teamsProtectionPolicyRules

Teams Protection Rules. Rules binding the Teams protection policy to recipients and scope. The teamsProtectionPolicyRules entity set lives under /exchange/v1.0/teamsProtectionPolicyRules in the Threat protection category.

Fact	Value
Path	/exchange/v1.0/teamsProtectionPolicyRules
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	ThreatPolicy.Read.All (Community)
Write role	ThreatPolicy.ReadWrite.All (Enterprise)
Backing cmdlets	Get-TeamsProtectionPolicyRule, Set-TeamsProtectionPolicyRule, New-TeamsProtectionPolicyRule

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/teamsProtectionPolicyRules	List teamsProtectionPolicyRules entries.	ThreatPolicy.Read	Community
POST	/exchange/v1.0/teamsProtectionPolicyRules	Create via New-TeamsProtectionPolicyRule. Required: name + teamsProtectionPolicy.	ThreatPolicy.ReadWrite	Enterprise
GET	/exchange/v1.0/teamsProtectionPolicyRules/{key}	Get a single teamsProtectionPolicyRules entry by Identity.	ThreatPolicy.Read	Community
PATCH	/exchange/v1.0/teamsProtectionPolicyRules/{key}	Partial update via Set-TeamsProtectionPolicyRule.	ThreatPolicy.ReadWrite	Enterprise

GET /exchange/v1.0/teamsProtectionPolicyRules

List teamsProtectionPolicyRules entries.

Backing cmdlet: Get-TeamsProtectionPolicyRule. Role: ThreatPolicy.Read (Community).

Parameter	In	Type	Required	Description
state	query	string		Server-side filter by rule enablement state. One of: Enabled | Disabled.

List teamsProtectionPolicyRules

Stub auto-generated example for the teamsProtectionPolicyRules collection. Backing cmdlet: Get-TeamsProtectionPolicyRule. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/teamsProtectionPolicyRules?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#teamsProtectionPolicyRules",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/teamsProtectionPolicyRules/{key}

POST /exchange/v1.0/teamsProtectionPolicyRules

Create via New-TeamsProtectionPolicyRule. Required: name + teamsProtectionPolicy.

Backing cmdlet: New-TeamsProtectionPolicyRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
name	body		yes
teamsProtectionPolicy	body		yes
comments	body
enabled	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
dryRun	query	bool (switch)

Create rule fails when required field is missing

New-TeamsProtectionPolicyRule requires both name and teamsProtectionPolicy. Omitting teamsProtectionPolicy yields a 400 before the cmdlet runs.

POST /exchange/v1.0/teamsProtectionPolicyRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-teamsProtectionPolicyRules"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'teamsProtectionPolicy' is missing.",
    "target": "teamsProtectionPolicy"
  },
  "correlationId": "0HN3F9K2M4P7Q"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/teamsProtectionPolicyRules

Create a Teams protection policy rule

Create a Teams protection policy rule via New-TeamsProtectionPolicyRule. The rule binds recipient-scope conditions to the parent Teams protection policy.

POST /exchange/v1.0/teamsProtectionPolicyRules HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-teamsProtectionPolicyRules",
  "teamsProtectionPolicy": "Teams Protection Policy",
  "comments": "Exonaut sample Teams protection rule.",
  "enabled": true,
  "exceptIfRecipientDomainIs": [
    "contoso.com"
  ],
  "exceptIfSentTo": [
    "[email protected]"
  ]
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/teamsProtectionPolicyRules/exonaut-sample-teamsProtectionPolicyRules

{
  "Id": "exonaut-sample-teamsProtectionPolicyRules",
  "Identity": "exonaut-sample-teamsProtectionPolicyRules",
  "Name": "exonaut-sample-teamsProtectionPolicyRules",
  "TeamsProtectionPolicy": "Teams Protection Policy",
  "Comments": "Exonaut sample Teams protection rule.",
  "Enabled": true,
  "ExceptIfRecipientDomainIs": [
    "contoso.com"
  ],
  "ExceptIfSentTo": [
    "[email protected]"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/teamsProtectionPolicyRules

GET /exchange/v1.0/teamsProtectionPolicyRules/{key}

Get a single teamsProtectionPolicyRules entry by Identity.

Backing cmdlet: Get-TeamsProtectionPolicyRule. Role: ThreatPolicy.Read (Community).

Get a single teamsProtectionPolicyRules entry

Stub auto-generated example for GET /teamsProtectionPolicyRules/{key}. Backing cmdlet: Get-TeamsProtectionPolicyRule with -Identity {key}. Returns the full entity body; 404 if the identity doesn’t resolve.

GET /exchange/v1.0/teamsProtectionPolicyRules/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#teamsProtectionPolicyRules/$entity"
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

Related: GET /exchange/v1.0/teamsProtectionPolicyRules

PATCH /exchange/v1.0/teamsProtectionPolicyRules/{key}

Partial update via Set-TeamsProtectionPolicyRule.

Backing cmdlet: Set-TeamsProtectionPolicyRule. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comments	body
exceptIfRecipientDomainIs	body
exceptIfSentTo	body
exceptIfSentToMemberOf	body
dryRun	query	bool (switch)

Update a Teams protection policy rule

Sub-resource of teamsProtectionPolicyRules at GET /teamsProtectionPolicyRules/{key} - partial update via Set-TeamsProtectionPolicyRule. Only the writable fields supplied are changed; the updated entity is returned.

PATCH /exchange/v1.0/teamsProtectionPolicyRules/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "comments": "Updated Exonaut sample Teams protection rule.",
  "exceptIfRecipientDomainIs": [
    "contoso.com",
    "sales.contoso.com"
  ],
  "exceptIfSentToMemberOf": [
    "[email protected]"
  ]
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-teamsProtectionPolicyRules",
  "Identity": "exonaut-sample-teamsProtectionPolicyRules",
  "Name": "exonaut-sample-teamsProtectionPolicyRules",
  "TeamsProtectionPolicy": "Teams Protection Policy",
  "Comments": "Updated Exonaut sample Teams protection rule.",
  "Enabled": true,
  "ExceptIfRecipientDomainIs": [
    "contoso.com",
    "sales.contoso.com"
  ],
  "ExceptIfSentToMemberOf": [
    "[email protected]"
  ]
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/teamsProtectionPolicyRules

?dryRun=true previews of any write stay on Community.