Why are phishing emails bypassing Exchange Online Protection?
Clean phishing emails are being delivered straight to the inbox with no warning from Exchange Online Protection. These spoofs sail through primarily because of per-user whitelists. When a client allowlisted a sender years ago, it causes these malicious emails to bypass current filtering entirely.
What the numbers show
Counted from the threads quoted below. How we count
- People have been saying this in most months since September 2026.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Why are phishing emails bypassing Exchange Online Protection?
- 1Adding domain and URL blocks to the Tenant Allow/Block List in M365Did this help you?
- 2Submitting the malicious message to Microsoft as phishingDid this help you?
- 3Adding mail flow rules to quarantine messages claiming to be from the service that originate outside its legitimate sending IPs.Did this help you?
- 4Using filtering systems that trigger alerts when users attempt to whitelist known risky default addresses.Did this help you?
- 5Providing clients with instructional packets on how to configure third-party services to send emails from their own custom domains rather than default system addresses.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“The whitelist angle is the part that worries me most, we have seen the same thing with the QuickBooks ones where a client allowlisted the sender years ago and the spoof just sails through.”source ↗
“Yeah really the per user whitelists are the ones causing this.”source ↗
Where this came up
People with this problem also raised
- 4Why does IT send fake phishing emails that stress us out?
- 6Why am I getting WhatsApp scams with my real travel booking details?
- 6Why do users keep clicking phishing links?
- 2Fake Cloudflare security verification terminal command scam
- 7Getting weird scam letters or emails from banks I don't use
- 9Why am I getting DMARC and SPF errors when emails deliver fine?