Security Policy Errors

How to Modify Anti-Spam Policies in Microsoft 365 Defender

Adam Davis Oct 20, 2026 868 views

Question details

The user needs to modify Microsoft 365 Defender anti-spam policies because messages from an approved sender are continuously being quarantined.

How to Modify an Anti-Spam Policy in Microsoft 365 Defender

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Legitimate emails from a known sender are being blocked and sent to quarantine despite being explicitly added to an allow-list.
Observed behavior: The messages are receiving a High Confidence Phish verdict, causing the standard anti-spam allow-list to be bypassed and the emails to be blocked.

Before you start

Ensure you have administrator access to the Microsoft 365 Defender portal and have verified that the quarantined message is genuinely from a trusted source before adjusting security rules.

Solution 1Recommended

Edit Allowed Senders and Domains in Anti-Spam Policies

Use this method to manually add trusted email addresses or domains to your anti-spam allow list via the Microsoft Defender portal.

Adding a sender or domain to your anti-spam policy allow-list ensures that standard spam filtering does not block their messages. However, this will not bypass high-confidence malware or phishing filters.

Access the Microsoft Defender Portal

Open your web browser, navigate to https://security.microsoft.com, and sign in using your administrator credentials.

Navigate to Threat Policies

On the left navigation menu, click on 'Email & collaboration', then select 'Policies & rules'. From there, click on 'Threat policies'.

Edit Anti-Spam Policies

Under the Threat policies section, select 'Anti-spam policies'. Click on the specific active policy you want to modify to open its details pane.

Update Allowed Senders

Scroll down to locate the settings for allowed senders and domains. Click 'Edit allowed and blocked senders and domains', add the required email addresses or domains, and save your changes.

Edit Allowed Senders and Domains in Anti-Spam Policies

Solution 2

Resolve High Confidence Phish Quarantines

If messages are still blocked after updating the allow-list, you must address the specific 'High Confidence Phish' verdict.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Suite?

While enterprise email routing and security policies are managed through domain administrators, everyday document processing requires a fast, secure, and reliable office suite. WPS Office provides a free, lightweight alternative to Microsoft Office that is fully compatible with your existing workflows.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the Application: Run the installer and follow the simple on-screen instructions to set up WPS Office on your computer.
3. Open Your Documents: Launch WPS Office and instantly open your existing .docx, .xlsx, or .pptx files with full formatting support.

Seamless compatibility with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture ensures fast performance even on older hardware.Built-in PDF reader and editor for secure document handling without extra software.Familiar user interface makes transitioning easy with zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Why are allowed senders still quarantined as 'High Confidence Phish'?

Microsoft 365 prioritizes phishing protection over standard anti-spam allow lists. Because phishing poses a severe security risk, 'High Confidence Phish' verdicts automatically bypass standard allow entries to protect end users.

How do I prevent legitimate emails from being marked as phishing?

If legitimate emails are incorrectly flagged, administrators should submit the quarantined messages to Microsoft as false positives. Over time, this trains the Microsoft Defender filters to correctly identify and deliver these emails.

Is it safe to add an entire domain to the anti-spam allow-list?

It is generally not recommended to allow an entire domain unless it is fully trusted and a security assessment has been performed. If any account within a whitelisted domain becomes compromised, malicious emails could bypass your organization's security filters.

Do Microsoft 365 Defender policies have a priority order?

Yes, Microsoft 365 processes security policies based on their assigned priority level. If a higher-priority policy blocks a message, it will override any allow-list entries configured in lower-priority anti-spam policies.

Microsoft Office Security Issues