Review email-filter exceptions.
By Tyler Mayberry · Cirlet. Published . Page updated .
Sources checked November 7, 2026. The example is fictional, not an account of an agency incident.
A carrier or vendor says its emails are getting blocked. Someone adds an exception so the messages get through. Months later, nobody remembers what it covers or whether it is still needed.
That exception is worth reviewing. In its November 2026 email-threat report, Microsoft described malicious messages impersonating business services that were delivered after organization or user exceptions overrode protections. This does not mean your agency has one of those exceptions or received those messages. It is a reason to ask what your own rules allow.
You do not need to change the rules yourself. Ask the person who manages your email to walk through them with you. If a separate security provider filters mail before Microsoft 365, include that provider's settings in the review too.
Ask for the actual list
For an agency using Microsoft 365 cloud mailboxes, Microsoft documents several places where allowed senders can be configured: the Tenant Allow/Block List, mail flow rules, individual Outlook Safe Senders lists, the IP Allow List and allowed sender or domain lists in anti-spam policies. These do different things. One screen does not necessarily show every exception.
Ask your email administrator or provider:
- Where have we allowed senders, domains, IP addresses or messages to bypass a filter? Are there exceptions in another email security product too?
- What does each entry match, which mailboxes does it affect, and which checks does it bypass?
- Who requested it, what business problem did it solve, and is that reason still current?
- Can we confirm the sender or service through a contact route already known to us? A familiar-looking address alone is not enough.
- Is there an expiry or review date? Who owns the decision to keep, change or remove it?
- If we change it, how will we test legitimate delivery and watch for messages incorrectly blocked?
Do not paste client messages or agency credentials into a shared worksheet. The owner can keep sensitive evidence in the agency's approved location.
Try one entry first
This example is fictional. An agency finds a rule allowing messages from vendor.example because a billing notice was blocked last year. The provider confirms that the domain is still used by the vendor and checks what the rule actually bypasses. The agency owner confirms whether the billing notices are still needed.
The provider then proposes a change, explains which mailboxes it affects and arranges a test with the business owner. They check that a known legitimate notice reaches its intended recipient and that the review did not interrupt the billing workflow. They record the decision and set a date to revisit it. The right change depends on the actual rule and the mail system; this example is not a tenant configuration.
Keep a record
For each exception, record:
- Where it is configured: provider and policy or list.
- What it matches: sender, domain, IP address or other condition.
- What it changes: filters affected and mailboxes covered, as confirmed by the administrator.
- Why it exists: business need and person who confirmed it.
- What happens next: decision, owner, test and review date.
Download the blank email exception review to copy or print.
Read and copy the blank email exception review
CIRLET | Email exception review Use one copy for each exception. Ask the person who manages your email to check the actual rule with you. If another provider filters your mail too, include its settings in the review. Don't put customer records, email messages, passwords, recovery codes or private screenshots here. Use an internal reference instead of a sender address, domain or IP address. Keep the actual rule details in your agency's approved records. Review date: _________________________________________________ Rule reference and where the details are kept: _________________ ______________________________________________________________ Provider and policy or list: __________________________________ ______________________________________________________________ What does it affect? Which mailboxes or roles? _________________ ______________________________________________________________ Which checks does it bypass? Ask the provider. _________________ ______________________________________________________________ Why was it added? Is that reason still current? ________________ ______________________________________________________________ Who confirmed the sender or service, and how? __________________ ______________________________________________________________ Expiry, if any, or next review date: ___________________________ Decision: [ ] Keep [ ] Change [ ] Remove [ ] Still deciding Decision owner: _______________________________________________ What will the provider do next? ________________________________ ______________________________________________________________ How will you test legitimate delivery and check for blocked mail? ______________________________________________________________ Test result or what is still unknown: ___________________________ ______________________________________________________________ Follow-up owner and date: ______________________________________ An unanswered question is unknown, not proof of a problem. This record doesn't tell you whether an exception is safe. Review changes with your email provider before making them. Guide: https://aicybersecurityforinsuranceagencies.com/guides/email-exception-review
What Microsoft recommends
Microsoft recommends its Tenant Allow/Block List before the other Microsoft 365 allow methods it describes. It also advises submitting incorrectly blocked good messages for analysis. The provider should decide what fits the agency's actual setup, especially if mail passes through another filter first.
Microsoft warns that allowed sender or domain lists in anti-spam policies can bypass several protections and recommends avoiding that method where possible. Its guidance describes different behavior for different allow methods and verdicts. An exception does not necessarily turn off every protection, and a visible allow entry does not tell you everything about the whole mail path.
A public SPF or DMARC check cannot show the exceptions inside your mail system. Bring the list and the decisions to your provider, and keep the records where your agency can find them next time a vendor asks for a change.
Sources
- Microsoft Threat Intelligence: email threat landscape, Q3 2026, November 5, 2026.
- Microsoft Learn: create sender allowlists for cloud mailboxes, checked November 7, 2026.
- Microsoft Learn: manage email sender entries in the Tenant Allow/Block List, checked November 7, 2026.
Microsoft 365 SPF and DMARC for agencies · Prepare for email fraud · Build a provider action plan.