Best Practice - Mesh 365

The default policy settings are designed to be best practice and are explained below.

Verdicts

Verdict	Recommended action	What the verdict means
CLEAN	DELIVER	The email has been scanned and given a clean verdict.
IMPERSONATION	JUNK + BANNER	The email contains Business Email Compromise indicators and sender information matches, or is similar to an internal user.
INFOMAIL	JUNK + BANNER	The email contains an unsubscribe link and/or advertising, marketing, newsletter type content. Note: Many transactional emails will contain unsubscribe links and will be quarantined if your policy is configured to quarantine Infomail.
MALWARE	QUARANTINE	The email contains malicious content such as a URL or attachment.
PHISHING	QUARANTINE	The email contains content such as a URL or attachment that is considered phishing.
SPAM-DEFINITE	JUNK + BANNER	The email has received a spam score of 18.00+
SPAM-HIGH	JUNK + BANNER	The email has received a spam score of 9.00-18.00
SPAM-LIKELY	JUNK + BANNER	The email has received a spam score of 6.25-9.00
BANNED	QUARANTINE	The email contains an attachment banned as per the policy in place. Allow rules DO NOT bypass this verdict. To bypass the banned verdict, you must create a custom rule or remove the attachment type from the policy option.

Other Email Settings

Policy Option	Recommended action	What the verdict means
Banned Attachments	QUARANTINE EXECUTABLES	If an email contains a banned attachment, it will be automatically quarantined. Note: emails quarantined for banned attachments can only be released by an administrator.
Bypass Internal Banned Attachments	DISABLED	If enabled, internal emails containing a banned attachment will not be quarantined.
Geo Filter	QUARANTINE	Quarantine, junk, or banner actions on emails from different regions and countries. Policy is triggered based on the country of origin or the envelope-from TLD. Allow rules DO NOT bypass this verdict. To bypass the policy-geo verdict, you must create a custom rule or remove the country from the policy option.
Spam Filtering Level	MEDIUM	This feature increases or reduces the sensitivity of the spam filtering. This can be useful if you require filtering to be more or less restrictive for everyone or for certain mailboxes. Low will quarantine emails with a spam score of 7.5 as “Spam-Likely”. Medium is our default medium setting. This will quarantine emails with a spam score of 6.25. Emails at this score would fall into our "Spam-Likely" category. High will quarantine emails with a spam score of 5.0 as “Spam-Likely”. Medium is the recommended setting.

Actions Explained

Actions	What it means
DELIVER	Emails are delivered to the inbox.
DELIVER + BANNER	Emails are delivered to the inbox with a verdict dependant banner applied.
QUARANTINE	Emails are quarantined in Mesh for 28 days.
JUNK	Emails are moved to the Junk folder in Outlook.
BANNER	A warning banner is applied to the top of the email.
JUNK + BANNER	A warning banner is applied to the top of the email and the email is moved to the Junk folder in Outlook.
DELETE	Emails are deleted entirely and will not appear in the quarantine or inbox. Deleted emails cannot be delivered.