I want to set up a rule that will block outgoing email when it includes domains person@a.com and person@b.com as recipients. However, I want email that goes to just person@a.com to be allowed as well as well as a separate email to person@b.com

This needs to work regardless of other email addresses included on the email (e.g. allow person@a.com , test@test.com),  (block person@a.com, person@b.com , test@test.com).

It also needs to work regardless of if they are on the to line or cc line, but ignore instances of the emails in the body of the message.

Finally, I'd like this to work for subdomains as well without needing to specify them (e.g. person2@test.a.com is blocked)

Just for clarity, it shouldn't block (email to person@a.com, person2@a.com, person3@test.a.com) but (block person@a.com, person2@a.com, person2@b.com)

I can't quite make it work in 2013 - it feels like I need to use a predicate I'd rather not, as the same one isn't allowed twice. I tried the recipients address contains anded with the recipient domain is but it didn't seem to work.

Any thoughts?

Hi,

Office 365 Email Anti-Spam Protection should suit your needs.

https://support.office.com/en-us/article/Office-365-Email-Anti-Spam-Protection-6a601501-a6a8-4559-b2e7-56b59c96a586?ui=en-US&rs=en-US&ad=US

To block the outgoing email sent to specific domains, see this document

https://technet.microsoft.com/en-us/library/jj200737(v=exchg.150).aspx

Best Regards.