Security Policy Errors

Which EOP Filters Are Bypassed by IP Allow List and SCL -1

Amos Gikunda Oct 10, 2026 868 views

Question details

Exchange administrators need to know the specific anti-spam and content-filtering checks that are skipped when a sender is on the Connection Filtering IP Allow List or receives an SCL value of -1.

Which EOP Filters Are Bypassed by IP Allow List and SCL -1

Product: Exchange Online Protection (EOP)
Device & OS: not provided
Scenario: Administrators are configuring connection filter policies and mail flow rules to ensure trusted senders bypass spam filtering without inadvertently bypassing critical security checks.
Observed behavior: Administrators lack a detailed, policy-by-policy breakdown of which content filters, SPF/DKIM evaluations, and anti-spam checks are bypassed under these specific whitelist conditions.

Before you start

Ensure you have Exchange Administrator or Security Administrator privileges in your Microsoft 365 tenant to access and review Connection Filter and Anti-spam policies in the Microsoft Defender portal.

Solution 1Recommended

Understand IP Allow List and SCL -1 Bypass Rules

Determine the exact behavior of Exchange Online Protection (EOP) when processing messages from allowed IPs or when a mail flow rule applies an SCL of -1.

Exchange Online Protection (EOP) handles spam and content filtering through multiple layers, including connection filtering, content filtering, outbound filtering, and spoof intelligence. When administrators configure specific allow lists, EOP alters its standard processing path.

While Microsoft does not publish an exhaustive, policy-by-policy matrix of skipped checks due to frequent architectural updates, the core bypass behaviors for connection filtering and SCL overrides are well documented.

Evaluate IP Allow List Behavior

When a sending IP address is added to the Connection Filtering IP Allow List, EOP generally bypasses standard spam filtering. However, SPF and DKIM authentication checks may still be evaluated during initial message processing for reporting purposes, even though the spam verdict is overridden.

Analyze SCL -1 Overrides

Assigning a Spam Confidence Level (SCL) value of -1 (typically via an Exchange mail flow rule) specifically instructs EOP to bypass content-filtering checks. This prevents the message from being classified as spam, high-confidence spam, or bulk email based on its content.

Account for Connector and Forest Exceptions

Be aware of documented exceptions. If your deployment receives mail through a Partner Organization inbound connector or routes mail across different Active Directory forests, connection filtering bypasses might not apply universally, requiring SCL -1 mail flow rules instead.

Understand IP Allow List and SCL -1 Bypass Rules

Security Best Practice: Relying purely on IP Allow Lists can expose your organization to spoofing if the IP is shared or compromised. Microsoft recommends using tenant allow/block lists based on sender authentication (like SPF, DKIM, and DMARC) instead of broad IP whitelisting whenever possible.

Free Microsoft Office alternative

Looking for a Lightweight, Secure Office Suite?

While configuring Exchange Online Protection requires complex administrative work in Microsoft 365, your daily document creation doesn't need to be expensive or complicated. WPS Office provides a powerful, free alternative to Microsoft Office, ensuring seamless productivity without the high subscription costs.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Free, lightweight, and incredibly fast to install and launchFamiliar user interface requiring zero learning curve for seamless migrationBuilt-in PDF editing, conversion, and advanced document security tools

microsoft office alternative - wps office

Frequently Asked Questions

Does an SCL value of -1 bypass malware filtering in EOP?

No. An SCL of -1 only bypasses content and spam filtering. Exchange Online Protection (EOP) always scans attachments and links for malware to protect users from malicious payloads, regardless of the SCL value or connection filter settings.

Are SPF and DKIM checks skipped if the sender is on the IP Allow List?

SPF and DKIM authentication checks are typically still evaluated during the initial message processing phase to maintain accurate headers and authentication results. However, the IP Allow List overrides the resulting spam verdict, allowing the message to pass through even if it would normally be flagged for authentication failures.

Why is my IP Allow List not bypassing spam filters for a Partner Organization connector?

There are documented architectural exceptions involving inbound connectors and cross-forest routing in Microsoft 365 that can cause IP Allow Lists to be ignored. In these scenarios, administrators should use Exchange mail flow rules (transport rules) to identify the trusted traffic and explicitly set the SCL to -1.

Microsoft Office Security Issues