Office 365 provides a solid spam filter but will occasionally allow some sexually suggestive (and not so suggestive) emails through to the user’s mailbox. These emails ended up in the Junk Folder, but I still got complaints. Getting upset about junk emails in your Junk folder is like getting angry at trash in your trash can.[note]I was going to say “getting upset about finding poop in your toilet” but my next question was Who Pooped? [/note]

To give yourself a bit more control over these types of emails, you can use PowerShell to quickly create a series of transport rules to block certain words. Because of the character length of transport rules, it is best to split the rules up into different chunks.

PowerShell Script to Create Office 365 Word Filter

First, download the list of bad words from here. The .zip file contains five text files. Each text file will correspond to a transport rule, as pictured above. This list is aimed at the education market so you might want to review it. Feel free to add or remove words from the individual files.

Next, download and modify this PowerShell script. You will need to set the $BadWordFolder location to point to your extracted lists. These transport rules only apply to incoming messages. To filter messages within your organization, remove the -ExceptIfFromScope InOrganization portion of each rule.

#Bad Words Go Here - No Ending Backslash
$BadWordFolder = "C:\Users\Joseph\Desktop\BadWords"

$UserCredential = Get-Credential 
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection 
Import-PSSession $Session 

New-TransportRule -Name "Blocked Word List 1" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words1.txt") -ExceptIfFromScope InOrganization -SetSCL 7 -Priority 0
New-TransportRule -Name "Blocked Word List 2" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words2.txt") -ExceptIfFromScope InOrganization -SetSCL 7 -Priority 1
New-TransportRule -Name "Blocked Word List 3" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words3.txt") -ExceptIfFromScope InOrganization -SetSCL 7 -Priority 2
New-TransportRule -Name "Blocked Word List 4" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words4.txt") -ExceptIfFromScope InOrganization -SetSCL 7 -Priority 3
New-TransportRule -Name "Blocked Word List 5" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words5.txt") -ExceptIfFromScope InOrganization -SetSCL 7 -Priority 4

The -SetSCL 7 portion sets Spam Confidence Level of matching messages to 7. Messages with an SCL of 7-9 are marked as High Confidence Spam[note]See this for more SCL details.[/note] In your default Spam policy, you will want to make sure that High Confidence Spam items are sent to quarantine – see the picture below for an example.

If you would prefer that your users not see these type of messages in their quarantine, you can move the messages to the Host Quarantine location by using this version of the script:

#Bad Words Go Here - No Ending Backslash
$BadWordFolder = "C:\Users\Joseph\Desktop\BadWords"

$UserCredential = Get-Credential 
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection 
Import-PSSession $Session 

New-TransportRule -Name "Blocked Word List 1" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words1.txt") -ExceptIfFromScope InOrganization -Quarantine $True -Priority 0
New-TransportRule -Name "Blocked Word List 2" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words2.txt") -ExceptIfFromScope InOrganization -Quarantine $True -Priority 1
New-TransportRule -Name "Blocked Word List 3" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words3.txt") -ExceptIfFromScope InOrganization -Quarantine $True -Priority 2
New-TransportRule -Name "Blocked Word List 4" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words4.txt") -ExceptIfFromScope InOrganization -Quarantine $True -Priority 3
New-TransportRule -Name "Blocked Word List 5" -SubjectOrBodyContainsWords (Get-Content "$BadWordFolder\Words5.txt") -ExceptIfFromScope InOrganization -Quarantine $True -Priority 4

Emails that contain a word in the list are moved to the Hosted Quarantine location. When an Office 365 administrator logs into https://protection.office.com/#/quarantine, they can see these blocked messages by filtering to messages quarantined due to Transport Rule.