Send & Receive Issues

How to Block Spam from Changing IP Addresses in Microsoft 365

Muhammad Talha Oct 21, 2026 868 views

Question details

The user needs to stop incoming spam emails sent from rotating or shared IP addresses without accidentally blocking legitimate emails.

How to Block Spam from Changing IP Addresses in Microsoft 365

Product: Microsoft 365
Device & OS: not provided
Scenario: Managing inbound email security and configuring spam filters to handle persistent spammers who use dynamic infrastructure.
Observed behavior: Standard IP blocking fails because senders constantly change IPs or use shared cloud mail servers, and broad IP blocks inadvertently reject valid messages.

Before you start

Ensure you have Exchange Administrator or Security Administrator permissions in Microsoft 365 to access the Defender portal and Exchange admin center.

Solution 1Recommended

Use the Tenant Allow/Block List and Anti-Spam Policies

This is the most effective method for blocking persistent spam from changing IPs by targeting specific sender domains or email addresses instead of network infrastructure.

Blocking domains or exact sender addresses is much safer than blocking IP addresses, especially when the spam originates from shared services like Outlook.com or Gmail.

Access the Defender Portal

Open Tenant Allow/Block Lists

Under the Rules section, click on Tenant Allow/Block Lists and navigate to the Blocked tab.

Add Block Entries

Click the '+' icon to add the specific spammer email addresses or domains to the block list. Choose the option to block the sender from reaching your organization.

Update Anti-Spam Policies

Alternatively, return to Threat policies, click Anti-spam policies, edit your default inbound policy, and add the malicious senders to the blocked senders and domains list.

Use the Tenant Allow/Block List and Anti-Spam Policies

Best Practice: Relying on the Tenant Allow/Block List helps maintain deliverability for legitimate emails coming from the same shared IP spaces used by spammers.

Solution 2

Configure Spam Confidence Level (SCL) Rules

Create mail flow rules to automatically quarantine messages that Microsoft 365's backend detects as highly suspicious, bypassing the need to block specific IPs manually.

Solution 3

Add Static Malicious IPs to the Connection Filter

Use this method only if you have confirmed that a specific IP address is completely malicious and not part of a shared email service.

Free Microsoft Office alternative

Enhance Your Productivity with WPS Office

While resolving Microsoft 365 spam and administrative issues, you might also be looking for ways to streamline your organization's document management. WPS Office is a powerful, lightweight alternative to Microsoft 365 desktop apps, offering full compatibility with Word, Excel, and PowerPoint files at no cost.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Install the Software: Run the downloaded installer file and follow the on-screen prompts to complete the setup.
3. Open Your Documents: Launch WPS Office and instantly open your existing Microsoft Office files with full formatting support.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Free and lightweight alternative without expensive recurring subscription fees.Features a familiar, user-friendly interface that minimizes the learning curve.Includes comprehensive built-in PDF viewing, editing, and conversion tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why shouldn't I block IP addresses from Gmail or Outlook.com?

Cloud email providers use a shared pool of IP addresses. If you block an IP address currently being used by a spammer on Gmail, you will also block all legitimate emails coming from normal users who happen to be routed through that same IP.

How can I check the Spam Confidence Level (SCL) of an email?

You can view the SCL by inspecting the message headers of the received email. Look for the 'X-MS-Exchange-Organization-SCL' header; a value of 5, 6, 8, or 9 indicates the message was identified as spam.

What is the difference between Outlook Blocked Senders and the Tenant Allow/Block List?

Outlook Blocked Senders is a user-level setting that only moves emails to the individual's Junk Email folder. The Tenant Allow/Block List is an admin-level feature that blocks the spammer globally from reaching anyone in your organization.

Can mail flow rules block spam based on keywords?

Yes. If spammers are using rotating IPs and domains but sending the same payload, you can create a mail flow rule in the Exchange admin center to identify specific keywords or phrases in the subject or body and automatically route those messages to quarantine.

Outlook & Email Problems