Mail Flow Rules (Transport Rules)

To support Prevent (Inline) protection mode for policies, Avanan creates Mail Flow rules (Transport rules). These rules allow Avanan to scan and perform remediation before the email is delivered to the recipient’s mailbox.

Avanan creates these Mail Flow rules (Transport rules).

Avanan - Protect Outgoing Rule
Avanan - Protect Internal Rule
Avanan - Protect Rule
Avanan - Whitelist Rule
Avanan - Junk Filter Low Rule
Avanan - Junk Filter Rule
Avanan - Encryption

Avanan - Protect Outgoing Rule

When is this rule applied?	What does this rule do?	Exceptions
Email is sent Outside the organization. Email is received from a avanan_inline_outgoing@[portal domain] group member.	Routes the email using Avanan DLP Outbound Connector. Sets the message header X-CLOUD-SEC-AV-Info with the [portal],office365_emails,sent,inline value. Stops processing more rules.	Sender IP address belongs to one of the relevant IP addresses for Avanan - Protect Outgoing rule. See IP Addresses for Avanan - Protect Outgoing Rule.

Note - [portal] refers to the unique identifier of your Avanan tenant.

Avanan - Protect Internal Rule

When is this rule applied?	What does this rule do?	Exceptions
Recipient is inside the organization and is a member of the inline group. See, Avanan Inline Incoming Group. Sender is inside the organization.	Routes the email using Outbound DLPAvananConnector. Adds X-CLOUD-SEC-AV-Info to the header with [portal],office365_emails,internal,inline value.	If the SCL is greater than or equal to 5. Sender IP address belongs to one of the relevant IP addresses for the Avanan - Protect rule. See IP Addresses for Avanan - Protect Internal Rule.

Notes:

[portal] refers to the unique identifier of your Avanan tenant.
Manual changes made to the rule will not be retained unless the Configure excluded IPs manually in mail flow rule option is selected under the Protect rule in the Policy section.

Avanan - Protect Rule

When is this rule applied?	What does this rule do?	Exceptions
Email is received from Outside the organization. Email is sent Inside the organization. Email is sent to avanan_inline_incoming@[portal domain] group member.	Routes the email using Avanan Outbound Connector. Sets the message header X-CLOUD-SEC-AV-Info with the [portal],office365_emails,inline value. Stops processing more rules.	Sender IP address belongs to one of the relevant IP addresses for the Avanan - Protect rule. See IP Addresses for Avanan - Protect Rule.

Notes - [portal] refers to the unique identifier of your Avanan tenant.

Avanan - Whitelist Rule

When is this rule applied?	What does this rule do?	Exceptions
Sender IP address belongs to one of the relevant IP addresses for the Avanan - Whitelist rule. See IP Addresses for Avanan - Whitelist Rule.	Sets the Spam Confidence Level (SCL) to -1.	If the message header X-CLOUD-SEC-AV-SCL matches the following patterns: true.

Avanan - Junk Filter Low Rule

This rule is used to mark Microsoft that the email was detected as spam by Avanan and should be delivered to the Junk folder.

When is this rule applied?	What does this rule do?
Sender IP address belongs to one of the relevant IP addresses for the Avanan - Junk Filter Low rule. See IP Addresses for Avanan - Junk Filter Low Rule. X-CLOUD-SEC-AV-SPAM-LOW header matches the following patterns: true	Sets the Spam Confidence Level (SCL) to 6.

Avanan - Junk Filter Rule

This rule is used to mark Microsoft that the email was detected as spam by Avanan and should be delivered to the Junk folder.

When is this rule applied?	What does this rule do?
Sender IP address belongs to one of the relevant IP addresses for the Avanan - Junk Filter rule. See IP Addresses for Avanan - Junk Filter Rule. X-CLOUD-SEC-AV-SPAM-HIGH header matches the following patterns: true	Sets the Spam Confidence Level (SCL) to 9.

Avanan - Encryption

When is this rule applied?	What does this rule do?
Email is sent Outside the organization. X-CLOUD-SEC-AV-Encrypt-Microsoft header matches the following patterns: true Email is received from Inside the Organization.	Rights protect message with RMS template: Encrypt

Notes - This rule is not created during onboarding. It is created only after a customer enables the Microsoft encryption workflow. See Encrypting Outgoing Emails.