Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Spam confidence level (SCL) in Microsoft 365

4 September 2026Doc update+26 / −23 lines

In brief

The page now explains that SCL no longer determines spam verdicts or final actions in cloud organizations. It directs admins to use header values such as CAT and DIR, while describing SCL uses for mail flow rules and on-premises Exchange.

What Defender admins need to know

Use the updated guidance when interpreting message headers or troubleshooting spam handling; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Spam confidence level (SCL) in cloud organizationsMicrosoft 365

In all organizations with cloud mailboxes, inbound messages go through spam filtering and get a spam score. That score is mapped to an individualHistorically, the spam confidence level (SCL) helped indicate whether spam filtering considered a message good or bad, or whether filtering was skipped on the message. Spam filtering stamps the SCL value added(-1, or 0 to 9) on messages in the X-Forefront-Antispam-Report header. An SCL value of 5 or higher generally indicates the message in an X-header. A higheris considered bad.

As the filtering stack evolved, particularly with the expansion into message categorization, the SCL value indicatesno longer holds the same meaning in cloud organizations. The value doesn't determine whether spam filtering identifies a message is more likely to be spam. Microsoft 365 takes action onas Spam or High confidence spam, and it doesn't determine the message based on the SCL value.

The following table describes what the SCL values mean and the default action taken on the message. Spam filtering makes those messages:

decisions using categorization and other signals, so the same SCL valueDefinitionDefault action
-1The can appear on messages with different verdicts.

To understand how a message skipped spam filtering.was handled, use other values in the message header. For example, CAT (category) identifies what filtered the message, and DIR (directionality) indicates whether the message is from a safe sender, was sent to a safe recipient, or is from an email source server on the IP Allow List.internal. For more information, see Create sender allowlistsAnti-spam message headers.

Deliver For the actions that anti-spam policies take for each verdict, see Actions in anti-spam policies.

In the cloud, the primary use of SCL is mail flow rules (also known as transport rules) to request a bypass from most spam filtering (SCL -1), treat messages as spam (SCL 5 or 6), or treat messages as high confidence spam (SCL 9) based on specific criteria. But even when a rule requests a bypass, the actual SCL value stamped on the message might not be -1 (for example, 0 or 1 to recipient Inbox folders.

0, 1Spam filtering determinedindicate it was evaluated and found not to be spam).

The main purpose of the message wasn't spam.

DeliverSCL value is to support on-premises Exchange servers, including hybrid environments where cloud-filtered messages are delivered to on-premises mailboxes. In on-premises Exchange, the message to recipient Inbox folders.
5, 6Spam filtering markedSCL value is meaningful for the message as SpamDefaultfollowing anti-spam policy, new anti-spam policies,features:

7, 8, 9Spam filtering markedthreshold for the message as High confidence spamDefault anti-spam policy and new anti-spam policies: Deliver the message to recipientorganization.
  • The Junk Email folders.

    Standard and Strict preset security policies: Quarantine the message.

    • For more information about actions you can take on messages based on the spam filtering verdict,information, see Configure anti-spam policiesExchange spam confidence level (SCL) thresholds.

    For troubleshooting information about SCLspam filtering overrides, see SCL override behaviorSpam verdict override behavior. To identify which component set the SCL onfiltered a specific message, see Determine which component set the SCLDetermine which component filtered the message.

    Similar to the SCL, theThe bulk complaint level (BCL) identifies bad bulk email (also known as gray mail). A higher BCL value indicates the message is more likely to exhibit undesirable spam-like behavior. You configure the BCL threshold in anti-spam policies. For more information, see Configure anti-spam policies, Bulk complaint level (BCL), and What's the difference between junk email and bulk email?.the following articles: