Security Policy Errors

How to Allowlist a Delayed Email in Microsoft 365 Security

Chanuka Geekiyanage Sep 30, 2026 868 views

Question details

The administrator needs to locate and release a time-sensitive email (such as banking or verification codes) delayed by Microsoft 365 security, and configure rules to allow it in the future.

How to Allowlist a Delayed Email in Microsoft 365 Security

Product: Microsoft 365
Device & OS: not provided
Scenario: A critical, urgent email is blocked or delayed by Microsoft 365 security filters, and the IT admin must release it and prevent future delays for this trusted sender.
Observed behavior: Time-sensitive emails are not delivered to the user's inbox promptly because they are intercepted by mail-flow rules or Microsoft Defender quarantine.

Before you start

Ensure you have Exchange Administrator or Security Administrator privileges in your Microsoft 365 tenant, as you will need elevated permissions to access the Defender portal and modify mail-flow configurations.

Solution 1Recommended

Investigate and Allowlist via Microsoft Defender for Office 365

Use Message Trace and Quarantine features in Microsoft Defender to find the delayed email, release it safely, and add the sender to the Tenant Allow/Block List.

Instead of globally disabling spam or phishing protections, administrators should identify exactly where the email was stopped and create a narrowly scoped exception for that specific sender.

Run a Message Trace

Go to the Exchange admin center, navigate to 'Mail flow' > 'Message trace'. Search for the sender's email address and the recipient to see exactly where the email was delayed or if it was quarantined by a specific rule.

Check Microsoft Defender Quarantine

Open the Microsoft Defender portal, navigate to 'Email & Collaboration' > 'Review', and select 'Quarantine'. Search for the missing email within the quarantined items.

Release the Quarantined Email

Select the delayed message. After verifying that it is a legitimate email, click the 'Release email' button to deliver it to the recipient's inbox.

Add Sender to Tenant Allow/Block List

In the Defender portal, go to 'Policies & rules' > 'Threat policies' > 'Tenant Allow/Block Lists'. Add the specific sender's email address or verified domain to prevent future delays for their urgent messages.

Investigate and Allowlist via Microsoft Defender for Office 365

Security Best Practice: Avoid disabling anti-spam or anti-phishing policies broadly. Always use a narrowly scoped allow entry specifically for the verified sender to maintain your organization's security posture.

Free Microsoft Office alternative

Switch to WPS Office for a Lightweight and Free Alternative

While Microsoft 365 manages enterprise server configurations and email security, its software subscriptions can be expensive and complex. If you just need powerful, reliable, and user-friendly desktop applications for your documents, spreadsheets, and presentations, WPS Office is an excellent free alternative.

1. Visit the WPS Office Website: Open your browser and go to the official WPS Office website to find the free download link.
2. Download the Installer: Click on the 'Free Download' button to get the setup file for your respective operating system.
3. Install and Start Using: Run the downloaded installer, follow the simple on-screen instructions, and launch the suite to start working immediately.

Seamlessly open, edit, and save Microsoft Word, Excel, and PowerPoint files without formatting loss.Completely free to use with a lightweight installer that saves local system resources.Familiar, intuitive user interface that guarantees a seamless migration with zero learning curve.Built-in PDF reader and editor for comprehensive document management.

microsoft office alternative - wps office

Frequently Asked Questions

Why do time-sensitive emails like banking verifications get delayed in Microsoft 365?

Emails from automated systems often get delayed if they fail email authentication checks like SPF, DKIM, or DMARC. Microsoft Defender flags these as potential spoofing or spam and routes them to quarantine to protect the user.

Can end-users release their own delayed emails from quarantine?

It depends on the organization's quarantine policies. Administrators can configure settings to allow users to review and request the release of certain messages, though high-confidence phishing emails usually require admin approval.

Is it safe to allowlist an entire domain to prevent delays?

No, whitelisting an entire domain (especially generic public ones like Yahoo or Gmail) bypasses critical security checks and exposes the organization to spoofing attacks. You should always use a narrowly scoped allow entry for the specific sending address.

How long does a Message Trace take to find a delayed email?

For emails sent within the past 7 days, a Message Trace typically returns results within a few minutes, allowing administrators to quickly diagnose why an urgent message is not appearing in the inbox.

Microsoft Office Security Issues