttachmentContainsWords": [],
      "AttachmentExtensionMatchesWords": [],
      "AttachmentHasExecutableContent": false,
      "AttachmentIsPasswordProtected": false,
      "AttachmentIsUnsupported": false,
      "AttachmentMatchesPatterns": [],
      "AttachmentNameMatchesPatterns": [],
      "AttachmentProcessingLimitExceeded": false,
      "AttachmentPropertyContainsWords": [],
      "AttachmentSizeOver": null,
      "BetweenMemberOf1": [],
      "BetweenMemberOf2": [],
      "BlindCopyTo": [],
      "Comments": null,
      "ContentCharacterSetContainsWords": [],
      "CopyTo": [],
      "DeleteMessage": false,
      "Disconnect": false,
      "DlpPolicy": null,
      "DomainController": null,
      "Enabled": false,
      "ExceptIfADComparisonAttribute": null,
      "ExceptIfADComparisonOperator": null,
      "ExceptIfAnyOfCcHeader": [],
      "ExceptIfAnyOfCcHeaderMemberOf": [],
      "ExceptIfAnyOfRecipientAddressContainsWords": [],
      "ExceptIfAnyOfRecipientAddressMatchesPatterns": [],
      "ExceptIfAnyOfToCcHeader": [],
      "ExceptIfAnyOfToCcHeaderMemberOf": [],
      "ExceptIfAnyOfToHeader": [],
      "ExceptIfAnyOfToHeaderMemberOf": [],
      "ExceptIfAttachmentContainsWords": [],
      "ExceptIfAttachmentExtensionMatchesWords": [],
      "ExceptIfAttachmentHasExecutableContent": false,
      "ExceptIfAttachmentIsPasswordProtected": false,
      "ExceptIfAttachmentIsUnsupported": false,
      "ExceptIfAttachmentMatchesPatterns": [],
      "ExceptIfAttachmentNameMatchesPatterns": [],
      "ExceptIfAttachmentProcessingLimitExceeded": false,
      "ExceptIfAttachmentPropertyContainsWords": [],
      "ExceptIfAttachmentSizeOver": null,
      "ExceptIfBetweenMemberOf1": [],
      "ExceptIfBetweenMemberOf2": [],
      "ExceptIfContentCharacterSetContainsWords": [],
      "ExceptIfFrom": [],
      "ExceptIfFromAddressContainsWords": [],
      "ExceptIfFromAddressMatchesPatterns": [],
      "ExceptIfFromMemberOf": [],
      "ExceptIfFromScope": null,
      "ExceptIfHasClassification": null,
      "ExceptIfHasNoClassification": false,
      "ExceptIfHasSenderOverride": false,
      "ExceptIfHeaderContainsMessageHeader": null,
      "ExceptIfHeaderContainsWords": [],
      "ExceptIfHeaderMatchesMessageHeader": null,
      "ExceptIfHeaderMatchesPatterns": [],
      "ExceptIfManagerAddresses": [],
      "ExceptIfManagerForEvaluatedUser": null,
      "ExceptIfMessageContainsDataClassifications": [],
      "ExceptIfMessageSizeOver": null,
      "ExceptIfMessageTypeMatches": null,
      "ExceptIfRecipientADAttributeContainsWords": [],
      "ExceptIfRecipientADAttributeMatchesPatterns": [],
      "ExceptIfRecipientAddressContainsWords": [],
      "ExceptIfRecipientAddressMatchesPatterns": [],
      "ExceptIfRecipientDomainIs": [],
      "ExceptIfRecipientInSenderList": [],
      "ExceptIfSCLOver": null,
      "ExceptIfSenderADAttributeContainsWords": [],
      "ExceptIfSenderADAttributeMatchesPatterns": [],
      "ExceptIfSenderDomainIs": [],
      "ExceptIfSenderInRecipientList": [],
      "ExceptIfSenderIpRanges": [],
      "ExceptIfSenderManagementRelationship": null,
      "ExceptIfSentTo": [],
      "ExceptIfSentToMemberOf": [],
      "ExceptIfSentToScope": null,
      "ExceptIfSubjectContainsWords": [],
      "ExceptIfSubjectMatchesPatterns": [],
      "ExceptIfSubjectOrBodyContainsWords": [],
      "ExceptIfSubjectOrBodyMatchesPatterns": [],
      "ExceptIfWithImportance": null,
      "ExcludeConditionActionDetails": false,
      "ExpiryDate": null,
      "From": [],
      "FromAddressContainsWords": [],
      "FromAddressMatchesPatterns": [],
      "FromMemberOf": [],
      "FromScope": null,
      "GenerateIncidentReport": null,
      "GenerateNotification": null,
      "HasClassification": null,
      "HasNoClassification": false,
      "HasSenderOverride": false,
      "HeaderContainsMessageHeader": null,
      "HeaderContainsWords": [],
      "HeaderMatchesMessageHeader": null,
      "HeaderMatchesPatterns": [],
      "IncidentReportContent": [],
      "IncidentReportOriginalMail": null,
      "LogEventText": null,
      "ManagerAddresses": [],
      "ManagerForEvaluatedUser": null,
      "MessageContainsDataClassifications": [],
      "MessageSizeOver": null,
      "MessageTypeMatches": null,
      "Mode": "AuditAndNotify",
      "ModerateMessageByManager": false,
      "ModerateMessageByUser": [],
      "Name": "External recipient MailTip",
      "NotifySender": null,
      "PrependSubject": null,
      "Priority": 2,
      "Quarantine": false,
      "RecipientADAttributeContainsWords": [],
      "RecipientADAttributeMatchesPatterns": [],
      "RecipientAddressContainsWords": [],
      "RecipientAddressMatchesPatterns": [],
      "RecipientAddressType": "Resolved",
      "RecipientDomainIs": [],
      "RecipientInSenderList": [],
      "RedirectMessageTo": [],
      "RejectMessageEnhancedStatusCode": null,
      "RejectMessageReasonText": null,
      "RemoveHeader": null,
      "RemoveOME": false,
      "RemoveOMEv2": false,
      "RemoveRMSAttachmentEncryption": false,
      "RouteMessageOutboundConnector": null,
      "RouteMessageOutboundRequireTls": false,
      "RuleErrorAction": "Defer",
      "RuleSubType": "None",
      "SCLOver": null,
      "SenderADAttributeContainsWords": [],
      "SenderADAttributeMatchesPatterns": [],
      "SenderAddressLocation": "HeaderOrEnvelope",
      "SenderDomainIs": [],
      "SenderInRecipientList": [],
      "SenderIpRanges": [],
      "SenderManagementRelationship": null,
      "SentTo": [],
      "SentToMemberOf": [],
      "SentToScope": "NotInOrganization",
      "SetAuditSeverity": "High",
      "SetHeaderName": null,
      "SetHeaderValue": null,
      "SetSCL": null,
      "SmtpRejectMessageRejectStatusCode": null,
      "SmtpRejectMessageRejectText": null,
      "State": "Enabled",
      "StopRuleProcessing": false,
      "SubjectContainsWords": [],
      "SubjectMatchesPatterns": [],
      "SubjectOrBodyContainsWords": [],
      "SubjectOrBodyMatchesPatterns": [],
      "UseLegacyRegex": false,
      "WithImportance": null,
      "Actions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SetAuditSeverityAction Microsoft.Exchange.MessagingPolicies.Rules.Tasks.ApplyHtmlDisclaimerAction",
      "Conditions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToScopePredicate",
      "ContentMatchesPrompt": null,
      "ContentMatchesPromptVerdict": null,
      "CreatedBy": "Ayla Kol",
      "Description": "If the message:\r\n\tIs sent to 'Outside the organization'\r\nTake the following actions:\r\n\tSet audit severity level to 'High'\r\n\tand Append the message with the disclaimer '[Contoso]'. If the disclaimer can't be applied, take no action.\r\n",
      "DistinguishedName": "CN=External recipient MailTip,CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "DlpPolicyId": "00000000-0000-0000-0000-000000000000",
      "ExceptIfContentMatchesPrompt": null,
      "ExceptIfContentMatchesPromptVerdict": null,
      "ExceptIfMessageContainsAllDataClassifications": null,
      "Exceptions": null,
      "Guid": "8d5c5dbd-ecb2-4426-8c02-212d96e21ca8",
      "Identity": "External recipient MailTip",
      "ImmutableId": "8d5c5dbd-ecb2-4426-8c02-212d96e21ca8",
      "IsRuleConfigurationSupported": true,
      "LastModifiedBy": "Ayla Kol",
      "ManuallyModified": false,
      "MessageContainsAllDataClassifications": null,
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "RegexSize": 0,
      "RuleConfigurationUnsupportedReason": "",
      "RuleVersion": "15.0.1.0",
      "SenderNotificationType": null,
      "Size": 485,
      "WhenChanged": "2026-03-30T17:52:23+03:00"
    }
  ]
}

Notes: Rules are returned in priority order (Priority 0 first). Identity equals the rule Name and is used as {key} on the by-key route.

POST /exchange/v1.0/transportRules

POST /transportRules - creates a transport rule via New-TransportRule. Returns 201 + Location.

Backing cmdlet: New-TransportRule. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required
`name`	body		yes
`activationDate`	body
`adComparisonAttribute`	body
`adComparisonOperator`	body
`addManagerAsRecipientType`	body
`addToRecipients`	body
`anyOfCcHeader`	body
`anyOfCcHeaderMemberOf`	body
`anyOfRecipientAddressContainsWords`	body
`anyOfRecipientAddressMatchesPatterns`	body
`anyOfToCcHeader`	body
`anyOfToCcHeaderMemberOf`	body
`anyOfToHeader`	body
`anyOfToHeaderMemberOf`	body
`applyClassification`	body
`applyHtmlDisclaimerFallbackAction`	body
`applyHtmlDisclaimerLocation`	body
`applyHtmlDisclaimerText`	body
`applyOME`	body
`applyRightsProtectionCustomizationTemplate`	body
`applyRightsProtectionTemplate`	body
`attachmentContainsWords`	body
`attachmentExtensionMatchesWords`	body
`attachmentHasExecutableContent`	body
`attachmentIsPasswordProtected`	body
`attachmentIsUnsupported`	body
`attachmentMatchesPatterns`	body
`attachmentNameMatchesPatterns`	body
`attachmentProcessingLimitExceeded`	body
`attachmentPropertyContainsWords`	body
`attachmentSizeOver`	body
`betweenMemberOf1`	body
`betweenMemberOf2`	body
`blindCopyTo`	body
`comments`	body
`contentCharacterSetContainsWords`	body
`copyTo`	body
`deleteMessage`	body
`disconnect`	body
`dlpPolicy`	body
`enabled`	body
`exceptIfADComparisonAttribute`	body
`exceptIfADComparisonOperator`	body
`exceptIfAnyOfCcHeader`	body
`exceptIfAnyOfCcHeaderMemberOf`	body
`exceptIfAnyOfRecipientAddressContainsWords`	body
`exceptIfAnyOfRecipientAddressMatchesPatterns`	body
`exceptIfAnyOfToCcHeader`	body
`exceptIfAnyOfToCcHeaderMemberOf`	body
`exceptIfAnyOfToHeader`	body
`exceptIfAnyOfToHeaderMemberOf`	body
`exceptIfAttachmentContainsWords`	body
`exceptIfAttachmentExtensionMatchesWords`	body
`exceptIfAttachmentHasExecutableContent`	body
`exceptIfAttachmentIsPasswordProtected`	body
`exceptIfAttachmentIsUnsupported`	body
`exceptIfAttachmentMatchesPatterns`	body
`exceptIfAttachmentNameMatchesPatterns`	body
`exceptIfAttachmentProcessingLimitExceeded`	body
`exceptIfAttachmentPropertyContainsWords`	body
`exceptIfAttachmentSizeOver`	body
`exceptIfBetweenMemberOf1`	body
`exceptIfBetweenMemberOf2`	body
`exceptIfContentCharacterSetContainsWords`	body
`exceptIfFrom`	body
`exceptIfFromAddressContainsWords`	body
`exceptIfFromAddressMatchesPatterns`	body
`exceptIfFromMemberOf`	body
`exceptIfFromScope`	body
`exceptIfHasClassification`	body
`exceptIfHasNoClassification`	body
`exceptIfHasSenderOverride`	body
`exceptIfHeaderContainsMessageHeader`	body
`exceptIfHeaderContainsWords`	body
`exceptIfHeaderMatchesMessageHeader`	body
`exceptIfHeaderMatchesPatterns`	body
`exceptIfManagerAddresses`	body
`exceptIfManagerForEvaluatedUser`	body
`exceptIfMessageContainsDataClassifications`	body
`exceptIfMessageSizeOver`	body
`exceptIfMessageTypeMatches`	body
`exceptIfRecipientADAttributeContainsWords`	body
`exceptIfRecipientADAttributeMatchesPatterns`	body
`exceptIfRecipientAddressContainsWords`	body
`exceptIfRecipientAddressMatchesPatterns`	body
`exceptIfRecipientDomainIs`	body
`exceptIfRecipientInSenderList`	body
`exceptIfSCLOver`	body
`exceptIfSenderADAttributeContainsWords`	body
`exceptIfSenderADAttributeMatchesPatterns`	body
`exceptIfSenderDomainIs`	body
`exceptIfSenderInRecipientList`	body
`exceptIfSenderIpRanges`	body
`exceptIfSenderManagementRelationship`	body
`exceptIfSentTo`	body
`exceptIfSentToMemberOf`	body
`exceptIfSentToScope`	body
`exceptIfSubjectContainsWords`	body
`exceptIfSubjectMatchesPatterns`	body
`exceptIfSubjectOrBodyContainsWords`	body
`exceptIfSubjectOrBodyMatchesPatterns`	body
`exceptIfWithImportance`	body
`expiryDate`	body
`from`	body
`fromAddressContainsWords`	body
`fromAddressMatchesPatterns`	body
`fromMemberOf`	body
`fromScope`	body
`generateIncidentReport`	body
`generateNotification`	body
`hasClassification`	body
`hasNoClassification`	body
`hasSenderOverride`	body
`headerContainsMessageHeader`	body
`headerContainsWords`	body
`headerMatchesMessageHeader`	body
`headerMatchesPatterns`	body
`incidentReportContent`	body
`incidentReportOriginalMail`	body
`logEventText`	body
`managerAddresses`	body
`managerForEvaluatedUser`	body
`messageContainsDataClassifications`	body
`messageSizeOver`	body
`messageTypeMatches`	body
`mode`	body
`moderateMessageByManager`	body
`moderateMessageByUser`	body
`notifySender`	body
`prependSubject`	body
`priority`	body
`quarantine`	body
`recipientADAttributeContainsWords`	body
`recipientADAttributeMatchesPatterns`	body
`recipientAddressContainsWords`	body
`recipientAddressMatchesPatterns`	body
`recipientAddressType`	body
`recipientDomainIs`	body
`recipientInSenderList`	body
`redirectMessageTo`	body
`rejectMessageEnhancedStatusCode`	body
`rejectMessageReasonText`	body
`removeHeader`	body
`removeOME`	body
`removeOMEv2`	body
`removeRMSAttachmentEncryption`	body
`routeMessageOutboundConnector`	body
`routeMessageOutboundRequireTls`	body
`ruleErrorAction`	body
`ruleSubType`	body
`sclOver`	body
`senderADAttributeContainsWords`	body
`senderADAttributeMatchesPatterns`	body
`senderAddressLocation`	body
`senderDomainIs`	body
`senderInRecipientList`	body
`senderIpRanges`	body
`senderManagementRelationship`	body
`sentTo`	body
`sentToMemberOf`	body
`sentToScope`	body
`setAuditSeverity`	body
`setHeaderName`	body
`setHeaderValue`	body
`setSCL`	body
`smtpRejectMessageRejectStatusCode`	body
`smtpRejectMessageRejectText`	body
`stopRuleProcessing`	body
`subjectContainsWords`	body
`subjectMatchesPatterns`	body
`subjectOrBodyContainsWords`	body
`subjectOrBodyMatchesPatterns`	body
`useLegacyRegex`	body
`withImportance`	body
`dryRun`	query	bool (switch)

Create a transport rule - missing required field

New-TransportRule requires Name. Omitting it fails body validation before the cmdlet runs and the API returns a 400 with the canonical error envelope.

POST /exchange/v1.0/transportRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comments": "Prepend an external-sender banner on inbound mail.",
  "prependSubject": "[External] "
}

HTTP/1.1 400 Bad Request

{
  "error": {
    "code": "BadRequest",
    "message": "The 'name' field is required.",
    "target": "name"
  },
  "correlationId": "0HNLSU6PPVJ03:00000002"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a transport rule

Creates a mail-flow (transport) rule via New-TransportRule. Send only the predicate, exception, and action fields the rule needs; Name is required. Returns 201 with a Location header pointing at the new rule.

POST /exchange/v1.0/transportRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-transportRules",
  "comments": "Prepend an external-sender banner on inbound mail.",
  "priority": 0,
  "enabled": true,
  "fromScope": "NotInOrganization",
  "sentToScope": "InOrganization",
  "prependSubject": "[External] ",
  "stopRuleProcessing": false
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/transportRules/exonaut-sample-transportRules

{
  "Id": "exonaut-sample-transportRules",
  "Identity": "exonaut-sample-transportRules",
  "name": "exonaut-sample-transportRules",
  "comments": "Prepend an external-sender banner on inbound mail.",
  "priority": 0,
  "enabled": true,
  "fromScope": "NotInOrganization",
  "sentToScope": "InOrganization",
  "prependSubject": "[External] ",
  "stopRuleProcessing": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/transportRules/{key}

Get a single transportRules entry by Identity.

Backing cmdlet: Get-TransportRule. Role: MailFlow.Read (Community).

Get a single transport rule

Returns one transport rule by identity. Backed by Get-TransportRule with -Identity {key}, where {key} is the rule Name; the full entity body is returned.

GET /exchange/v1.0/transportRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#transportRules/$entity",
  "Id": "[Redirect & Forward combo]",
  "ADComparisonAttribute": null,
  "ADComparisonOperator": null,
  "ActivationDate": null,
  "AddManagerAsRecipientType": null,
  "AddToRecipients": [],
  "AnyOfCcHeader": [],
  "AnyOfCcHeaderMemberOf": [],
  "AnyOfRecipientAddressContainsWords": [],
  "AnyOfRecipientAddressMatchesPatterns": [],
  "AnyOfToCcHeader": [
    "M365_Group_1@contoso.com"
  ],
  "AnyOfToCcHeaderMemberOf": [],
  "AnyOfToHeader": [],
  "AnyOfToHeaderMemberOf": [],
  "ApplyClassification": null,
  "ApplyHtmlDisclaimerFallbackAction": null,
  "ApplyHtmlDisclaimerLocation": null,
  "ApplyHtmlDisclaimerText": null,
  "ApplyOME": false,
  "ApplyRightsProtectionCustomizationTemplate": null,
  "ApplyRightsProtectionTemplate": null,
  "AttachmentContainsWords": [],
  "AttachmentExtensionMatchesWords": [],
  "AttachmentHasExecutableContent": false,
  "AttachmentIsPasswordProtected": false,
  "AttachmentIsUnsupported": false,
  "AttachmentMatchesPatterns": [],
  "AttachmentNameMatchesPatterns": [],
  "AttachmentProcessingLimitExceeded": false,
  "AttachmentPropertyContainsWords": [],
  "AttachmentSizeOver": null,
  "BetweenMemberOf1": [],
  "BetweenMemberOf2": [],
  "BlindCopyTo": [],
  "Comments": null,
  "ContentCharacterSetContainsWords": [],
  "CopyTo": [],
  "DeleteMessage": false,
  "Disconnect": false,
  "DlpPolicy": null,
  "DomainController": null,
  "Enabled": false,
  "ExceptIfADComparisonAttribute": null,
  "ExceptIfADComparisonOperator": null,
  "ExceptIfAnyOfCcHeader": [],
  "ExceptIfAnyOfCcHeaderMemberOf": [],
  "ExceptIfAnyOfRecipientAddressContainsWords": [],
  "ExceptIfAnyOfRecipientAddressMatchesPatterns": [],
  "ExceptIfAnyOfToCcHeader": [],
  "ExceptIfAnyOfToCcHeaderMemberOf": [],
  "ExceptIfAnyOfToHeader": [],
  "ExceptIfAnyOfToHeaderMemberOf": [],
  "ExceptIfAttachmentContainsWords": [],
  "ExceptIfAttachmentExtensionMatchesWords": [],
  "ExceptIfAttachmentHasExecutableContent": false,
  "ExceptIfAttachmentIsPasswordProtected": false,
  "ExceptIfAttachmentIsUnsupported": false,
  "ExceptIfAttachmentMatchesPatterns": [],
  "ExceptIfAttachmentNameMatchesPatterns": [],
  "ExceptIfAttachmentProcessingLimitExceeded": false,
  "ExceptIfAttachmentPropertyContainsWords": [],
  "ExceptIfAttachmentSizeOver": null,
  "ExceptIfBetweenMemberOf1": [],
  "ExceptIfBetweenMemberOf2": [],
  "ExceptIfContentCharacterSetContainsWords": [],
  "ExceptIfFrom": [],
  "ExceptIfFromAddressContainsWords": [],
  "ExceptIfFromAddressMatchesPatterns": [],
  "ExceptIfFromMemberOf": [],
  "ExceptIfFromScope": null,
  "ExceptIfHasClassification": null,
  "ExceptIfHasNoClassification": false,
  "ExceptIfHasSenderOverride": false,
  "ExceptIfHeaderContainsMessageHeader": null,
  "ExceptIfHeaderContainsWords": [],
  "ExceptIfHeaderMatchesMessageHeader": null,
  "ExceptIfHeaderMatchesPatterns": [],
  "ExceptIfManagerAddresses": [],
  "ExceptIfManagerForEvaluatedUser": null,
  "ExceptIfMessageContainsDataClassifications": [],
  "ExceptIfMessageSizeOver": null,
  "ExceptIfMessageTypeMatches": null,
  "ExceptIfRecipientADAttributeContainsWords": [],
  "ExceptIfRecipientADAttributeMatchesPatterns": [],
  "ExceptIfRecipientAddressContainsWords": [],
  "ExceptIfRecipientAddressMatchesPatterns": [],
  "ExceptIfRecipientDomainIs": [],
  "ExceptIfRecipientInSenderList": [],
  "ExceptIfSCLOver": null,
  "ExceptIfSenderADAttributeContainsWords": [],
  "ExceptIfSenderADAttributeMatchesPatterns": [],
  "ExceptIfSenderDomainIs": [],
  "ExceptIfSenderInRecipientList": [],
  "ExceptIfSenderIpRanges": [],
  "ExceptIfSenderManagementRelationship": null,
  "ExceptIfSentTo": [],
  "ExceptIfSentToMemberOf": [],
  "ExceptIfSentToScope": null,
  "ExceptIfSubjectContainsWords": [],
  "ExceptIfSubjectMatchesPatterns": [],
  "ExceptIfSubjectOrBodyContainsWords": [],
  "ExceptIfSubjectOrBodyMatchesPatterns": [],
  "ExceptIfWithImportance": null,
  "ExcludeConditionActionDetails": false,
  "ExpiryDate": null,
  "From": [],
  "FromAddressContainsWords": [],
  "FromAddressMatchesPatterns": [],
  "FromMemberOf": [],
  "FromScope": null,
  "GenerateIncidentReport": null,
  "GenerateNotification": null,
  "HasClassification": null,
  "HasNoClassification": false,
  "HasSenderOverride": false,
  "HeaderContainsMessageHeader": null,
  "HeaderContainsWords": [],
  "HeaderMatchesMessageHeader": null,
  "HeaderMatchesPatterns": [],
  "IncidentReportContent": [],
  "IncidentReportOriginalMail": null,
  "LogEventText": null,
  "ManagerAddresses": [],
  "ManagerForEvaluatedUser": null,
  "MessageContainsDataClassifications": [],
  "MessageSizeOver": null,
  "MessageTypeMatches": null,
  "Mode": "Enforce",
  "ModerateMessageByManager": false,
  "ModerateMessageByUser": [],
  "Name": "[Redirect & Forward combo]",
  "NotifySender": null,
  "PrependSubject": null,
  "Priority": 0,
  "Quarantine": false,
  "RecipientADAttributeContainsWords": [],
  "RecipientADAttributeMatchesPatterns": [],
  "RecipientAddressContainsWords": [],
  "RecipientAddressMatchesPatterns": [],
  "RecipientAddressType": "Resolved",
  "RecipientDomainIs": [],
  "RecipientInSenderList": [],
  "RedirectMessageTo": [
    "forward@contoso.com"
  ],
  "RejectMessageEnhancedStatusCode": null,
  "RejectMessageReasonText": null,
  "RemoveHeader": null,
  "RemoveOME": false,
  "RemoveOMEv2": false,
  "RemoveRMSAttachmentEncryption": false,
  "RouteMessageOutboundConnector": null,
  "RouteMessageOutboundRequireTls": false,
  "RuleErrorAction": "Ignore",
  "RuleSubType": "None",
  "SCLOver": null,
  "SenderADAttributeContainsWords": [],
  "SenderADAttributeMatchesPatterns": [],
  "SenderAddressLocation": "HeaderOrEnvelope",
  "SenderDomainIs": [],
  "SenderInRecipientList": [],
  "SenderIpRanges": [],
  "SenderManagementRelationship": null,
  "SentTo": [],
  "SentToMemberOf": [],
  "SentToScope": null,
  "SetAuditSeverity": null,
  "SetHeaderName": null,
  "SetHeaderValue": null,
  "SetSCL": null,
  "SmtpRejectMessageRejectStatusCode": null,
  "SmtpRejectMessageRejectText": null,
  "State": "Enabled",
  "StopRuleProcessing": true,
  "SubjectContainsWords": [],
  "SubjectMatchesPatterns": [],
  "SubjectOrBodyContainsWords": [],
  "SubjectOrBodyMatchesPatterns": [],
  "UseLegacyRegex": false,
  "WithImportance": null,
  "Actions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.RedirectMessageAction Microsoft.Exchange.MessagingPolicies.Rules.Tasks.StopRuleProcessingAction",
  "Conditions": "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.AnyOfToCcHeaderPredicate",
  "ContentMatchesPrompt": null,
  "ContentMatchesPromptVerdict": null,
  "CreatedBy": "Ayla Kol",
  "Description": "If the message:\r\n\tincludes any of these recipients in the To or Cc box: 'M365_Group_1@contoso.com'\r\nTake the following actions:\r\n\tRedirect the message to 'forward@contoso.com'\r\n\tand Stop processing more rules\r\n",
  "DistinguishedName": "CN=[Redirect & Forward combo],CN=TransportVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "DlpPolicyId": "00000000-0000-0000-0000-000000000000",
  "ExceptIfContentMatchesPrompt": null,
  "ExceptIfContentMatchesPromptVerdict": null,
  "ExceptIfMessageContainsAllDataClassifications": null,
  "Exceptions": null,
  "Guid": "d09deb47-9e15-4d79-bfcb-9d9bda3ed447",
  "Identity": "[Redirect & Forward combo]",
  "ImmutableId": "d09deb47-9e15-4d79-bfcb-9d9bda3ed447",
  "IsRuleConfigurationSupported": true,
  "LastModifiedBy": "Ayla Kol",
  "ManuallyModified": false,
  "MessageContainsAllDataClassifications": null,
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "RegexSize": 0,
  "RuleConfigurationUnsupportedReason": "",
  "RuleVersion": "14.0.0.0",
  "SenderNotificationType": null,
  "Size": 381,
  "WhenChanged": "2026-03-30T17:53:26+03:00"
}

Notes: {key} is the rule Name (the Identity property). Names containing spaces or brackets must be URL-encoded.

Get a single transportRules entry - not found

When {key} does not resolve to an existing transport rule, Get-TransportRule fails to find the object and the API returns a 404 with the canonical error envelope.

GET /exchange/v1.0/transportRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 404 Not Found

{
  "error": {
    "code": "NotFound",
    "message": "Exchange object 'does-not-exist-12345' could not be found.",
    "target": "identity",
    "innerError": {
      "cmdlet": "Get-TransportRule"
    }
  },
  "correlationId": "0HNLSU6PPVJ03:00000001"
}

Notes: The {key} is the rule Name/Identity; an unresolvable identity yields this 404 envelope.

PATCH /exchange/v1.0/transportRules/{key}

PATCH /transportRules/{key} - partial update via Set-TransportRule. Returns 200 + updated entity.

Backing cmdlet: Set-TransportRule. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type
`activationDate`	body
`adComparisonAttribute`	body
`adComparisonOperator`	body
`addManagerAsRecipientType`	body
`addToRecipients`	body
`anyOfCcHeader`	body
`anyOfCcHeaderMemberOf`	body
`anyOfRecipientAddressContainsWords`	body
`anyOfRecipientAddressMatchesPatterns`	body
`anyOfToCcHeader`	body
`anyOfToCcHeaderMemberOf`	body
`anyOfToHeader`	body
`anyOfToHeaderMemberOf`	body
`applyClassification`	body
`applyHtmlDisclaimerFallbackAction`	body
`applyHtmlDisclaimerLocation`	body
`applyHtmlDisclaimerText`	body
`applyOME`	body
`applyRightsProtectionCustomizationTemplate`	body
`applyRightsProtectionTemplate`	body
`attachmentContainsWords`	body
`attachmentExtensionMatchesWords`	body
`attachmentHasExecutableContent`	body
`attachmentIsPasswordProtected`	body
`attachmentIsUnsupported`	body
`attachmentMatchesPatterns`	body
`attachmentNameMatchesPatterns`	body
`attachmentProcessingLimitExceeded`	body
`attachmentPropertyContainsWords`	body
`attachmentSizeOver`	body
`betweenMemberOf1`	body
`betweenMemberOf2`	body
`blindCopyTo`	body
`comments`	body
`contentCharacterSetContainsWords`	body
`copyTo`	body
`deleteMessage`	body
`disconnect`	body
`dlpPolicy`	body
`exceptIfADComparisonAttribute`	body
`exceptIfADComparisonOperator`	body
`exceptIfAnyOfCcHeader`	body
`exceptIfAnyOfCcHeaderMemberOf`	body
`exceptIfAnyOfRecipientAddressContainsWords`	body
`exceptIfAnyOfRecipientAddressMatchesPatterns`	body
`exceptIfAnyOfToCcHeader`	body
`exceptIfAnyOfToCcHeaderMemberOf`	body
`exceptIfAnyOfToHeader`	body
`exceptIfAnyOfToHeaderMemberOf`	body
`exceptIfAttachmentContainsWords`	body
`exceptIfAttachmentExtensionMatchesWords`	body
`exceptIfAttachmentHasExecutableContent`	body
`exceptIfAttachmentIsPasswordProtected`	body
`exceptIfAttachmentIsUnsupported`	body
`exceptIfAttachmentMatchesPatterns`	body
`exceptIfAttachmentNameMatchesPatterns`	body
`exceptIfAttachmentProcessingLimitExceeded`	body
`exceptIfAttachmentPropertyContainsWords`	body
`exceptIfAttachmentSizeOver`	body
`exceptIfBetweenMemberOf1`	body
`exceptIfBetweenMemberOf2`	body
`exceptIfContentCharacterSetContainsWords`	body
`exceptIfFrom`	body
`exceptIfFromAddressContainsWords`	body
`exceptIfFromAddressMatchesPatterns`	body
`exceptIfFromMemberOf`	body
`exceptIfFromScope`	body
`exceptIfHasClassification`	body
`exceptIfHasNoClassification`	body
`exceptIfHasSenderOverride`	body
`exceptIfHeaderContainsMessageHeader`	body
`exceptIfHeaderContainsWords`	body
`exceptIfHeaderMatchesMessageHeader`	body
`exceptIfHeaderMatchesPatterns`	body
`exceptIfManagerAddresses`	body
`exceptIfManagerForEvaluatedUser`	body
`exceptIfMessageContainsDataClassifications`	body
`exceptIfMessageSizeOver`	body
`exceptIfMessageTypeMatches`	body
`exceptIfRecipientADAttributeContainsWords`	body
`exceptIfRecipientADAttributeMatchesPatterns`	body
`exceptIfRecipientAddressContainsWords`	body
`exceptIfRecipientAddressMatchesPatterns`	body
`exceptIfRecipientDomainIs`	body
`exceptIfRecipientInSenderList`	body
`exceptIfSCLOver`	body
`exceptIfSenderADAttributeContainsWords`	body
`exceptIfSenderADAttributeMatchesPatterns`	body
`exceptIfSenderDomainIs`	body
`exceptIfSenderInRecipientList`	body
`exceptIfSenderIpRanges`	body
`exceptIfSenderManagementRelationship`	body
`exceptIfSentTo`	body
`exceptIfSentToMemberOf`	body
`exceptIfSentToScope`	body
`exceptIfSubjectContainsWords`	body
`exceptIfSubjectMatchesPatterns`	body
`exceptIfSubjectOrBodyContainsWords`	body
`exceptIfSubjectOrBodyMatchesPatterns`	body
`exceptIfWithImportance`	body
`expiryDate`	body
`from`	body
`fromAddressContainsWords`	body
`fromAddressMatchesPatterns`	body
`fromMemberOf`	body
`fromScope`	body
`generateIncidentReport`	body
`generateNotification`	body
`hasClassification`	body
`hasNoClassification`	body
`hasSenderOverride`	body
`headerContainsMessageHeader`	body
`headerContainsWords`	body
`headerMatchesMessageHeader`	body
`headerMatchesPatterns`	body
`incidentReportContent`	body
`incidentReportOriginalMail`	body
`logEventText`	body
`managerAddresses`	body
`managerForEvaluatedUser`	body
`messageContainsDataClassifications`	body
`messageSizeOver`	body
`messageTypeMatches`	body
`mode`	body
`moderateMessageByManager`	body
`moderateMessageByUser`	body
`name`	body
`notifySender`	body
`prependSubject`	body
`priority`	body
`quarantine`	body
`recipientADAttributeContainsWords`	body
`recipientADAttributeMatchesPatterns`	body
`recipientAddressContainsWords`	body
`recipientAddressMatchesPatterns`	body
`recipientAddressType`	body
`recipientDomainIs`	body
`recipientInSenderList`	body
`redirectMessageTo`	body
`rejectMessageEnhancedStatusCode`	body
`rejectMessageReasonText`	body
`removeHeader`	body
`removeOME`	body
`removeOMEv2`	body
`removeRMSAttachmentEncryption`	body
`routeMessageOutboundConnector`	body
`routeMessageOutboundRequireTls`	body
`ruleErrorAction`	body
`ruleSubType`	body
`sclOver`	body
`senderADAttributeContainsWords`	body
`senderADAttributeMatchesPatterns`	body
`senderAddressLocation`	body
`senderDomainIs`	body
`senderInRecipientList`	body
`senderIpRanges`	body
`senderManagementRelationship`	body
`sentTo`	body
`sentToMemberOf`	body
`sentToScope`	body
`setAuditSeverity`	body
`setHeaderName`	body
`setHeaderValue`	body
`setSCL`	body
`smtpRejectMessageRejectStatusCode`	body
`smtpRejectMessageRejectText`	body
`stopRuleProcessing`	body
`subjectContainsWords`	body
`subjectMatchesPatterns`	body
`subjectOrBodyContainsWords`	body
`subjectOrBodyMatchesPatterns`	body
`withImportance`	body
`dryRun`	query	bool (switch)

Update a transport rule

Sub-resource of the transport rule at GET /transportRules/{key} - partially updates it via Set-TransportRule. Send only the fields you want to change. Returns 200 with the updated entity.

PATCH /exchange/v1.0/transportRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comments": "Updated: banner reworded for clarity.",
  "priority": 1,
  "prependSubject": "[External Sender] "
}

HTTP/1.1 200 OK

{
  "Id": "exonaut-sample-transportRules",
  "Identity": "exonaut-sample-transportRules",
  "name": "exonaut-sample-transportRules",
  "comments": "Updated: banner reworded for clarity.",
  "priority": 1,
  "prependSubject": "[External Sender] "
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/transportRules/{key}

DELETE /transportRules/{key} - destructive, no soft-delete.

Backing cmdlet: Remove-TransportRule. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a transport rule

Sub-resource of the transport rule at GET /transportRules/{key} - permanently removes it via Remove-TransportRule. Destructive; there is no soft-delete. Returns 204 with no body.

DELETE /exchange/v1.0/transportRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/transportRules/{key}/disable

POST /transportRules/{key}/disable - bound action via Disable-TransportRule. Returns 204.

Backing cmdlet: Disable-TransportRule. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Disable a transport rule

Sub-resource of the transport rule at GET /transportRules/{key} - bound action via Disable-TransportRule. Turns the rule off without deleting it. Returns 204.

POST /exchange/v1.0/transportRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

POST /exchange/v1.0/transportRules/{key}/enable

POST /transportRules/{key}/enable - bound action via Enable-TransportRule. Optional ?mode=Audit|AuditAndNotify|Enforce maps to -Mode. Returns 204.

Backing cmdlet: Enable-TransportRule. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type	Required	Description
`mode`	query	string		Optional rule mode: Audit \| AuditAndNotify \| Enforce
`dryRun`	query	bool (switch)

Enable a transport rule

Sub-resource of the transport rule at GET /transportRules/{key} - bound action via Enable-TransportRule. Optional ?mode=Audit|AuditAndNotify|Enforce maps to -Mode. Returns 204.

POST /exchange/v1.0/transportRules/{key}/enable?mode=Enforce HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.