Security Policy Errors

How to Enable the First-Contact Safety Tip with an Exchange Transport Rule

Steve K Oct 13, 2026 869 views

Question details

The administrator needs to enable the first-contact safety tip in Microsoft 365 and wants to know if its appearance can be customized.

How to Enable the First-Contact Safety Tip with an Exchange Transport Rule

Product: Microsoft 365 / Exchange Online
Device & OS: not provided
Scenario: Configuring email security policies to alert end-users when receiving an email from an unfamiliar external sender.
Observed behavior: The first-contact safety tip needs to be applied to incoming messages, but administrators are unsure how to enable it and whether they can change its gray color and font.

Before you start

Ensure you have the appropriate Administrator permissions in the Microsoft Defender portal and Exchange admin center to modify threat policies and mail flow rules.

Solution 1Recommended

Enable via Anti-Phishing Policies in Microsoft Defender

The most straightforward method to enable the first-contact safety tip is through the Microsoft Defender portal's built-in threat policies.

Using the Microsoft Defender portal allows you to manage the safety tip as part of your broader anti-phishing strategy without dealing with raw message headers.

Navigate to Threat Policies

Log in to the Microsoft Defender portal. In the left navigation pane, go to Email & collaboration > Policies & rules > Threat policies.

Open Anti-Phishing Policies

Under the Policies section, click on Anti-phishing to view your organization's anti-phishing configurations.

Enable the Safety Tip

Select the policy you want to modify (or create a new one). Edit the settings to toggle the 'First contact safety tip' to enabled, and save your changes.

Enable via Anti-Phishing Policies in Microsoft Defender

Policy Application Time: It may take a short amount of time for the new policy settings to propagate and take effect across your tenant.

Solution 2

Enable via Exchange Mail Flow Rule (Transport Rule)

If you need more granular control over which external messages trigger the safety tip, you can use an Exchange transport rule.

Solution 3

Addressing Appearance Customization Limits

Understanding the current limitations regarding the visual appearance of the first-contact safety tip.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Suite? Try WPS Office

While managing Exchange email security rules is handled strictly within Microsoft 365, users handling daily document creation, spreadsheets, and presentations can greatly benefit from WPS Office. It is a free, lightweight, and highly compatible alternative to Microsoft Office.

1. Visit the Official Website: Go to the official WPS Office website on your preferred device.
2. Download the Free Version: Click the 'Free Download' button to get the latest version tailored for your operating system.
3. Install and Work: Run the installer and immediately start creating, editing, and securing your documents.

Seamlessly compatible with Microsoft Office formats, including Word, Excel, and PowerPoint files.Lightweight installation ensures fast startup times and smooth performance on Windows, Mac, and Linux.Includes robust built-in PDF editing and reliable document protection features to secure sensitive local files.

Frequently Asked Questions

Can I change the gray background color of the first-contact safety tip?

Currently, Microsoft does not support customizing the visual appearance, including the gray color and font, of the first-contact safety tip. You can submit feedback in the Microsoft 365 admin center to formally request this feature.

What is the primary purpose of the first-contact safety tip?

It serves as a visual alert for recipients when they receive an email from an external sender address they have never communicated with before. This helps users pause and verify the sender's identity, preventing potential phishing and impersonation attacks.

Will enabling the safety tip via transport rule override my anti-phishing policies?

Using the transport rule approach (adding the X-MS-Exchange-EnableFirstContactSafetyTip header) is an alternative way to enable the tip. It does not override anti-phishing policies but acts as a secondary method for organizations that prefer routing condition-based triggers over standard threat policies.

Microsoft Office Security Issues