Daily Defender News
Aboutmerill.net
Microsoft Defender for Office 365
Email and collaboration

Understand overrides within the email entity page in Microsoft Defender for Office 365

4 September 2026Doc update+21 / −20 lines

In brief

The overrides details table was retitled, given a section anchor, reformatted, and updated with revised wording and links, including the SCL -1 mail flow rule explanation.

What Defender admins need to know

The refreshed table and links provide updated guidance for investigating email overrides.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Understand overrides within the email entity page in Microsoft Defender for Office 365

This article is all about helping you understand the different overrides, how they're triggered, and helpful information for diagnosing when the effect of an override was unexpected, such as an email being blocked when no threats were found.

OverridesUnderstand the overrides details table

The following table lists all overrides, a description of what that override means and some starting points for troubleshooting. Not all overrides are honored, depending on the circumstance. For example an email that contains malware is automatically blocked regardless if an end user set the sender as a "safe sender". To learn more about how overrides are applied, see How policies and protections are combined.

Override Description Notes
Third Party Filter We detected your MX record points to a non-Microsoft service and you have an SCL-1 transport rule, which overrides most Microsoft 365 filteringa mail flow rule that bypasses most Microsoft 365 filtering (SCL -1) and Secure by Default.secure by default.
Admin initiated time travel Admin triggered investigation, which leads to zero-hour auto purge (ZAP) modifying the delivery location of messages. Zero-hour auto purge (ZAP)
Antimalware policy block by file type The file extension for an attachment within the message matched a banned file type listed in the anti-malware policy for the recipient You may wish to tweak the file extensions listed in the Common attachments filter section of the anti-malware policy. Configure anti-malware policies.
Antispam policy settings The message matched a custom option in the anti-spam policy for the recipient. For example: "SPF record: hard fail" or "Empty messages". Check the "Mark as spam" options in the anti-spam policy for the affected recipient. Configure anti-spam policies.
Connection policy The message originated from an allowed / blocked IP within your connection filter policy. Check the "Connection filter policy" within the anti-spam policies section of the security portal. Configure connection filter policies.
Exchange transport rule The message matched a custom transport rule that affected the final delivery location. You can use the email entity page, or Exchange message trace to highlight which transport rule was triggered. Mail flow rules in Exchange Online.
Exclusive mode (User override) The recipient has chosen to mark all messages as spam unless they're received from a sender in their trusted contact list. The recipient has likely configured: "Don't trust email unless it comes from someone in my Safe Senders and Recipients list" within the Junk email settings in Outlook or OWA. Learn more.
Filtering skipped due to on-premises organization The message was marked as nonspam by your Exchange on-premises environment before being delivered to Exchange Online You should review your on-premises environment to locate the source of the override.
IP region filter from policy The message was detected as coming from a country/region that an admin has selected to block in the anti-spam policy for the recipient. Modify the "From these countries/regions" option within the anti-spam policy applied to the affected recipient. Configure anti-spam policies.
Language filter from policy The message was detected as containing a language that an admin has selected to block in the anti-spam policy for the recipient. Modify the "Contains specific languages" option within the anti-spam policy to the affected recipient. Configure anti-spam policies.
Phishing simulation The message met the criteria defined by an administrator to be considered a phishing simulation message. Criteria are within the "Phishing simulation" tab within Advanced delivery in the security portal. Configure Advanced delivery policy.
Quarantine release The recipient or an administrator released this message from quarantine. Release messages from quarantine.
SecOps Mailbox The message was sent to the specific security operations mailbox defined by an administrator. Mailboxes are defined within the "SecOps mailbox" tab within Advanced delivery in the security portal. Configure Advanced delivery policy.
Sender address list (Admin Override) The message matched an entry in the allowed/blocked senders within the anti-spam policy for the recipient. Check the "Allowed and blocked senders and domains" section of the relevant anti-spam policy. (allows with this method aren't recommended). Create safe sender lists in Office 365.
Sender address list (User override) The recipient has manually set this sender address to be delivered to the inbox (allowed) or junk email folder (blocked). The recipient has likely configured "Safe senders and domains" or "Blocked senders and domains" within the Junk email settings in Outlook or OWA. Set-MailboxJunkEmailConfiguration cmdlet.
Sender domain list (Admin Override) The message matched an entry in the allowed/blocked domains within the anti-spam policy for the recipient. Check the "Allowed and blocked senders and domains" section of the relevant anti-spam policy. (allows with this method aren't recommended). Create safe sender lists in Office 365.
Sender domain list (User override) The recipient has manually set the sending domain to be delivered to the inbox (allowed) or junk email folder (blocked). The recipient has likely configured "Safe senders and domains" or "Blocked senders and domains" within the Junk email settings in Outlook or OWA. Set-MailboxJunkEmailConfiguration cmdlet.
Tenant Allow/Block List file An entry was matched for a file hash listed in the Tenant allow/block list. Review the entires within the "Tenant Allow/Block Lists" page within the security portal. About the Tenant Allow/Block List.
Tenant Allow/Block List sender email address An entry was matched for a sender address listed in the Tenant allow/block list. Review the entires within the "Tenant Allow/Block Lists" page within the security portal. About the Tenant Allow/Block List.
Tenant Allow/Block List spoof An entry was matched for spoof detection in the Tenant allow/block list. Review the entires within the "Tenant Allow/Block Lists" page within the security portal. About the Tenant Allow/Block List.
Tenant Allow/Block List URL An entry was matched for a URL listed in the Tenant allow/block list. Review the entires within the "Tenant Allow/Block Lists" page within the security portal. About the Tenant Allow/Block List.
Trusted contact list (User override) The recipient has chosen to mark contacts in their contacts folder as trusted senders automatically. The recipient has likely configured: "Trust email from my contacts" within the Junk email settings in Outlook or OWA. Set-MailboxJunkEmailConfiguration cmdlet.
Trusted domain (User override) The recipient has added this domain to their safe recipients list within Outlook, emails sent to this domain aren't treated as junk email. The recipient has likely configured "Safe Recipients" within Outlook's Junk email options. Block or allow junk email settings in Outlook.
Trusted recipient (User override) The recipient has added this sender to their safe recipients list within Outlook, emails sent to this sender aren't treated as junk email. The recipient has likely configured "Safe Recipients" within Outlook's Junk email options. Block or allow junk email settings in Outlook.
Trusted senders only (User override) This override marks all messages as spam unless they're received from a sender in the recipient's trusted contact list, primarily used in outlook.com. This behavior is the same as Exclusive mode (User override). The recipient has likely configured: "Don't trust email unless it comes from someone in my Safe Senders and Recipients list" within the Junk email settings. Set-MailboxJunkEmailConfiguration cmdlet.

Next step