Why does a Safe Sender continue to go to Junk email?

Hi @Richard Welch, 

Thank you for raising your concerns. 

In your case, even if you add a sender to Safe senders and Contacts, messages can still be moved to Junk because the mailbox is protected by server-side anti-spam or threat policies. Depending on the configuration, those protections can still route messages to Junk, and some threat verdicts (for example, malware or high-confidence phishing) are handled more strictly under secure by default protections. 

Also, there are scenarios where a message may appear to arrive and then later be moved due to post-delivery remediation (often referred to as ZAP). This feature can retroactively take action on messages already delivered, and users typically aren’t notified when it moves messages.

Since this involves an internal sender, it’s important to consider tenant-level configuration. For example, an address or domain could be affected by tenant allow or block settings or other organization policies, and block entries take precedence. 

Regarding the rule behavior: Outlook on the web supports server-side rules only, so rules that are client-only or use unsupported conditions/actions may not run automatically. A good test is recreating a simple rule directly in Outlook on the web (From = sender > Move to Inbox). 

Below are some suggested steps to help move forward. Kindly follow: 

1. Firstly, open one affected message in Junk and capture the message headers. Admins can use these to identify the filtering verdict/policy involved. 
2. Secondly, recreate the rule in Outlook on the web to ensure its server-side.
3. After that, reach out to your IT admin to review tenant-level allow and relevant anti-spam policies for that sender. Tenant-level allow methods are generally the preferred approach when mailbox-only safe sender settings aren’t enough. 
4. As a last step, if your IT team can’t resolve it quickly, please ask them to open a support ticket to engage a Microsoft Exchange support agent. They have additional diagnostic tools and deeper mail-flow visibility to help pinpoint root cause and share workflow tips to prevent future misses. For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin.  

Thanks again for bringing this up with the header details plus a policy review. Should you have any further questions, please feel free to reach out. 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

For mailboxes hosted on Exchange or Exchange Online, the personal Safe Senders list in Outlook is not authoritative. Even if a sender is added as a safe sender, Exchange/Exchange Online can still classify messages as junk and move them to the Junk Email folder.

From the documented behavior:

• Adding addresses/domains to the Safe Senders list tells Outlook not to treat them as junk.
• However, when the mailbox is on Exchange/Exchange Online, changes made to the Safe Senders list in Outlook may not be recognized by the server-side filtering. As a result, messages from those senders or domains can still be delivered to Junk.

Because of this, the issue cannot be fully fixed only from the client side (rules, contacts, Safe Senders). The correct path is:

1. Contact the organization’s Exchange/Exchange Online administrator.
2. Ask the admin to review and adjust server-side anti-spam policies or allow lists for that sender or domain so that messages are not classified as junk.

Client-side rules that move messages from Junk to Inbox will not reliably override server-side junk classification, especially if the server continues to reclassify or move the messages.

References:

• Block a mail sender in Outlook