www Flagged as Phish email by MS Defender

Frian Gonzales 20 Reputation points
2023-10-20T06:44:37.76+00:00

Hi,

I have a colleague who sent an email with a www. URL link attached, MS considered as a phish mail and immediately quarantined.

They have sent a series of bulk mails and they kept getting block as spam senders.

I just wanna make sure if I add this URL on the Safe Links in Threat & Policy as users already pissed off.

Outlook Management
Outlook Management
Outlook: A family of Microsoft email and calendar products.Management: The act or process of organizing, handling, directing or controlling something.
4,937 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Faery Fu-MSFT 17,196 Reputation points Microsoft Vendor
    2023-10-20T09:37:50.4966667+00:00

    Hi @Frian Gonzales ,

    As an administrator, you can un-quarantine the emails and unblock the senders by following these steps:

    • Adding a URL to the Safe Links in Threat & Policy is one way to prevent Microsoft Defender from blocking a safe website.
    • To unblock the senders, you need to create a mail flow rule that sets the spam confidence level (SCL) to -1 for messages from those senders. This will bypass spam filtering and prevent future messages from being quarantined. For more information on how to create a mail flow rule, see: Use mail flow rules
    • You can also Manage quarantined messages and files as an admin in the Microsoft 365 Defender portal.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.