Security Policy Errors

How to Troubleshoot an Oversensitive Exchange Online Spam Filter

Nimra Malik Sep 28, 2026 869 views

Question details

Users are experiencing issues where legitimate external emails are incorrectly classified as spam and sent to the Junk Email folder.

How to Troubleshoot an Oversensitive Exchange Online Spam Filter

Product: Microsoft Exchange Online
Device & OS: not provided
Scenario: An organization needs to receive external communications reliably without them being constantly routed to user Junk Email folders.
Observed behavior: Most external messages are aggressively flagged as spam, causing employees who rarely check their Junk folders to miss important emails.

Before you start

Ensure you have Exchange Administrator or Global Administrator privileges in your Microsoft 365 tenant to access and modify anti-spam policies.

Solution 1Recommended

Adjust Anti-Spam Policies in Microsoft Defender

Reviewing and modifying your default anti-spam policies helps recalibrate the Spam Confidence Level (SCL) to prevent false positives.

Microsoft 365 provides default anti-spam policies that might be too aggressive for certain organizations. Adjusting the bulk email thresholds and spam actions can significantly reduce false positives.

Access Microsoft Defender

Log in to the Microsoft 365 Defender portal at security.microsoft.com and navigate to 'Email & collaboration' > 'Policies & rules'.

Open Anti-spam settings

Click on 'Threat policies' and then select 'Anti-spam' under the Policies section to view your active rules.

Modify the default policy

Select the 'Anti-spam inbound policy (Default)' from the list. Click 'Edit actions' at the bottom of the flyout pane to adjust the specific spam and high-confidence spam actions.

Adjust Spam Confidence Level (SCL)

Scroll to the 'Bulk email threshold (BCL)' setting. Ensure the BCL is not set too strictly; a value of 7 is generally recommended by Microsoft. Review the actions taken for different SCL ratings and save your changes.

Adjust Anti-Spam Policies in Microsoft Defender

Custom Policies: If modifying the default policy affects too many users, consider creating a custom anti-spam policy tailored for specific user groups or partner domains.

Solution 2

Review Quarantine Reports and Allow Sender Lists

Analyzing quarantine data allows administrators to identify blocked patterns and whitelist legitimate domains.

Free Microsoft Office alternative

Enhance Your Daily Productivity with WPS Office

While managing server-side Exchange email filtering requires Microsoft 365 administrator access, handling the actual document attachments you receive shouldn't be a hassle. WPS Office offers a powerful, lightweight, and fully compatible alternative to Microsoft Office, helping you easily open, edit, and share documents received via email.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the software: Run the downloaded installer and follow the simple on-screen instructions to set up WPS Office on your computer.
3. Open email attachments: Launch WPS Office or set it as your default application to instantly open and edit any Word, Excel, or PowerPoint files you receive in your inbox.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx) for seamless handling of email attachments.Lightweight design ensures smooth performance on any PC, Mac, or mobile device.Familiar user interface minimizes the learning curve, letting you work immediately.Built-in PDF editor and comprehensive toolkit available completely for free.

microsoft office alternative - wps office

Frequently Asked Questions

What is the recommended Bulk Complaint Level (BCL) in Exchange Online?

Microsoft generally recommends a default BCL threshold of 7. Lowering this value makes the spam filter more aggressive, which can frequently lead to legitimate bulk emails, such as newsletters, being erroneously marked as spam.

How can end-users prevent specific external emails from going to Junk?

End-users can open their Junk Email folder in Outlook, right-click the incorrectly flagged legitimate message, and select 'Junk' > 'Not Junk'. This helps train the Exchange filter and automatically adds the sender to the user's Safe Senders list.

Why are internal emails sometimes marked as spam in Microsoft 365?

Internal emails usually bypass standard spam filtering. If they are marked as spam, it is often due to misconfigured Exchange mail flow rules, domain spoofing protection (SPF/DKIM/DMARC) failures on internal routing, or a compromised internal user account.

Can I create different spam policies for different departments?

Yes, administrators can create custom anti-spam policies in the Microsoft 365 Defender portal and apply them to specific users, groups, or domains to accommodate varying security needs across different departments.

Microsoft Office Security Issues