Document alerts from SharePoint are being marked as 'Spam' by 'Microsoft 365 Defender'

[shageorg]

Automated document alert emails from SharePoint are being marked as 'Spam' by 'Microsoft 365 Defender' and quarantined until the emails are reviewed and released.

Can these be marked as safe so they aren't marked as 'Spam' and quarantined by 'Microsoft 365 Defender'?

[#2 · Accepted solution]

@shageorg Hi, you can whitelist your SPO email sender in the anti-spam inbound policy in defender as below 

[#3]

@eliekarkafy - Thank you!

I reached out to the administrators to update this setting. I appreciate your response!

[#4]

Have you checked to ensure that it is not user settings that are junking these items?

Some users may not realise that email address "no-reply at sharepointonline.com" is a genuine mail, and may report it as a phish. If you have a specimen recipient and an Exchange PowerShell to hand, try:

get-MailboxJunkEmailConfiguration -Identity user@tenancy | Select -ExpandProperty BlockedSendersAndDomains | fl

A question for the forum: is it possible to be phished by such messages from someone else's breached tenancy, presuming a pre-existing relationship between the recipient and the breached organisation?