If you're not receiving expected emails or attachments from a trusted sender, Microsoft 365’s default spam and security filters might be flagging them. Use the steps below to whitelist the sender and create mail flow rules to reduce enforcement actions.
Purpose
This article outlines how to:
Mark a specific email address or domain as a safe sender
Create a mail flow rule in Microsoft 365 to bypass attachment scanning
These steps are helpful when you trust a sender and want to ensure their messages and attachments are not quarantined or blocked by Microsoft Defender for Office 365.
Step 1: Add the Sender or Domain to the Allowed List
How-To:
Go to the Microsoft 365 Defender Portal
Navigate to:
nginx
Email & collaboration > Policies & rules > Threat policies > Anti-spam policiesUnder Spam filter policies, select the policy you want to modify (e.g., "Default").
Click Edit allowed and blocked senders and domains.
Under Allowed domains and senders, click + Add to include:
A specific email address (e.g.,
[email protected])Or an entire domain (e.g.,
domain.com)
Click Save.
Step 2: Create a Mail Flow Rule to Bypass Attachment Scanning
How-To:
Go to the Exchange Admin Center (EAC)
Navigate to:
css
Mail flow > RulesClick + Add a rule > Create a new rule.
Name the rule, e.g.:
pgsql
Bypass Attachment Scanning for Trusted SenderConfigure the rule conditions:
Apply this rule if:
The sender is → select the trusted email address
or
The sender domain is → select the trusted domain
Do the following:
Modify the message properties → set a message header
Header name:
X-MS-Exchange-Organization-SkipSafeAttachmentProcessingValue:
1
Add another action:
Modify the message properties → set a message header
Header name:
X-MS-Exchange-Organization-SkipSafeAttachmentFilteringValue:
1
(Optional but recommended): Add more conditions like:
Subject or body contains specific keywords
Click Save.
Additional Notes
These rules bypass Safe Attachment scanning in Microsoft Defender for Office 365.
Only apply these rules to senders you completely trust.
To also bypass Safe Links, add the following header:
Header name:
X-MS-Exchange-Organization-SkipSafeLinksProcessingValue:
1
Summary Table
Action | Location | Description |
Mark sender as safe | Microsoft 365 Defender Portal | Adds sender or domain to the allowed list |
Bypass scanning | Exchange Admin Center (Mail Flow > Rules) | Mail flow rule modifies headers to skip scanning |