Allow entry process.

Question

I am studying the Allow Entry process for a spoofed message, and the first step is confusing. It states that when a user receives an email that shouldn't have been blocked, then in the second step, they'd contact the GA or Security Administrator who would then submit the email to Microsoft. Why would a user contact an admin that their message was blocked when they'd already received it?

https://learn.microsoft.com/en-us/training/modules/examine-microsoft-defender-office-365/6-manage-email-access

This question is related to the following Learning Module

Answer 1

Hi Kizito Nwaodu,
Thank you for reaching out to us on the Microsoft Q&A forum.

I can appreciate why the process of "Allow Entry" for spoof messages can be quite challenging. I understand what the developers want and what problems they have. When it comes to allowing entry, I want to clarify that the processes apply to situations where actual emails are being erroneously restricted by the system, such instances we refer to them as false positives. This situation suggests that there were two paradoxes when that email reached the user’s inbox and therefore, should be considered as a false positive. The user is then encouraged to contact the Global Administrator (GA) or Security Administrator to report that. The administrator simply is to send that email to Microsoft. This sheds much lighter on the problem and helps Microsoft fix the flaws in their respective filtering system whereby such emails will not be filtered again in the future. For an Optimize system to learn proper filtration patterns it needs these fake negatives reported and thus their chances of being blocked in the future are next to none.

Refer follow: Allow or block email

If you continue to face issues, please let us know in the comments. We are here to help.

If you find this information helpful, please acknowledge by clicking the "Upvote" and "Accept Answer" buttons on the post.