www Flagged as Phish email by MS Defender

Question

Hi,

I have a colleague who sent an email with a www. URL link attached, MS considered as a phish mail and immediately quarantined.

They have sent a series of bulk mails and they kept getting block as spam senders.

I just wanna make sure if I add this URL on the Safe Links in Threat & Policy as users already pissed off.

Answer 1

Hi @Frian Gonzales ,

As an administrator, you can un-quarantine the emails and unblock the senders by following these steps:

• Adding a URL to the Safe Links in Threat & Policy is one way to prevent Microsoft Defender from blocking a safe website.
• To unblock the senders, you need to create a mail flow rule that sets the spam confidence level (SCL) to -1 for messages from those senders. This will bypass spam filtering and prevent future messages from being quarantined. For more information on how to create a mail flow rule, see: Use mail flow rules
• You can also Manage quarantined messages and files as an admin in the Microsoft 365 Defender portal.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.