Send & Receive Issues

How to Detect Messages Moved to Junk Email in Exchange Online

Algirdas Jasaitis Oct 12, 2026 869 views

Question details

Administrators need a way to receive notifications or track messages when they are delivered to users' Junk Email folders in Exchange Online.

How to Detect Messages Moved to Junk Email in Exchange Online

Product: Exchange Online
Device & OS: not provided
Scenario: Monitoring spam filtering behavior and ensuring legitimate organizational emails are not getting lost in individual user junk folders.
Observed behavior: Exchange Online does not send administrator notifications for messages routed to user Junk Email folders; quarantine notifications only apply to emails actively held in quarantine.

Before you start

Ensure you have Exchange Administrator permissions in the Microsoft 365 Defender or Exchange admin center to create and modify mail-flow rules.

Solution 1Recommended

Create a Mail-Flow Rule Using Spam Confidence Level (SCL)

Since direct junk notifications are unavailable, configuring a mail-flow rule based on SCL scores allows administrators to intercept or receive incident alerts for suspected spam before it reaches the user's Junk folder.

Exchange Online Protection (EOP) assigns a Spam Confidence Level (SCL) to all incoming messages. An SCL of 5 or 6 typically flags a message as spam and routes it to the Junk folder.

By setting up a mail-flow rule targeting these specific SCL values, administrators can trigger custom actions such as generating an incident report.

Access the Exchange Admin Center

Log in to the Microsoft 365 Exchange admin center using your administrator credentials and navigate to 'Mail flow' > 'Rules' from the left-hand menu.

Create a New Rule

Click the '+' icon or 'Add a rule' and select 'Create a new rule'. Provide a descriptive name for the rule, such as 'SCL Monitor for Junk Email'.

Set the SCL Condition

Under 'Apply this rule if', select 'The spam confidence level (SCL) is' and set the condition to 'greater than or equal to 5' (or your preferred threshold for junk mail).

Configure the Notification Action

Under 'Do the following', select 'Generate incident report and send it to' or 'Bcc the message to', and specify the designated administrator email address.

Save and Enable

Review the rule settings, ensure the rule mode is set to 'Enforce', and click 'Save'. The rule may take a short time to propagate across the tenant.

Create a Mail-Flow Rule Using Spam Confidence Level (SCL)

Manual Review is Still Required: Even with this rule in place, users should be encouraged to manually review their Junk Email folders periodically and mark legitimate emails as 'Not Junk' to train the filter.

Solution 2

Disable Desktop Alerts for Messages Moved to Junk

If you are experiencing the secondary issue of receiving unwanted system tray notifications every time a message is automatically moved to your Junk Email folder, you can modify Outlook client settings.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Manage Your Documents?

While WPS Office does not manage Microsoft Exchange mail servers, it provides a powerful, free, and lightweight alternative to Microsoft Office for creating and editing documents, spreadsheets, and presentations with full format compatibility.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the on-screen instructions to quickly set up the software.
3. Open Your Office Files: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint files without losing any formatting.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight design ensures fast startup and smooth operation even on older devices.Familiar and intuitive user interface requires zero learning curve for Office users.Built-in PDF tools for reading, editing, and converting documents seamlessly.

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't Exchange Online notify admins when emails go to a user's Junk folder?

Exchange Online treats user-level Junk Email filtering as a personal mailbox action. Administrator notifications (quarantine alerts) are reserved for organization-wide security threats like malware or high-confidence phishing.

What does a Spam Confidence Level (SCL) of 5 mean?

An SCL of 5 or 6 indicates suspected spam. By default, Exchange Online Protection (EOP) routes messages with these scores directly to the recipient's Junk Email folder instead of the inbox.

Can end-users recover emails sent to the Junk folder?

Yes. Users can open their Junk Email folder in Outlook, right-click a legitimate message, and select 'Junk' > 'Not Junk'. This moves the message to the inbox and adds the sender to their Safe Senders list.

Will an incident report rule prevent emails from reaching the Junk folder?

No, an incident report or BCC rule simply sends a copy or alert to the designated administrator. The original message will continue its regular mail flow to the user's Junk folder unless a specific 'redirect' action is also applied.

Outlook & Email Problems