{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
        "slug": "dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/"
        },
        "title": "Retire both objects behind a custom PowerShell anti-spam policy",
        "summary": "What must be checked when removing a custom spam-filter policy or rule through Exchange Online PowerShell?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:32+00:00",
        "modified_at": "2026-09-17T16:42:36+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 199,
        "potentially_affected": "Apply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.",
        "dse_recommendation": "DSE recommends treating retirement as a review of the policy-rule pair.",
        "primary_source": {
            "name": "Configure spam filter policies - Microsoft Defender for Office 365 | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Removing a spam-filter policy through PowerShell leaves its corresponding rule in place; Microsoft directs administrators to remove the orphaned rule separately when it is no longer needed. Removing the rule likewise leaves its policy behind. The default spam-filter policy is different: it has no corresponding rule. <a href=\"https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Apply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends treating retirement as a review of the policy-rule pair. Preserve the current settings, recipient conditions and priority in the change record. Check that the replacement coverage matches the intended population, then remove only the approved custom objects using the documented procedure. Give any intentionally retained object a stated purpose and owner.</p>\n<h2>Verification</h2>\n<p>After the authorized change, list policies and rules independently and compare both inventories with the approved target state. Confirm that the retired identities are absent and that the intended remaining rule still references the correct policy. Record recipient coverage and investigate unexpected orphaned objects before closing the change.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Configure anti-spam policies for cloud mailboxes</a>. Source reviewed September 17, 2026.</p>",
        "content_text": "Source facts\nRemoving a spam-filter policy through PowerShell leaves its corresponding rule in place; Microsoft directs administrators to remove the orphaned rule separately when it is no longer needed. Removing the rule likewise leaves its policy behind. The default spam-filter policy is different: it has no corresponding rule. Microsoft Learn.\nApplicability\nApply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.\nDSE recommendation\nDSE recommends treating retirement as a review of the policy-rule pair. Preserve the current settings, recipient conditions and priority in the change record. Check that the replacement coverage matches the intended population, then remove only the approved custom objects using the documented procedure. Give any intentionally retained object a stated purpose and owner.\nVerification\nAfter the authorized change, list policies and rules independently and compare both inventories with the approved target state. Confirm that the retired identities are absent and that the intended remaining rule still references the correct policy. Record recipient coverage and investigate unexpected orphaned objects before closing the change.\nOfficial references\nMicrosoft Learn: Configure anti-spam policies for cloud mailboxes. Source reviewed September 17, 2026.",
        "content_markdown": "## Source facts\n\nRemoving a spam-filter policy through PowerShell leaves its corresponding rule in place; Microsoft directs administrators to remove the orphaned rule separately when it is no longer needed. Removing the rule likewise leaves its policy behind. The default spam-filter policy is different: it has no corresponding rule. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure).\n\n## Applicability\n\nApply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.\n\n## DSE recommendation\n\nDSE recommends treating retirement as a review of the policy-rule pair. Preserve the current settings, recipient conditions and priority in the change record. Check that the replacement coverage matches the intended population, then remove only the approved custom objects using the documented procedure. Give any intentionally retained object a stated purpose and owner.\n\n## Verification\n\nAfter the authorized change, list policies and rules independently and compare both inventories with the approved target state. Confirm that the retired identities are absent and that the intended remaining rule still references the correct policy. Record recipient coverage and investigate unexpected orphaned objects before closing the change.\n\n## Official references\n\n[Microsoft Learn: Configure anti-spam policies for cloud mailboxes](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure). Source reviewed September 17, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Retire both objects behind a custom PowerShell anti-spam policy",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/",
                "headline": "Retire both objects behind a custom PowerShell anti-spam policy",
                "description": "What must be checked when removing a custom spam-filter policy or rule through Exchange Online PowerShell?",
                "abstract": "What must be checked when removing a custom spam-filter policy or rule through Exchange Online PowerShell?",
                "articleBody": "Source facts\nRemoving a spam-filter policy through PowerShell leaves its corresponding rule in place; Microsoft directs administrators to remove the orphaned rule separately when it is no longer needed. Removing the rule likewise leaves its policy behind. The default spam-filter policy is different: it has no corresponding rule. Microsoft Learn.\nApplicability\nApply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.\nDSE recommendation\nDSE recommends treating retirement as a review of the policy-rule pair. Preserve the current settings, recipient conditions and priority in the change record. Check that the replacement coverage matches the intended population, then remove only the approved custom objects using the documented procedure. Give any intentionally retained object a stated purpose and owner.\nVerification\nAfter the authorized change, list policies and rules independently and compare both inventories with the approved target state. Confirm that the retired identities are absent and that the intended remaining rule still references the correct policy. Record recipient coverage and investigate unexpected orphaned objects before closing the change.\nOfficial references\nMicrosoft Learn: Configure anti-spam policies for cloud mailboxes. Source reviewed September 17, 2026.",
                "datePublished": "2026-09-17T16:32:32+00:00",
                "dateModified": "2026-09-17T16:42:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Retire both objects behind a custom PowerShell anti-spam policy"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 199,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure spam filter policies - Microsoft Defender for Office 365 | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure"
                }
            }
        ]
    }
}