type.inbound
and sender.email.email == "no-reply@sharepointonline.com"
and length(recipients.to) > 40 // You may want to adjust this threshold if 40 is too aggressive
and any(recipients.to, .email.domain.domain in $free_email_providers)
and sender.display_name not in $org_display_names
Playground
Test against your own EMLs or sample data.