Whitelist External Email in Microsoft Exchange (Tenant-Wide)

If you are an IT administrator managing Microsoft 365, you’ve likely run into this headache: an important external vendor, client, or partner is trying to reach your team, but their emails keep getting swallowed by the spam filter.

Because they aren’t part of your organization’s domain, you need a safe, reliable way to tell Exchange, “Hey, this specific person is safe. Let them through.”

While users can manage their own safe senders in Outlook, the most robust way to handle this as an admin is by creating an Anti-Spam Bypass Rule via Exchange Mail Flow.

Here is the exact step-by-step process to add an external email address to your tenant-wide allow list using the Exchange Admin Center (EAC).

 

Whitelisting a Sender via Mail Flow

To get started, make sure you have Exchange Administrator or Global Administrator privileges, then follow these steps:

Step 1: Navigate to Mail Flow Rules

• Log in to the Exchange Admin Center. In the left-hand navigation menu, expand Mail flow and click on Rules.

Step 2: Create a New Blank Rule

• Click the Add a rule icon (the + sign) at the top of the rules list, and select Create a new rule from the dropdown menu.

Step 3: Define the External Sender

• Give your rule a clear, descriptive name (e.g., Bypass Anti-Spam – Safe External Sender).
• Under the dropdown for Apply this rule if, select The sender > is this person.
• A panel will slide out; type or paste the specific external email address here, click Add, and save the condition.

Step 4: Bypass Spam Filtering

• Under the Do the following dropdown, select Modify the message properties > set the spam confidence level (SCL).
• In the specify SCL dialog box, choose Bypass spam filtering. This programmatically assigns a value of -1 to the message, telling Office 365 to skip the spam checks.

Step 5: Save and Activate

• Click Next, review your settings, and click Save.
• CRITICAL FINAL STEP: Microsoft creates new rules in a Disabled state by default. Once the rule saves, you must click on it from your rules list and toggle the status to Enabled for it to actually start working.

 

Why Mail Flow instead of Anti-Spam Portal?

You might wonder why we don’t just use the “Allowed Senders” list inside the Microsoft Defender Security & Compliance portal.

While the Defender portal is an option, Mail Flow rules take precedence and offer significantly better visibility. When you use a Mail Flow rule:

• It is incredibly easy for other admins on your team to see exactly why an email bypassed filtering.
• You can easily add extra conditions later (like enforcing that the email must also come from a specific IP address to prevent spoofing).

A Quick Security Note: Only whitelist specific email addresses (user@partnerdomain.com) rather than entire domains (partnerdomain.com) whenever possible. Whitelisting an entire domain opens the door for attackers to spoof any email address from that domain and slide past your security defenses.

Conclusion

I welcome your thoughts, questions or suggestions on my article on how to tenant-wide whitelist an external email address in Microsoft Exchange.

You may support my work by sending me a tip using your Brave browser or by sending me a one time donation using your credit card.

Let me know if you found any errors within my article or if I may further assist you by answering any additional questions you may have.