Security Policy Errors

Why Identical Spam Messages Are Delivered to Some Users in Microsoft 365

Maira Mehtab Sep 22, 2026 869 views

Question details

Users are experiencing inconsistent spam filtering where identical spam emails are successfully delivered to some Microsoft 365 inboxes while being quarantined for others within the same organization.

Product: Microsoft 365
Device & OS: not provided
Scenario: Investigating email delivery to understand why the same spam message bypasses filters for certain accounts.
Observed behavior: Identical spam messages bypass anti-spam filters for specific users but are successfully quarantined for others, despite appearing in the same message trace.

Before you start

Before troubleshooting, ensure you have global administrator or Exchange administrator privileges in the Microsoft 365 Defender portal to view security policies and run message traces.

Solution 1Recommended

Check and Compare Anti-Spam and Protection Policies

Verify if the affected users fall under different anti-spam policies, security groups, or protection assignments in Microsoft Defender.

Different outcomes for the same message often result from variations in anti-spam settings, spam-filtering policies, or assigned protection capabilities like Microsoft Defender for Office 365 versus standard Exchange Online Protection (EOP).

Access Microsoft 365 Defender

Navigate to Threat Policies

Go to Email & Collaboration in the left menu, select Policies & Rules, and then click on Threat policies.

Compare Anti-spam Policies

Select 'Anti-spam policies' and compare the priority and scope of the assigned policies for both the users who received the spam and those who had it quarantined.

Review Security Group Memberships

Check the assigned Microsoft Defender for Office 365 licenses and security-group memberships to ensure consistent protection levels across all affected users.

Solution 2

Investigate Individual Safe Senders and Mail Flow Rules

Individual mailbox settings or custom mail-flow rules can override tenant-wide spam filters.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Microsoft Office?

While dealing with complex backend Microsoft 365 administrative tasks, your team might also be looking for a fast, reliable, and cost-effective office suite for daily productivity. WPS Office offers a powerful, lightweight alternative.

1. Visit the Official Website: Go to the official WPS Office website on your preferred browser.
2. Download the Installer: Click the 'Free Download' button to safely get the installation file for your operating system.
3. Install the Software: Run the downloaded installation file and follow the simple on-screen instructions.
4. Start Creating: Open WPS Office and start creating or editing your documents seamlessly.

Highly compatible with Microsoft Office formats including Word, Excel, and PowerPoint files.Completely free to use for basic document editing and daily productivity tasks.Lightweight installation that runs smoothly and efficiently on almost any computer.Familiar, user-friendly interface requiring zero learning curve for new users.

microsoft office alternative - wps office

Frequently Asked Questions

Can a user's license affect how spam is filtered in Microsoft 365?

Yes. Users assigned Microsoft Defender for Office 365 Plan 1 or Plan 2 licenses may benefit from advanced threat protection features, which might catch sophisticated spam or phishing attempts that standard Exchange Online Protection (EOP) misses.

Why would a message trace show the same spam email differently for two users?

A message trace reflects the final delivery action for each recipient. If one user has the sender on their Safe Senders list or falls under a specific mail-flow rule that bypasses spam filtering, the trace will show successful delivery for them while showing a quarantine action for the others.

What data should I collect if I need to escalate a spam delivery issue to support?

You should collect the message headers, extended message traces, affected user account details, license information, and group memberships. Ensure you only share this sensitive data through an approved private Microsoft support channel.

Microsoft Office Security Issues