Scripts for Safelisting in Microsoft 365

Overview

This article provides two safelisting scripts for Microsoft 365 email clients. Learn more about PowerShell scripting in Exchange Online docs and Azure Active directory docs. 

1. Safe Senders
2. Mail Flow Rules (deprecated)

Safe Senders

Adding senders to a user's safe senders list will remove the "Some content of this message has been blocked..." banner and allow the mail client to automatically download images in emails from the sender. If images are downloaded, opens will be recorded when a user views the email.

Add to existing Safe Senders list:

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
  Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement
$admin = Read-Host "Exchange admin email or UPN"
Connect-ExchangeOnline -UserPrincipalName $admin
$users = Get-User
$senders = @('example1@example.com', 'example2@example.com') # add safe senders here, in quotes and comma-separated
foreach($user in $users){
  # Get the user's current safe senders list
  [string[]]$safeSenders = Get-MailboxJunkEmailConfiguration -Identity $user.DistinguishedName | Select-Object -ExpandProperty TrustedSendersAndDomains

  # Add new senders to safe senders list, if not already present
  foreach($sender in $senders) {
    if (-not $safeSenders) {
      $safeSenders += $sender
    }
    elseif (-not $safeSenders.Contains($sender)) {
      $safeSenders += $sender
    }
  }

  $out = 'Adding Trusted Senders to {0}' -f $user.UserPrincipalName
  Write-Output $out
  Set-MailboxJunkEmailConfiguration $user.UserPrincipalName -TrustedSendersAndDomains $safeSenders
}
Write-Output "Finished!"

Replace existing Safe Senders list:

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement
$admin = Read-Host "Exchange admin email or UPN"
Connect-ExchangeOnline -UserPrincipalName $admin
$users = Get-User
$senders = 'example@example.com' #add safe senders here, in quotes and comma-separated
foreach($user in $users){
$out = 'Adding Trusted Senders to {0}' -f $user.UserPrincipalName
Write-Output $out
Set-MailboxJunkEmailConfiguration $user.UserPrincipalName -TrustedSendersAndDomains @{Add=$senders}
}
Write-Output "Finished!"

NOTE: You will need to assign all senders you wish to add to user's safe senders list to the $senders variable, in quotes and comma-separated. For example $senders = 'example@asd.com', 'second@123.com' , ...

Mail Flow Rules (deprecated)

Implement the four mail flow rules for bypassing by Junk, Spam and Clutter by IP and email Header 

if (-NOT (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) {
Install-Module -Name ExchangeOnlineManagement
}
Import-Module ExchangeOnlineManagement
$UserPrincipalName = Read-Host "UserPrincipalName"
$HeaderValue = Read-Host "X-PHISHTEST Header Value (default PhishingBox)"
if ([string]::IsNullOrEmpty($HeaderValue)) {
$HeaderValue = "PhishingBox"
}
Connect-ExchangeOnline -UserPrincipalName $UserPrincipalName
New-TransportRule "Phishing Testing - Bypass Spam By IP" -SenderIpRanges "64.191.166.0/24" -SetHeaderName "X-MS-Exchange-Organization-BypassClutter" -SetHeaderValue "true" -SetSCL "-1"
New-TransportRule "Phishing Testing - Bypass Junk By IP" -SenderIpRanges "64.191.166.0/24" -SetHeaderName "X-Forefront-Antispam-Report" -SetHeaderValue "SFV:SKI;"
New-TransportRule "Phishing Testing - Bypass Spam By Header" -HeaderContainsMessageHeader "X-PHISHTEST" -HeaderContainsWords $HeaderValue -SetHeaderName "X-MS-Exchange-Organization-BypassClutter" -SetHeaderValue "true" -SetSCL "-1"
New-TransportRule "Phishing Testing - Bypass Junk By Header" -HeaderContainsMessageHeader "X-PHISHTEST" -HeaderContainsWords $HeaderValue -SetHeaderName "X-Forefront-Antispam-Report" -SetHeaderValue "SFV:SKI;"