Advanced Computer Solutions

ACS Blog

How to Whitelist an Email Address in Exchange Admin Center

| IT Fixes

Who This Affects and What It Fixes

This guide is for small-business employees or administrators whose Microsoft 365 environment is incorrectly flagging legitimate emails as spam. By creating a mail flow rule in the Exchange Admin Center (EAC), you can tell Microsoft 365 to bypass spam filtering for a specific sender, ensuring their messages reach your inbox reliably.

Before You Begin

Use caution when whitelisting email addresses. Doing so bypasses certain security checks for that sender. Only whitelist addresses you fully trust, and plan to review your whitelist periodically to keep your environment secure.

Step-by-Step: Whitelisting an Email Address

1. Access the Exchange Admin Center

  1. Log in to your Microsoft 365 Admin account.
  2. In the left-hand navigation, select Admin Centers, then choose Exchange to open the Exchange Admin Center.

2. Go to Mail Flow Rules

  1. In the left-hand menu of the Exchange Admin Center, click Mail Flow.
  2. Select the Rules tab.

3. Create a New Rule

  1. Click the + (Add) button.
  2. Select Create a new rule.
  3. Give the rule a descriptive name, such as Whitelist [email address], so it is easy to identify later.

4. Set the Sender Condition

  1. Under Apply this rule if, choose The sender and then select is this person.
  2. Type the email address you want to whitelist and click OK.

5. Configure the Spam Bypass Action

  1. Under Do the following, select Modify the message properties.
  2. Choose Set the spam confidence level (SCL) and set it to Bypass spam filtering.

6. Add Optional Security Conditions

To reduce risk, you can add extra conditions before saving. Optional checks include:

  1. Checking for specific keywords in the subject line.
  2. Verifying the sender’s IP address.
  3. Ensuring the DMARC result is positive.

7. Save and Activate the Rule

  1. Click Save to finalize the rule.
  2. Confirm that the rule is enabled in the Rules list.

8. Test the Rule

  1. Ask the whitelisted sender to send a test email to your mailbox.
  2. Confirm the message arrives in the inbox without being flagged as spam.

Need Help?

If you run into issues or need more advanced configurations—such as using the Tenant Allow/Block List in Microsoft Defender for Office 365—contact the ACS support team for assistance.

Common questions

Will whitelisting an email address remove all security checks for that sender?

Setting the spam confidence level to Bypass spam filtering skips spam filtering for that sender, but other security policies in your Microsoft 365 environment may still apply. Use whitelisting only for senders you fully trust, and review your rules regularly.

How do I know if my new mail flow rule is working?

After saving and enabling the rule, send a test email from the whitelisted address to your mailbox. If the message arrives in your inbox without being flagged as spam, the rule is working correctly.

Can I add extra conditions to make a whitelist rule more secure?

Yes. When creating the rule, you can add optional conditions such as checking for specific subject-line keywords, verifying the sender’s IP address, or confirming a positive DMARC result. These additional checks help reduce the security risk of bypassing spam filtering.