malwareFilterRules

Malware Filter Rules. Rules scoping malware filter policies to recipients or domains. The malwareFilterRules entity set lives under /exchange/v1.0/malwareFilterRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/malwareFilterRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-MalwareFilterRule, Set-MalwareFilterRule, New-MalwareFilterRule, Remove-MalwareFilterRule, Enable-MalwareFilterRule, Disable-MalwareFilterRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/malwareFilterRules	List malwareFilterRules entries.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/malwareFilterRules	Create a new malwareFilterRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/malwareFilterRules/{key}	Get a single malwareFilterRules entry by Identity.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/malwareFilterRules/{key}	Partial update of the malwareFilterRules at /malwareFilterRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).	ThreatPolicy.ReadWrite	Enterprise
DELETE	/exchange/v1.0/malwareFilterRules/{key}	Remove the malwareFilterRules at /malwareFilterRules/{key}. Returns 204 with no body.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/malwareFilterRules/{key}/disable	POST /malwareFilterRules/{key}/disable - bound action via Disable-MalwareFilterRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise
POST	/exchange/v1.0/malwareFilterRules/{key}/enable	POST /malwareFilterRules/{key}/enable - bound action via Enable-MalwareFilterRule. Returns 204.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/malwareFilterRules

List malwareFilterRules entries.

Backing cmdlet: Get-MalwareFilterRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
state	query	string		Server-side filter by rule enablement state (Get-MalwareFilterRule -State). One of: Enabled | Disabled.

List malwareFilterRules

Stub auto-generated example for the malwareFilterRules collection. Backing cmdlet: Get-MalwareFilterRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/malwareFilterRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#malwareFilterRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/malwareFilterRules/{key}

POST /exchange/v1.0/malwareFilterRules

Create a new malwareFilterRules entry. Body keys map 1:1 to the cmdlet’s parameter names (camelCased). Returns 201 + Location + the freshly-fetched entity. Use ?dryRun=true to map to -WhatIf without applying.

Backing cmdlet: New-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
malwareFilterPolicy	body		yes
name	body		yes
comments	body
enabled	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Create fails when MalwareFilterPolicy is missing

New-MalwareFilterRule requires both Name and MalwareFilterPolicy. Omitting MalwareFilterPolicy is rejected with a 400 before the cmdlet runs.

POST /exchange/v1.0/malwareFilterRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-malwareFilterRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'malwareFilterPolicy' field is required.",
    "target": "malwareFilterPolicy"
  },
  "correlationId": "0HN7Q9A1B2C3D-0000001"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

Create a malware filter rule

Creates a malware filter rule via New-MalwareFilterRule. A rule binds an existing malware filter policy to recipient conditions; Name and MalwareFilterPolicy are required.

POST /exchange/v1.0/malwareFilterRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-malwareFilterRules",
  "malwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "enabled": true,
  "comments": "Applies the Exonaut malware policy to the contoso.com recipient domain.",
  "priority": 0,
  "recipientDomainIs": [
    "contoso.com"
  ],
  "sentTo": [
    "[email protected]"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/malwareFilterRules/exonaut-sample-malwareFilterRules

{
  "Id": "exonaut-sample-malwareFilterRules",
  "Identity": "exonaut-sample-malwareFilterRules",
  "Name": "exonaut-sample-malwareFilterRules",
  "MalwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "Enabled": true,
  "Priority": 0,
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "SentTo": [
    "[email protected]"
  ],
  "State": "Enabled"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

GET /exchange/v1.0/malwareFilterRules/{key}

Get a single malwareFilterRules entry by Identity.

Backing cmdlet: Get-MalwareFilterRule. Role: ThreatPolicy.Read (Community).

Get a single malwareFilterRules entry

Stub auto-generated example for GET /malwareFilterRules/{key}. Backing cmdlet: Get-MalwareFilterRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#malwareFilterRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/malwareFilterRules

PATCH /exchange/v1.0/malwareFilterRules/{key}

Partial update of the malwareFilterRules at /malwareFilterRules/{key}. Only body fields present are passed to the cmdlet. Returns 200 + the post-Set entity (rename-aware re-fetch when name is in the body).

Backing cmdlet: Set-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comments	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
malwareFilterPolicy	body
name	body
priority	body
recipientDomainIs	body
sentTo	body
sentToMemberOf	body
dryRun	query	bool (switch)

Update a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - partial update via Set-MalwareFilterRule. Only the supplied fields are passed to the cmdlet; the post-Set entity is returned.

PATCH /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "priority": 1,
  "comments": "Lowered priority; widened recipient scope to contoso.com.",
  "recipientDomainIs": [
    "contoso.com"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-malwareFilterRules",
  "Identity": "exonaut-sample-malwareFilterRules",
  "Name": "exonaut-sample-malwareFilterRules",
  "MalwareFilterPolicy": "exonaut-sample-malwareFilterPolicy",
  "Priority": 1,
  "Comments": "Lowered priority; widened recipient scope to contoso.com.",
  "RecipientDomainIs": [
    "contoso.com"
  ],
  "State": "Enabled"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

DELETE /exchange/v1.0/malwareFilterRules/{key}

Remove the malwareFilterRules at /malwareFilterRules/{key}. Returns 204 with no body.

Backing cmdlet: Remove-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - removes the rule via Remove-MalwareFilterRule. Returns 204 with no body.

DELETE /exchange/v1.0/malwareFilterRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

POST /exchange/v1.0/malwareFilterRules/{key}/disable

POST /malwareFilterRules/{key}/disable - bound action via Disable-MalwareFilterRule. Returns 204.

Backing cmdlet: Disable-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Disable a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - bound action that disables the rule via Disable-MalwareFilterRule. Returns 204 with no body.

POST /exchange/v1.0/malwareFilterRules/{key}/disable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

POST /exchange/v1.0/malwareFilterRules/{key}/enable

POST /malwareFilterRules/{key}/enable - bound action via Enable-MalwareFilterRule. Returns 204.

Backing cmdlet: Enable-MalwareFilterRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Enable a malware filter rule

Sub-resource of the malware filter rule at GET /malwareFilterRules/{key} - bound action that enables the rule via Enable-MalwareFilterRule. Returns 204 with no body.

POST /exchange/v1.0/malwareFilterRules/{key}/enable HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/malwareFilterRules

?dryRun=true previews of any write stay on Community.