Read time: 9 minutes
Summary: To whitelist an email address in Office 365, add the only trusted sender to Microsoft Defender’s Tenant Allow/Block List. You can also use Exchange Admin Center mail flow rules, Outlook Safe Senders, or PowerShell cmdlets as per you need.
Microsoft 365 users get frustrated when they receive business-critical emails from trusted senders in the Junk folder. However, Microsoft 365 provides a layer of protection to bypass such issues, but sometimes they remain the same.
Apart from that, you can set up Microsoft 365 in various ways manually to allow trusted senders and domains, but the right method depends on your specific condition, be it you want to allow one sender, an entire domain, or messages. You can use the Tenant Allow/Block List in Microsoft Defender, Exchange Online mail flow rules, and Outlook Safe Senders. To learn how to whitelist email addresses in Office 365, along with a complete step-by-step process, stay with us.
Whitelist an Email Address in Office 365: What Does It Mean
In Office 365, to whitelist an email address means the process to configure Microsoft 365 accordingly and treat email from a trusted sender as allowed. This can help when authentic or business-centric email messages are incorrectly identified as spam or blocked.
Allowlist is also a term that Microsoft generally uses rather than whitelist. Depending on your own configuration, you can allow:
- A specific email address
- An entire domain
- Messages matching specific conditions
- A sender for an individual Outlook mailbox
Why Are Legitimate Emails Going to Junk in Microsoft 365?
Before creating an allowed entry, identify why the message is being filtered. When processing an email, Microsoft 365 evaluates a multi-layered set of trust and threat signals through Exchange Online Protection (EOP) on various parameters like sender, domain reputation, SPF, DKIM, and DMARC authentication. Some others are:
- Spam characteristics
- Phishing indicators
- Impersonation signals
- Mail flow rules
- Microsoft Defender policies
- Previous sender behavior
If the sender is failing authentication or the message appears suspicious, prefer to fix the underlying issue rather than simply bypassing filtering.
Before You Whitelist an Email Address: Important Security Considerations
Allowlisting should not be treated as a way to bypass every Microsoft 365 security check.
Before you add sender or domain:
- Verify that the sender is genuinely trusted
- Prefer a specific email address over an entire domain when possible
- Avoid permanent exceptions when a temporary allowed entry is sufficient
- Review existing allow and block entries for interference
- Remove outdated domains and senders on a regular basis
Note: Don’t automatically allow its entire domain if only one external address needs to be trusted.
How to Whitelist Email Address in Office 365 using Microsoft Defender
From the Microsoft 365 Defender portal, you can use its tenant Allow/Block List feature to whitelist email addresses in Office 365 at the organization level. Here are the steps to do so:
- Log in to the Microsoft Defender portal with admin credentials.
- Move to Email & collaboration, tap on Policies & rules, then Threat policies.
- Under Rules, select Tenant Allow/Block Lists.
- Now, go to Domains & addresses, tap Add, then tap on Allow.
- Enter the email address you want to whitelist, review the configuration, specify an expiration duration (1 day, 2 days, etc.), and after that, tap on Add.
The entry you’ve made will be saved, and Microsoft 365 will start evaluating messages from that sender.
Should You Whitelist an Entire Domain?
Only do this when there is a clear business reason. For example, a whole email address like abc@example.com is generally more restrictive than allowing only the domain, like example.com.
If a domain contains multiple mailboxes, other addresses under that domain may also receive the benefit of the allow configuration.
For that reason, whitelist email address Office 365 configurations should generally be as specific as practical.
How to Whitelist an Email Address in Exchange Admin Center (Mail Flow Rules)
Exchange Online also allows admins to create mail flow rules when they need more granular control over message processing. Here is how to whitelist an email address in Exchange Admin Center:
- Go to the Exchange Admin Center and sign in with an admin account.
- Select Mail flow, then Rules, click Add a rule (+), and select Create a new rule.
- Enter the Rule name and specify the trusted sender:
Under Apply this rule if, select The sender, then tap on is this person, and enter the email address. After that, tap on Save to add the sender.
- Now set the spam-filtering action:
Under Do the following, select: Modify the message properties, then set the spam confidence level (SCL) to SCL -1 option.
- Add exceptions if necessary and tap on Next.
- Review the remaining rule conditions and choose Next.
- Choose the rule mode that means reviewing the available testing/enforcement options. For a production rule, select the appropriate enforcement option after testing. Then, click Next.
- Check and make sure that the rule condition and rule settings are correct. After that, tap on Finish.
Wait for approx. 30 minutes for the rule to take effect. Once done, send a test email and verify the rule you’ve created.
When Should You Use EAC Mail Flow Rule for Whitelisting Email Address?
Use the EAC mail flow rule to whitelist when you need to:
- Allow email messages from only specific senders under your defined conditions
- Handle messages from a trusted business partner (domain and email address)
How to Whitelist Email in Outlook 365 (Safe Sender Option)
With the Outlook for Web (OWA) Safe Sender option, you can perform Office 365 whitelist email addresses procedure, but it is best for whitelisting only individual mailboxes. You can also identify and authorize trusted senders to send emails through Outlook’s junk email settings. Here are the steps you need to follow:
- Log in to OWA, go to Settings, then Mail > Junk From Safe senders and domains, tap on Add safe sender.
- Enter the email address or domain that you want to whitelist and tap on Save.
However, an Outlook Safe Sender entry is not the same as an organization-wide Microsoft 365 allow entry. For company-wide requirements, admins should use the appropriate Microsoft 365 security or Exchange configuration.
How to Whitelist an Email Address in Office 365 Using PowerShell
Admins need to manage multiple Microsoft 365 environments, so they may prefer PowerShell. Here are the Exchange Online PowerShell cmdlets to manage Tenant Allow/Block List entries.
-
- To install and connect with Exchange Online PowerShell, follow this command:
Install-Module -Name ExchangeOnlineManagement -Force
- Use your global or Exchange administrator credentials.
Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.com
- Add a specific email address to the Allowed Senders list with the command:
Set-HostedContentFilterPolicy -Identity “Default” -AllowedSenders @{Add=”trusteduser@example.com”}
Note: To whitelist an entire domain instead, replace -AllowedSenders with -AllowedSenderDomains @{Add=”example.com”}.
- To create a rule to bypass spam filtering for a specific sender, execute the command:
New-TransportRule -Name “Whitelist – trusteduser@example.com” -From “trusteduser@example.com” -SetSCL -1 -SetAuditSeverity Low
- Finally, disconnect Exchange Online with the command below:
Disconnect-ExchangeOnline -Confirm:$false
- To install and connect with Exchange Online PowerShell, follow this command:
Note: Replace entities with your original data.
Whitelist vs Safe Sender vs Mail Flow Rule
There isn’t one universal Office 365 whitelist email address setting. Microsoft 365 provides several controls. Here is what you should choose to whitelist an email address in Office 365 based on use cases and scope:
| Method for Whitelist | Best suited for | To whom it is needed |
|---|---|---|
| Tenant Allow/Block List | Trusted senders or domains | Organization |
| Mail flow rule | Conditional message processing | Organization |
| Outlook Safe Senders | Individual trusted senders | Individual mailbox |
| PowerShell | Automated administration | Organization |
Conclusion
To whitelist email addresses in Office 365 for organization-wide requirements, start with the appropriate Microsoft Defender allow configuration. Use Exchange Online mail flow rules when you need conditional processing, and Outlook Safe Senders for individual mailboxes.
For mailbox data protection against accidental deletion, security incidents, or other data-loss scenarios, a dedicated Microsoft 365 Backup tool, Kernel Office 365 Backup solution, can help to add another layer of data protection. You get automated backup, a backup scheduling option, and other features that help in your data protection strategies effectively. With authentic and whitelisted business-centric emails along with their effective backups, organizations experience a smooth workflow in every business operation.
Frequently Asked Questions
A: Not always. A domain-wide allow entry can expose your organization to unwanted messages from other addresses within that domain.
A: Check message trace, quarantine, authentication results, mail flow rules, and Microsoft Defender policies. The message may be affected by another control or may have an authentication or phishing-related issue.
