How to Create a Hub Transport Rule Based on Any Attachment

Transport rules are cool. Except when they don't work the way you expect.

I wanted to create a transport rule that blocks outgoing email to external recipients that contains an attachment, except for members of the "Allow Outbound Attachments" group. So, I created the following rule:

The trouble is, that it blocks any email that is not sent as plain-text, even though there is no attachment. Not good.

I examined the headers on emails with and without attachments and found the X-MS-Has-Attach X-header has a yes value when there's an attachment and is <blank> when there isn't.

...Message-ID: <BL0PR01MB4243EF8B4D8DD1624C9C6E77D4D20@BL9PR01MB4243.prod.exchangelabs.com>References: <1db58e8b507e4f7f81a892f1bb48654e@ex.contoso.com>In-Reply-To: <1db58e8b507e4f7f81a892f1bb48654e@ex.contoso.com>Accept-Language: en-USContent-Language: en-USX-MS-Has-Attach: yesX-MS-TNEF-Correlator:Authentication-Results-Original: spf=none (sender IP is )...

I modified the rule as below and it now works perfectly.

It's worth noting that the header values are not cAsE sensitive.