Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Handle False Positives In Microsoft Defender For Office 365

4 September 2026Doc update+11 / −10 lines

In brief

The guide replaces SCL-based guidance with spam verdict and category values such as SFV:SPM, CAT:SPM, and CAT:HSPM. It also updates BCL examples, remediation steps, and mail-flow rule guidance.

What Defender admins need to know

Use SFV and CAT header values, rather than SCL alone, when investigating false positives and tuning anti-spam policies.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • Legitimate bulk email (newsletters, marketing) is marked as spam.
  • Messages are delivered to the Junk Email folder instead of the Inbox.
  • Messages are quarantined as spam (not phishing or malware).
  • Message headers show a high Spam Confidence Level (SCL 5-9) or Bulk Complaint Level (BCL 7-9).
  • Message headers show SFV:SPM (spam filter verdict).

Use the phishing/malware false positive steps in this article if:

Value Description Implication
SCL:5 or SCL:6SFV:SPM Medium spam probabilitySpam filtering verdict DeliveredSpam filtering processed the message. Use the CAT value to Junk Email folderdetermine whether the message was identified as spam, phishing, or malware.
SCL:7, SCL:8, or SCL:9CAT:SPM High confidenceCategory: spam Delivered to Junk Email folder (default) or quarantined (preset security policies)by default
CAT:HSPMCategory: high confidence spamQuarantined by default
BCL:7 to BCL:9 High bulk complaint level Likely blocked by bulk mail threshold
SFV:SPMSpam filter verdict: spamMessage flagged as spam by content filters
SFV:BLK Blocked sender Sender is on the user's Blocked Senders list in Outlook
  • Tenant Allow/Block List block entry: Check the email entity page overrides information, or check the Tenant Allow/Block List directly for block entries that match the sender.
  • User's Blocked Senders list: Look for SFV:BLK in the message headers.
  • Exchange mail flow rule (transport rule): Look for the X-MS-Exchange-Organization-RuleID header.
  • Anti-spam policy settings: A high SCL score (5+)Spam or High confidence spam verdict (SFV:SPM with CAT:SPM or CAT:HSPM), or the BCL threshold is exceeded.
  • Connection filter (IP block list): Check the connection filter policy settings for the sending IP address in the IP Block List.

Step 3: Apply the appropriate fix

|Tenant Allow/Block List block entry|Remove the block entry or create an allow entry for the sender.| |User's Blocked Senders list|Remove the sender from the user's Blocked Senders list in Outlook or use an admin allow override.| |IP block list|Add the sending IP to the connection filter IP Allow List.| |Anti-spam policy (high SCL)(spam verdict)|Tune the anti-spam policy. For example, increase the BCL threshold or adjust the spam action.| |Mail flow rule|Modify the mail flow rule conditions in Exchange or add exceptions for the affected sender.| |Spam filtering error (no organization configuration issue)|Submit the message to Microsoft for analysis as a false positive.|

  1. Ask the sender to send a test message with the same content type and sender domain.
  2. Use message trace to verify the message was delivered to the Inbox.
  3. Check the message headers to confirm the SCL value is lower or the spam verdict is no longer applied.applied (for example, SFV:NSPM or CAT:NONE).
Scenario Key indicators Recommended approach
Legitimate bulk newsletter or marketing email consistently quarantined High BCL (7-9), CAT:BULK Increase the Bulk Complaint Level (BCL) threshold (the default value is 7). Or,
Legitimate newsletter or marketing email identified as spam or high confidence spamCAT:SPM or CAT:HSPMSubmit the messages to Microsoft for analysis and create an allow entry for the sender during the submission.
All email from a specific partner domain is blocked Sender found in the Tenant Allow/Block List (check the email entity page or the Tenant Allow/Block List directly) Remove the block entry or create an allow entry for the domain.
Marketing automation platform email blocked (Marketo, HubSpot, Mailchimp, etc.) High BCL, possible email authentication failures Verify the sender's SPF/DKIM/DMARC configuration. If authentication passes but filtering still triggers, increase the BCL threshold or add the sending domain to the allow list.
Forwarded emails quarantined as spoofing DMARC failure, spoof detection triggered Configure ARC trusted sealers for the forwarding service, or add a spoof intelligence override for the sender/infrastructure pair.
  • Policy precedence conflict: A higher-priority policy (preset security policy) might override your custom policy settings. For details, see Troubleshoot anti-spam policy issues.
  • Multiple detection reasons: The message triggered more than one detection (for example, spam and spoof detection). Resolving one cause might not be enough.
  • Allow entry expired or incorrect: Verify the Tenant Allow/Block List entry is active, not expired, and uses the correct format (email address vs. domain).
  • Mail flow rule overrideaction: Mail flow rules are evaluated before anti-spam policies. A mailcan request that messages bypass spam filtering. Spam filtering considers the request with other signals when it determines how to handle the message. Mail flow rule that sets the SCL overrides the anti-spam policy action. Check for rules that set SCL orcan also delete messages.

Handle phishing and malware false positives