# Retire both objects behind a custom PowerShell anti-spam policy

> What must be checked when removing a custom spam-filter policy or rule through Exchange Online PowerShell?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:32+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

What must be checked when removing a custom spam-filter policy or rule through Exchange Online PowerShell?

## Potentially affected

Apply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.

## DSE recommendation

DSE recommends treating retirement as a review of the policy-rule pair.

## Article

## Source facts

Removing a spam-filter policy through PowerShell leaves its corresponding rule in place; Microsoft directs administrators to remove the orphaned rule separately when it is no longer needed. Removing the rule likewise leaves its policy behind. The default spam-filter policy is different: it has no corresponding rule. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure).

## Applicability

Apply this review to custom anti-spam configuration managed through PowerShell. Confirm the exact policy and its associated rule before approving a removal, and identify which protection will cover the recipients afterward.

## DSE recommendation

DSE recommends treating retirement as a review of the policy-rule pair. Preserve the current settings, recipient conditions and priority in the change record. Check that the replacement coverage matches the intended population, then remove only the approved custom objects using the documented procedure. Give any intentionally retained object a stated purpose and owner.

## Verification

After the authorized change, list policies and rules independently and compare both inventories with the approved target state. Confirm that the retired identities are absent and that the intended remaining rule still references the correct policy. Record recipient coverage and investigate unexpected orphaned objects before closing the change.

## Official references

[Microsoft Learn: Configure anti-spam policies for cloud mailboxes](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure). Source reviewed September 17, 2026.

## Primary reference

- Name: Configure spam filter policies - Microsoft Defender for Office 365 | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Retire both objects behind a custom PowerShell anti-spam policy,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-148-retire-both-objects-behind-a-custom-powershell-anti-spam-policy/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.