Whitelisting envelope sender addresses (Microsoft 365)

September 10, 2026 12:42 Updated

Depending on your Microsoft 365 setup, it might not be enough to only whitelist IPs. If that is the case, you should also whitelist the so-called envelope sender addresses (technical senders). Doing so only takes a few minutes and we have prepared a step-by-step guide to make things easy for you.

Log in to your Microsoft Defender with an administrator account.

Expand the Email & collaboration menu, select Policies & rules, and then choose Threat policies.

Select Anti-spam, followed by Anti-spam inbound policy (Default). A new dialog will open.

Towards the bottom of this dialog, select Edit allowed and blocked senders and domains.

Under Senders (x), click Manage x Sender(s).

Here, enter the Envelope sender addresses (technical senders) shown in the SoSafe Manager (Settings / Whitelisting).

Select Done to finish the process.

Microsoft Defender Anti-spam inbound policy (Default) dialog, with Edit allowed and blocked senders and domains marked near the bottom, below the empty Allowed senders, Allowed domains, Blocked senders, and Blocked domains sections.

SoSafe Manager whitelisting page with the Envelope sender addresses (technical senders) section expanded, showing noreply@sosafe.de, above a note that these addresses depend on the templates selected for the campaign.