Share via

How to create the SCL=-1 mail flow rule

Rizwan Assad 341 Reputation points
2025-05-15T06:26:45.61+00:00

Hi We are planning to move from 3rd party solution to defender, I want to get the default settings from defender side because this instance was previously used so there are some stale policies etc. there, how do I start from scratch and how do I create the SCL=-1 mail flow rule later on to exclude the pilot users from the 3rd party protection service. And what do you suggest would be the best path? start evaluation and then change it to standard configuration? or what is the best practice and shortest way to migrate from 3rd part to defender and yes, I have skim read the process mentioned in https://learn.microsoft.com/en-us/defender-office-365/migrate-to-defender-for-office-365-setup

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator
    2025-05-16T10:48:58.52+00:00

    Hi, understood, but hear me out :) If you create safelists and set the messages to SCL -1 , then you wont be testing Defender at all, instead you will be telling Defender to allow any messages from that 3rd party. If you need to safelist, then exclude them within the 3rd party solution checks, not within Defender if I am understanding your requirements correctly :)

    Was this answer helpful?

    1 person found this answer helpful.
  2. Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator
    2025-05-15T10:50:50.1666667+00:00

    Dont create a rule. Instead send your messages from the 3rd party provider and if they are blocked, submit them as false positives as an admin. Teach the system to allow these. See the first bullet in this article

    https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365

    Was this answer helpful?

    1 person found this answer helpful.
  3. Camila Th 1,945 Reputation points Microsoft External Staff Moderator
    2025-05-15T08:00:20.7266667+00:00

    Hi @Rizwan Assad

    Thank you for posting your question in the Microsoft Q&A forum.

    For creating Exchange Online mail flow rule, you may go to EAC >  Mail flow > Rules to create a mail flow rule. After setting the condition, you can choose “Modify the message properties > set the spam confidence level (SCL)” and select “Bypass spam filtering”. 

    Please check this for more details: Use mail flow rules to the SCL in messages in Exchange Online | Microsoft Learn

    Additionally, please understand that our Exchange Online Q&A forum only focus on issues related to Exchange Online services. If you need more suggestions about Microsoft Defender, you can post questions under “Microsoft Defender” related tags. Thanks for your understanding.

    Microsoft Defender for Cloud - Microsoft Q&A

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.