Hi,

I have about 70 transport rules defined and one of them blocks the some of messages, but I need to know which one exactly.

The closest I get is information:

EventDescription     : The message was rejected by a rule set at the organization level. For more information, check your organization's Transport rules.

Is ther any report or log that I can see which rule blocked the message.

Thank you!

Hello

with get-messagetracking search to email what is blocked and get-transportrule |fl identity, guid to list rule.
and check blocked email log search eventdata ruleid: and find what is same wit rule guid.

Hi,

We can use the specific date and time or sender, subject to filter the message tracking log and find out emails transactions during that time.

the Transport Rule agent uses the custom-data field in message tracking log to record the GUID of the transport rule or DLP policy that acted on the message. For more information about these Transport Rule agent values, see the "Data logging" section in the DLP policy detection reports topic.

Regards,