Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Migrate To Defender For Office 365 Setup

4 September 2026Doc update+15 / −13 lines

In brief

The article now refers to the SCL=-1 rule as the “bypass spam filtering” mail flow rule throughout Step 3, including pilot-group exceptions and rule conditions. The article date and supporting link text were also updated.

What Defender admins need to know

Administrators following the migration guide should use the updated Step 3 heading and terminology when locating or configuring the rule.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  1. Create distribution groups for pilot users
  2. Configure user reported message settings
  3. Maintain or create the SCL=-1 mail flow ruleMaintain or create the bypass spam filtering mail flow rule
  4. Configure Enhanced Filtering for Connectors
  5. Create pilot threat policies

Distribution groups are required in Microsoft 365 for the following aspects of your migration:

  • Exceptions for the SCL=-1bypass spam filtering mail flow rule: You want pilot users to get the full effect of Defender for Office 365 protection, so you need Defender for Office 365 to scan their incoming messages. You get this result by defining your pilot users in the appropriate distribution groups in Microsoft 365, and configuring these groups as exceptions to the SCL=-1bypass spam filtering mail flow rule.

    As we described in Onboard Step 2: (Optional) Exempt pilot users from filtering by your existing protection service, you should consider exempting these same pilot users from scanning by your existing protection service. Eliminating the possibility of filtering by your existing protection service and relying exclusively on Defender for Office 365 is the best and closest representation of what's going to happen after your migration is complete.

For clarity, we use these specific group names throughout this article, but you're free to use your own naming convention.

When you're ready to begin testing, add these groups as exceptions to the SCL=-1 mail flow rulethe bypass spam filtering mail flow rule. As you create policies for the various protection features in Defender for Office 365, use these groups as conditions that define who the policy applies to.

Notes:

Instead of relying on data that's based on the experience of the entire organization, more than one migration has resulted in emotional speculation based on a single negative user experience. Furthermore, if you've been running phishing simulations, you can use feedback from your users to inform you when they see something risky that might require investigation.

Step 3: Maintain or create the SCL=-1bypass spam filtering mail flow rule

Because your inbound email is routed through another protection service that sits in front of Microsoft 365, it's likely that you already have a mail flow rule (also known as a transport rule) in Exchange Online that sets thebypasses spam confidence level (SCL) offiltering for all incoming mail to the value -1 (bypass spam filtering)(spam confidence level or SCL -1). Most non-Microsoft protection services encourage this SCL=-1 mail flowbypass rule rule for Microsoft 365 customers who want to use their services.

If you're using some other mechanism to override the Microsoft filtering stack (for example, an IP allow list) we recommend that you switch to using an SCL=-1a bypass spam filtering mail flow rule as long as all inbound internet mail into Microsoft 365 comes from the non-Microsoft protection service (no mail flows directly from the internet into Microsoft 365).

The SCL=-1bypass spam filtering mail flow rule is important during the migration for the following reasons:

  • You can use Threat Explorer (Explorer) to see which features in the Microsoft stack would have acted on messages without affecting the results from your existing protection service.

  • You can gradually adjust who is protected by the Microsoft 365 filtering stack by configuring exceptions to the SCL=-1bypass spam filtering mail flow rule. The exceptions are the members of the pilot distribution groups that we recommend later in this article.

    Before or during the cutover of your MX record to Microsoft 365, you disable this rule to turn on the full protection of the Microsoft 365 protection stack for all recipients in your organization.

For more information, see Use mail flow rules to set the SCL in messages.

Notes:

  • If you plan to allow internet mail to flow through your existing protection service and directly into Microsoft 365 at the same time, you need restrict the SCL=-1bypass spam filtering mail flow rule (mail that bypasses spam filtering) to mail that's gone through your existing protection service only. You don't want unfiltered internet mail landing in user mailboxes in Microsoft 365.

    To correctly identify mail that's already been scanned by your existing protection service, you can add a condition to the SCL=-1bypass spam filtering mail flow rule. For example:

    • For cloud-based protection services: You can use a header and header value that's unique to your organization. Messages that have the header aren't scanned by Microsoft 365. Messages without the header are scanned by Microsoft 365
    • For on-premises protection services or devices: You can use source IP addresses. Messages from the source IP addresses aren't scanned by Microsoft 365. Messages that aren't from the source IP addresses are scanned by Microsoft 365.

  • Minimal configuration.

  • Extremely low chance of false positives.

  • Similar behavior to anti-malware protection, which is always on and not affected by the SCL=-1bypass spam filtering mail flow rule.

For the recommended settings, see Recommended Safe Attachments policy settings. The Standard and Strict recommendations are the same. To create the policy, see Set up Safe Attachments policies. Be sure to use the group MDOPilot_SafeAttachments as the condition of the policy (who the policy applies to).