How to Fix Legitimate Microsoft 365 Emails Marked as Spam
Question details
Users are experiencing a sudden increase in legitimate internal and external emails being incorrectly classified as spam or phishing.
- Product
- Microsoft 365 / Exchange Online
- Device & OS
- not provided
- Scenario
- Sending and receiving regular business emails containing links to internal portals or trusted external websites.
- Observed behavior
- Emails are intercepted by Microsoft Defender for Office 365 and flagged as spam or phishing due to false positives in the malicious URL reputation checks.
Ensure you have Exchange Administrator or Global Administrator permissions in your Microsoft 365 tenant to access the Defender portal and modify security policies.
Exclude Trusted URLs in Safe Links Policies
Prevent Microsoft Defender from rewriting and falsely flagging known safe URLs by adding them to your exclusion list.
Microsoft Defender for Office 365 uses Safe Links to proactively protect users from malicious URLs. Occasionally, legitimate internal or partner URLs are mistakenly assigned a poor reputation, causing the emails containing them to be marked as spam. Excluding these URLs prevents them from being rewritten and blocked.
Log in to the Microsoft 365 Defender portal and navigate to 'Policies & rules' under the Email & collaboration section.
Click on 'Threat policies', then select 'Safe Links' under the Policies section.
Select your active Safe Links policy from the list and click 'Edit protection settings'.
Scroll down to the 'Do not rewrite the following URLs' section. Enter the trusted internal or external URLs that are causing the spam classification and click 'Save'.
Run an Extended Message Trace
Analyze email routing details and spam confidence levels (SCL) to confirm exactly why an email was classified as spam.
Submit Legitimate URLs for Microsoft Analysis
Report URL false positives directly to Microsoft to help permanently fix the reputation scoring in their security database.
Looking for a Lightweight, Cost-Effective Office Suite?
Enterprise-level email and administration like Microsoft 365 can be complex and expensive. If your primary need is robust desktop software for documents, spreadsheets, and presentations without the administrative overhead, WPS Office is an exceptional free alternative. It offers powerful productivity tools offline, bypassing the complexity of cloud-managed security policies.
- 1. Download the Installer: Visit the official WPS Office website and click 'Free Download' to get the installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the quick on-screen instructions to install the suite on your device.
- 3. Open Your Documents: Launch WPS Office and directly open any existing Microsoft Office files—no complex configuration required.
Frequently Asked Questions
How long does it take for a Safe Links policy update to take effect?
It can take up to 24 hours for Microsoft Defender policy changes, including Safe Links URL exclusions, to fully propagate and take effect across all servers globally in your tenant.
Why would an internal company URL be suddenly flagged as malicious?
Internal URLs can be flagged if a recently compromised account sent out spam containing the link, if the domain shares infrastructure with known bad actors, or if automated systems mistakenly identify the URL patterns as similar to known phishing sites.
Can I bypass Microsoft 365 spam filtering for specific senders entirely?
Yes, administrators can configure Exchange mail flow rules (transport rules) to assign a Spam Confidence Level (SCL) of -1 to emails from specific domains or IP addresses, effectively bypassing the spam filter. However, this should only be done for highly trusted sources.
