Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
Protection against phishing, malware, and other threats targeting email and collaboration tools in Microsoft 365
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 5%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWD%3C/text%3E%3C/svg%3E)
How can i research the spoofing?
questionable emails coming from ******@microsoftonline.com
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 54%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJA%3C/text%3E%3C/svg%3E)
Julie A
6
Reputation points
Several users have received emails from ******@microsoftonline.com. The messages appear to be suspicious, when reporting them to MS, the status comes back "threats found" I am hesitant to add this address to our block list for fear of not receiving legitimate messages from Microsoft. Can you tell me if this address is legit? Is it ok to add that address to our tenant block list.
Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
2 answers
Sort by: Most helpful
-
Vasil Michev 126.1K Reputation points MVP Volunteer Moderator2025-08-06T06:25:21.97+00:00 Said address is still used for account verification (part of the self-service password reset process) afaik. The messages you received were likely spoofed, so consider blocking the sender's ip/ranges instead.