Security Policy Errors

How to Add Safe Sender Domains and IP Addresses in Exchange Online

Steve K Oct 19, 2026 868 views

Question details

Administrators need to configure Exchange Online to allow emails from specific domains, email addresses, or IP addresses to bypass spam filtering and ensure reliable delivery.

Product: Exchange Online
Device & OS: not provided
Scenario: Configuring email security policies to allow trusted senders in a corporate environment.
Observed behavior: Valid emails from external partners might be blocked or filtered by default spam policies, requiring administrators to explicitly whitelist domains or IP addresses.

Before you start

Ensure you have global administrator or security administrator permissions in Microsoft 365 to access the Microsoft Defender portal and Exchange Admin Center.

Solution 1Recommended

Add Entries to the Tenant Allow/Block List

The most secure and recommended method by Microsoft for allowing specific domains and email addresses.

Using the Tenant Allow/Block List is Microsoft's top recommendation for managing safe senders. It provides centralized control and overrides spam filters without compromising overall security.

Access the Defender Portal

Navigate to Threat Policies

In the left navigation pane, go to Policies & rules, then select Threat policies.

Open Tenant Allow/Block Lists

Under the Rules section, click on Tenant Allow/Block Lists.

Add Safe Senders

Select the 'Domains & addresses' tab, click the 'Add' icon, and enter the trusted email addresses or domains you want to whitelist.

Add Entries to the Tenant Allow/Block List

Best Practice: This method ensures spoofed senders are still evaluated, maintaining a higher level of security compared to IP allowing.

Solution 2

Create a Mail Flow Rule

Useful for complex scenarios where you need condition-based filtering bypassing.

Solution 3

Update Connection Filter Policies for IP Addresses

Best for explicitly allowing a static IP address or IP range from a trusted source.

Free Microsoft Office alternative

Looking for a Cost-Effective Office Suite?

While managing your organization's Exchange environment, you might be looking to reduce software costs for end-users. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for everyday document tasks.

1. Download the Installer: Visit the official WPS Office website and download the free version for your operating system.
2. Install WPS Office: Run the installer and follow the on-screen instructions to complete the quick installation process.
3. Open Your Documents: Launch WPS Office and start opening, editing, and saving your Microsoft Office files immediately without compatibility issues.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight design ensures fast loading and smooth performance on older hardwareFamiliar user interface requires no learning curve for easy migrationBuilt-in PDF tools for seamless document viewing, editing, and conversion

microsoft office alternative - wps office

Frequently Asked Questions

Why should I use the Tenant Allow/Block List instead of Outlook Safe Senders?

Outlook Safe Senders only apply to individual user mailboxes and do not prevent domain spoofing. The Tenant Allow/Block List provides organization-wide protection, is managed centrally by administrators, and integrates natively with Microsoft Defender's advanced threat filtering.

Does adding a domain to the allow list guarantee email delivery?

While it ensures the email bypasses standard anti-spam filters, messages can still be blocked by strict malware filters or high-confidence phishing policies designed to protect the organization from malicious payloads.

Can end-users add safe senders themselves?

Yes, end-users can add specific email addresses to their personal Outlook Safe Senders list through their Outlook client settings. However, they cannot configure organization-wide bypass rules or modify Exchange connection filter policies.

Microsoft Office Security Issues