Hi everyone,

One client org has internal emails being caught in the Microsoft Defender Quarantine on O365. They also have external emails being caught there and it seems that these days we cannot even whitelist email addresses any longer, we have to submit them to Microsoft so Microsoft can EVENTUALLY improve the filter?

Client is going crazy as many important vendor emails are getting caught and they just want to change from Microsoft somewhere else which I’m trying to not recommend.

It does suck, understandably to have your email domain hosted on O365 for a dozen+ years and to have the Spam filter act as if it’s brand new sometimes on a yearly basis however. It’s very inconvenient for productivity reasons as lots of false-positives start happening over and over as if the filter is brand new now and then.

I have tried to set the quarantine to “send an email daily” to user so they can handle their own quarantine, that hasn’t worked, no email arrives. So I have given the users the link to login to their quarnatine to try to release/report false-positive’s to Microsoft meanwhile.

Any suggestions to improve this?

Thanks.

​Hi everyone, One client org has internal emails being caught in the Microsoft Defender Quarantine on O365. They also have external emails being caught there and it seems that these days we cannot even whitelist email addresses any longer, we have to submit them to Microsoft so Microsoft can EVENTUALLY improve the filter? Client is going crazy as many important vendor emails are getting caught and they just want to change from Microsoft somewhere else which I’m trying to not recommend. It does suck, understandably to have your email domain hosted on O365 for a dozen+ years and to have the Spam filter act as if it’s brand new sometimes on a yearly basis however. It’s very inconvenient for productivity reasons as lots of false-positives start happening over and over as if the filter is brand new now and then. I have tried to set the quarantine to “send an email daily” to user so they can handle their own quarantine, that hasn’t worked, no email arrives. So I have given the users the link to login to their quarnatine to try to release/report false-positive’s to Microsoft meanwhile.  Any suggestions to improve this? Thanks.   Read More

​