Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Configure Junk Email Settings On Exo Mailboxes

4 September 2026Doc update+14 / −17 lines

In brief

The article now clarifies that Safe Senders entries do not determine the final spam verdict and that malware, high-confidence phishing, and other detections take precedence. It also reorganizes prerequisites and refreshes PowerShell formatting and wording.

What Defender admins need to know

Administrators should update their understanding of Safe Senders behavior, especially when reviewing spam-filtering expectations and hybrid mail-flow configurations.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

But, there are also specific anti-spam settings that admins can configure on individual mailboxes in Exchange Online:

  • Deliver messages to the Junk Email folder based on anti-spam policies: When an anti-spam policy is configured with the action Move message to Junk Email folder for a spam filtering verdict, the message is delivered to the mailbox's Junk Email folder of the mailbox.folder. For more information about spam filtering verdicts in anti-spam policies, see Configure anti-spam policies. Similarly, if zero-hour auto purge (ZAP) determines that a delivered message is spam or phishing, the message is moved to the Junk Email folder for Move message to Junk Email folder spam filtering verdict actions. For more information about ZAP, see Zero-hour auto purge (ZAP) in Exchange Online.

  • Junk email settings that users configure for themselves in Outlook or Outlook on the web: The safelist collection is the Safe Senders list, the Safe Recipients list, and the Blocked Senders list on each mailbox. The entries in these lists determine whether the message is delivered to the Inbox or the Junk Email folder. Users can configure the safelist collection for their own mailboxes in Outlook or Outlook on the web (formerly known as Outlook Web App or OWA). Admins can configure the safelist collection on any user's mailbox.

Admins can use Exchange Online PowerShell to configure entries in the safelist collection on mailboxes (the Safe Senders list, the Safe Recipients list, and the Blocked Senders list).

What do you need to know before you begin?Prerequisites

  • You can only use Exchange Online PowerShell to do the procedures in this article. To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell.

  • You need to be assigned permissions in Exchange Online before you can do the procedures in this article. Specifically, you need the Mail Recipients role (which is assigned to the Organization Management, Recipient Management, and Custom Mail Recipients role groups by default) or the User Options role (which is assigned to the Organization Management and Help Desk role groups by default). To add users to role groups in Exchange Online, see Modify role groups in Exchange Online. Users with default permissions can do these same procedures on their own mailboxes, as long as they have access to Exchange Online PowerShell.

  • In hybrid environments where the built-in security features for cloud mailboxes protect on-premises Exchange mailboxes, you need to configure Exchange mail flow rules (also known as transport(transport rules) in your on-premises Exchange organization to recognize the spam filtering verdicts from the cloud. For details, see Deliver cloud-detected spam to the Junk Email folder in on-premises mailboxes.

    After you manually create the rule in Microsoft 365 to match the rule in on-premises Exchange, the rule replicates in hybrid environments.

  • By design, safe senders for shared mailboxes aren't synchronized to Microsoft Entra ID or Microsoft 365.

A mailbox's safelist collection consists of the Safe Senders list, the Safe Recipients list, and the Blocked Senders list. By default, users can configure the safelist collection on their own mailboxes in Outlook or Outlook on the web. Admins can use the corresponding parameters on the Set-MailboxJunkEmailConfiguration cmdlet to configure the safelist collection on a user's mailbox. The following table maps each Set-MailboxJunkEmailConfiguration parameter to the corresponding junk email setting in Outlook and Outlook on the web.

Parameter on Set-MailboxJunkEmailConfiguration Junk Email Options in Outlook Junk email settings in Outlook on the web
BlockedSendersAndDomains Blocked Senders tab Blocked Senders and domains section
ContactsTrusted Safe Senders tab > Also trust email from my Contacts Filters sections > Trust email from my contacts
  • Remove the value [email protected] from the Safe Senders list and the Safe Recipients list.
  • Configure contacts in the Contacts folder to be treated as trusted senders.
Set-MailboxJunkEmailConfiguration "Ori Epstein" -BlockedSendersAndDomains @{Add="[email protected]"} -TrustedSendersAndDomains @{Remove="[email protected]"} -ContactsTrusted $true

To remove a blocked domain from the Blocked Senders list of every user mailbox in the organization, run the following bulk update command:

$All = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited; $All | foreach {Set-MailboxJunkEmailConfiguration $_.Name -BlockedSendersAndDomains @{Remove="contoso.com"}}

To verify you successfully configured the safelist collection on a mailbox, use any of the following procedures:

  • Replace <MailboxIdentity> with the name, alias, or email address of the mailbox, and run the following command to verify the property values:

    Get-MailboxJunkEmailConfiguration -Identity "<MailboxIdentity>" | Format-List trusted*,contacts*,blocked*