IP Permission List, Transport Rules (Microsoft 365) – SoSafe Support

In this article, we explain how to whitelist Exchange Online (Microsoft 365). 

The following steps are required: 

First, you set up an IP permission list that contains our IP address. 
Then, you set up a message flow rule so that our incoming e-mail can bypass both the Clutter folder and Microsoft's EOP spam filter. 
In addition, a rule must be created in Microsoft 365 regarding the Junk folder.

Once you have completed this process, it may take some time for the settings to be fully processed. We recommend that you wait one to two hours before you test whether the whitelisting was successful. 

For the IP addresses used, please refer to the SoSafe Manager Portal under Simulation > Whitelisting. Self-service customers can only view this information through their individual SoSafe Manager access. All other customers can also access this information via the following direct link: 

SoSafe Manager (Whitelisting) 

When using Microsoft Defender for Microsoft 365, please also see this article:

Whitelisting domains with safe links (Microsoft Defender)

Chapter 1: Setting Up the IP Permission List

Step 1

Step 2

Under “Policies & rules” (1) select “Threat policies” (2).

Microsoft 365 Defender left navigation menu with Policies and rules marked 1. The Email and collaboration section also lists Real-time detections, Submissions, Review, and Exchange message trace.

Policies and rules page in Microsoft 365 Defender, with Threat policies marked 2 in the list, alongside Alert policy, Manage advanced alerts, and Activity alerts.

Step 3

Click on “Anti-spam”.

Threat policies page in Microsoft 365 Defender, with Anti-spam marked among Anti-phishing, Anti-malware, Safe Attachments, and Safe Links under the Policies section.

Step 4

Click on  Connection filter policy. A pop-up window will open.

Anti-spam policies page in Microsoft 365 Defender, with Connection filter policy marked next to the Anti-spam inbound and Anti-spam outbound policies, all showing Always on status.

Connection filter policy panel open, showing the IP Allow list and IP Block list both set to Not configured and the Safe list switched off, with an Edit connection filter policy link below.

Step 5

Click “Edit connection filter policy”.

The same connection filter policy panel, now with the Edit connection filter policy link marked.

Step 6

Insert our IP address here (see platform or direct link) (1) and click “Save” (2).

Connection filter policy edit dialog with the Always allow messages field marked 1 and the Save button marked 2, below the Always block messages field and a Turn on safe list checkbox.

Step 7

Click on “Save”. This completes the Setting Up the IP Permission List section.

Chapter 2: Bypass Spam and Clutter filters

Step 1

Choose “Exchange message trace” in the left menu. The Exchange Admin Center opens in a new window.

Microsoft 365 Defender left navigation with Exchange message trace marked, which opens the Exchange admin center in a new window. Policies and rules and the other Email and collaboration items sit below it.

Step 2

Click on “Rules” under the drop-down menu “Mail flow”.

Exchange admin center left navigation with Rules marked under the Mail flow section, alongside Message trace, Remote domains, and Accepted domains. The Recipients section above lists Mailboxes, Groups, Resources, and Contacts.

Step 3

Click on the plus icon and select “Add a rule…”. A pop-up window opens.

Rules page in Exchange admin center with the Add a rule button marked, its dropdown open and Create a new rule highlighted among other templates such as Apply disclaimers and Restrict messages by sender or recipient.

Step 4

Give the rule a name, e.g., “Avoid spam and clutter filters by IP address”.

New transport rule dialog with the Name field filled in as Avoid spam and clutter filters by IP address, above empty Apply this rule if, Do the following, and Except if condition dropdowns.

Step 5

In the drop-down menu, under the “Apply this rule if...” item, select the “The sender...” item. - then activate the rule “IP address is in any of these ranges or exactly matches”.

Apply this rule if section with The sender selected and its options list open, showing IP address is in any of these ranges or exactly matches marked among choices like is a member of this group and address matches any of these text patterns.

Step 6

Enter our IP address (see platform or direct link) in the window that opens and click on the “Add” button to add them. Add more addresses if necessary and then click on “Save”.

Specify IP address ranges dialog with a field to enter an IPv4 or IPv6 address or range next to an Add button, and Edit, Delete, and an item count below.

Step 7

In the drop-down menu under “Do the following...” click “Modify the message properties...” and then click “set a message header”.

Do the following section with Modify the message properties selected and its options open, set a message header marked among remove a message header, apply a message classification, and set the spam confidence level SCL.

Step 8

On the right this text should appear: Set the message header *Enter text… to the value *Enter text.... 

Enter “X-MS-Exchange-Organization-BypassClutter” for the first placeholder and “true” for the second placeholder. 

Do the following section set to Modify the message properties and set a message header, showing the header X-MS-Exchange-Organization-BypassClutter set to the value true.

Step 9

Click on the blue plus symbol (+) to add another action and select “Modify the message properties…” from the drop-down menu, then select “set the spam confidence level (SCL)”.

A second action added below with And, Modify the message properties selected again and its dropdown open, with set the spam confidence level SCL marked among apply a message classification and the greyed-out set a message header option.

Step 10

In the pop-up window, select the option “Bypass spam filtering” and press “Save”. 

Selection dialog specify SCL. The entry Bypass spam filtering is selected. Save button shown at the bottom.

Step 11

Now click on “Next” to get to the next section “Set rule settings”.

Scroll down to the “Match sender address in message” field and select “Envelope” instead of “Header”.

Set rule settings section showing rule mode set to Enforce, severity Not specified, and the Match sender address in message field set to Envelope instead of Header, with Activate and Deactivate scheduling fields below.

Click on “Next” again.

The finished rule should look like this:

Finished rule summary for Chapter 2, showing the condition Sender's IP address is in the range, and actions setting the X-MS-Exchange-Organization-BypassClutter header to true and the spam confidence level SCL to negative one.

Press “Finish”. Then set the rule from “Disabled” to “Enabled”.

This completes the chapter Bypass Spam and Clutter filters.

Chapter 3: Bypass Junk filter 

Step 1

Follow the steps 1 – 3 in chapter 2 and open “Rules” under the drop-down menu “Mail flow”.

Step 2

Click on the plus icon and select “Add a rule…”. A pop-up window opens.

Step 3

Give the rule a name, e.g., “Junkfilter”.

New transport rule dialog for Chapter 3, with the Name field filled in as Junkfilter, above empty Apply this rule if, Do the following, and Except if condition dropdowns.

Step 4

In the drop-down menu, under the “Apply this rule if...” item, select the “The sender...” item. - then activate the rule “IP address is in any of these ranges or exactly matches”.

Apply this rule if section for the Junkfilter rule, with The sender selected and its options list open, showing IP address is in any of these ranges or exactly matches marked among the other condition choices.

Step 5

Enter our IP address (see platform or direct link) in the window that opens and click on the “Add” button to add them. Add more addresses if necessary and then click on “Save”.