The following four scripts relate to the Secure Government Email Keyword Blocking document and are provided in a format suitable for copying and pasting into Exchange Online. 

You must have PowerShell 5.1 or 7+ (>7.0.3) to run the exchange online module. 

1.	Connect to your exchange online (connect-exchangeonline) and sign in to your tenancy.
2.	Run the following four scripts.
3.	Log in via your GUI and confirm the rules have appeared at the bottom of your list of transport rules. You may need to change the order locations to suit your tenancy requirements.


New-TransportRule -Name 'SGE Inbound keyword block rule' `
  -Mode Enforce `
  -RuleErrorAction Defer `
  -SenderAddressLocation HeaderOrEnvelope `
  -FromScope NotInOrganization `
  -SubjectOrBodyContainsWords `
    '{RESTRICTED}', '{SENSITIVE}', '{CONFIDENTIAL}', '{SECRET}', '{TOPSECRET}', '{TOP SECRET}', '{TOP-SECRET}', `
    '[RESTRICTED}', '[SENSITIVE}', '[CONFIDENTIAL}', '[SECRET}', '[TOPSECRET}', '[TOP SECRET}', '[TOP-SECRET}', `
    '{RESTRICTED]', '{SENSITIVE]', '{CONFIDENTIAL]', '{SECRET]', '{TOPSECRET]', '{TOP SECRET]', '{TOP-SECRET]', `
    '[RESTRICTED]', '[SENSITIVE]', '[CONFIDENTIAL]', '[SECRET]', '[TOPSECRET]', '[TOP SECRET]', '[TOP-SECRET]' `
  -RejectMessageReasonText `
    'This message contains a classification tag that cannot be received by this organization via email. The email has not been delivered. If the classification is not necessary, remove the tag and resend, or use another method to share the information.' `
  -RejectMessageEnhancedStatusCode '5.7.1'


New-TransportRule -Name 'SGE Outbound keyword block rule' `
  -Mode Enforce `
  -RuleErrorAction Defer `
  -SenderAddressLocation HeaderOrEnvelope `
  -SentToScope NotInOrganization `
  -SubjectOrBodyContainsWords `
    '{RESTRICTED}', '{SENSITIVE}', '{CONFIDENTIAL}', '{SECRET}', '{TOPSECRET}', '{TOP SECRET}', '{TOP-SECRET}', `
    '[RESTRICTED}', '[SENSITIVE}', '[CONFIDENTIAL}', '[SECRET}', '[TOPSECRET}', '[TOP SECRET}', '[TOP-SECRET}', `
    '{RESTRICTED]', '{SENSITIVE]', '{CONFIDENTIAL]', '{SECRET]', '{TOPSECRET]', '{TOP SECRET]', '{TOP-SECRET]', `
    '[RESTRICTED]', '[SENSITIVE]', '[CONFIDENTIAL]', '[SECRET]', '[TOPSECRET]', '[TOP SECRET]', '[TOP-SECRET]' `
  -RejectMessageReasonText `
    'This message contains a classification tag that cannot be sent externally via email or exceeds the permitted classification level for email. The email has not been delivered. If the classification is not necessary, remove the tag and resend, or use another method to share the information.' `
  -RejectMessageEnhancedStatusCode '5.7.1'


New-TransportRule -Name 'SGE Inbound attachment keyword block rule' `
  -Mode Enforce `
  -RuleErrorAction Defer `
  -SenderAddressLocation HeaderOrEnvelope `
  -FromScope NotInOrganization `
  -AttachmentContainsWords `
    '{RESTRICTED}', '{SENSITIVE}', '{CONFIDENTIAL}', '{SECRET}', '{TOPSECRET}', '{TOP SECRET}', '{TOP-SECRET}', `
    '[RESTRICTED}', '[SENSITIVE}', '[CONFIDENTIAL}', '[SECRET}', '[TOPSECRET}', '[TOP SECRET}', '[TOP-SECRET}', `
    '{RESTRICTED]', '{SENSITIVE]', '{CONFIDENTIAL]', '{SECRET]', '{TOPSECRET]', '{TOP SECRET]', '{TOP-SECRET]', `
    '[RESTRICTED]', '[SENSITIVE]', '[CONFIDENTIAL]', '[SECRET]', '[TOPSECRET]', '[TOP SECRET]', '[TOP-SECRET]' `
  -RejectMessageReasonText `
    'An attachment to this message contains a classification tag that cannot be received by this organization via email. The email has not been delivered. If the classification is not necessary, remove the tag and resend, or use another method to share the information.' `
  -RejectMessageEnhancedStatusCode '5.7.1'


New-TransportRule -Name 'SGE Outbound attachment keyword block rule' `
  -Mode Enforce `
  -RuleErrorAction Defer `
  -SenderAddressLocation HeaderOrEnvelope `
  -SentToScope NotInOrganization `
  -AttachmentContainsWords `
    '{RESTRICTED}', '{SENSITIVE}', '{CONFIDENTIAL}', '{SECRET}', '{TOPSECRET}', '{TOP SECRET}', '{TOP-SECRET}', `
    '[RESTRICTED}', '[SENSITIVE}', '[CONFIDENTIAL}', '[SECRET}', '[TOPSECRET}', '[TOP SECRET}', '[TOP-SECRET}', `
    '{RESTRICTED]', '{SENSITIVE]', '{CONFIDENTIAL]', '{SECRET]', '{TOPSECRET]', '{TOP SECRET]', '{TOP-SECRET]', `
    '[RESTRICTED]', '[SENSITIVE]', '[CONFIDENTIAL]', '[SECRET]', '[TOPSECRET]', '[TOP SECRET]', '[TOP-SECRET]' `
  -RejectMessageReasonText `
    'An attachment to this message contains a classification tag that cannot be sent externally via email or exceeds the permitted classification level for email. The email has not been delivered. If the classification is not necessary, remove the tag and resend, or use another method to share the information.' `
  -RejectMessageEnhancedStatusCode '5.7.1'