How to Stop Legitimate Emails Going to Junk in Outlook by Adding Safe Senders (Exchange Online)
This issue typically arises due to spam filtering policies, user-level junk settings, or sender reputation signals within Exchange Online Protection (EOP). This guide covers four ways to fix it, from a quick personal fix to a tenant-wide solution.
🔍 The Symptoms
⚠️ What You May Experience
Emails from a trusted sender are consistently delivered to the Junk Email folder instead of the Inbox, despite being legitimate and expected.
🧠 Root Cause
💡 Why Legitimate Emails Get Misclassified
This behaviour occurs when Exchange Online’s filtering layers classify the email as suspicious based on signals such as:
- Sender reputation or lack of authentication (SPF, DKIM, DMARC)
- Content filtering rules
- Organisation anti-spam policies
- User-level block/safe list configurations
Even trusted senders can be misclassified if these checks are not aligned correctly.
🛠️ Step-by-Step Resolution
Method 1 — Add Safe Sender (User-Level, Outlook)
The quickest fix for a single user — works in both Outlook Web and the desktop app.
✅ Option A — Outlook Web (OWA)
- Log in to Outlook Web App at outlook.office.com
- Click the Settings (⚙️) icon
- Select Mail → Junk email
- Under Safe senders and domains, click Add
- Enter the sender’s email address (e.g.,
example@domain.com) - Click Save
✅ Option B — Outlook Desktop App
- Open Outlook
- Navigate to Home → Junk → Junk E-mail Options
- Go to the Safe Senders tab
- Click Add
- Enter the sender’s email address or domain
- Click OK and apply changes
Method 2 — Add Safe Sender via Exchange Online (Admin-Level)
If multiple users are affected, configure the Safe Senders list centrally via PowerShell instead of asking each user to do it manually.
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com # Add a sender to a mailbox's Safe Senders list Set-MailboxJunkEmailConfiguration -Identity user@yourdomain.com -TrustedSendersAndDomains @{Add="sender@domain.com"}
Method 3 — Allow Sender via Tenant Allow/Block List
For organisation-wide delivery assurance, add the sender to the tenant-level Allow list — this overrides per-mailbox settings and applies to every user.
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com New-TenantAllowBlockListItems -ListType Sender -Allow -Entries "sender@domain.com" -NoExpiration
💡 When to Use This Method
This is the most reliable fix for production-critical senders — such as vendor invoice systems or automated licence notifications — since it applies tenant-wide regardless of individual mailbox configurations.
Method 4 — Review Anti-Spam Policies (Microsoft Defender Portal)
If the issue affects a whole domain or a pattern of senders, review and adjust the inbound anti-spam policy directly.
✅ GUI Method
- Go to Microsoft Defender Portal at security.microsoft.com
- Navigate to Email & Collaboration → Policies & Rules → Threat Policies → Anti-Spam
- Edit the relevant inbound policy
- Configure Allowed senders and/or Allowed domains
- Save changes
💡 Best Practices & Recommendations
- Ensure the sender domain has proper SPF, DKIM, and DMARC configuration — this is often the root cause and fixing it prevents future misclassification
- Prefer Admin-level allow rules (Methods 2–4) for business-critical senders instead of relying only on individual user settings
- Regularly monitor the Quarantine and Message Trace in the Defender Portal to verify mail flow behaviour over time
- For production environments — such as vendor invoices or automated licence notifications — implement the Tenant Allow list for consistency across all users
✅ Key Takeaway
For a single affected user, the OWA or Outlook desktop Safe Senders list is the fastest fix. For recurring or organisation-wide issues — especially with business-critical senders — the Tenant Allow/Block List is the most reliable and consistent solution.
📚 References & Further Reading
- 🔗 Tenant Allow/Block List in Microsoft 365 — Microsoft Learn
- 🔗 Configure anti-spam policies in EOP — Microsoft Learn