Microsoft Allow Lists and Safe Senders

Secure Email Threat Defense honors senders and domains added to your spam filter allow lists in Microsoft 365 for Spam and Graymail messages. MS Allow lists are honored for BEC and Scam verdicts but not for Malicious or Phishing verdicts. For more information, see Secure Email Threat Defense and Microsoft 365.

Microsoft Allow lists are not always honored by Secure Email Threat Defense if your organization allows individual users to configure allow lists in their mailbox and a message happens to fall in a user’s allow list. If you want Secure Email Threat Defense to honor these settings, deselect the Apply policy to Microsoft Safe Sender messages checkbox on the Configuration > Global settings > Unwanted message analysis panel.

Safe Sender flags are respected for Spam and Graymail verdicts, but are not respected for Threat verdicts. A Microsoft Safe Sender match does not stop Secure Email Threat Defense analysis; the message is still analyzed and assigned a verdict.

Safe Sender messages with Spam or Graymail verdicts are not remediated unless an applicable Policy Exception also matches the message and specifies an action for that verdict category. In that case, Secure Email Threat Defense applies the Policy Exception action instead of the Safe Sender allowance.

Safe Sender handling differs from Global Message Bypass: Safe Sender messages are still analyzed, whereas Global Message Bypass stops Secure Email Threat Defense analysis.