M365 and "Junk Mail"

[Jawloms]

We migrated from onsite Exchange up to M365 a year or so ago. We've recently started seeing a lot of emails from parents going in to staff's "Junk Email" folder which has resulted in some being missed. Now we could whitelist every single email address of our parents however that would mean that we are essentially saying that any email we ever receive from a parent is safe, which isn’t necessarily the case of course. If a parent’s email account is compromised, we could very easily receive viruses/malware/phishing emails from them which we are ‘trusting’ (obviously we have AV running locally on the device which you'd like to think would also prevent nastiness!).

 

I think this is going to have to come down to staff checking their Junk folder. If they then mark the email as “Not Junk”, M365 would still be checking them for viruses etc. and quarantine it before it gets to the staff inbox, but so long as M365 decides it is safe then it will deliver that email to the staff members inbox instead of their Junk folder from then on?

 

I check the quarantine regularly and discuss with staff where ones look legitimate and then release them accordingly, but we can’t centrally check people’s Junk folders.
 

Or is there a better way......?

[itskdog]

Reporting false positives & false negatives is something that all staff should be encouraged to do anyway (as hard as it can be to train them when so much spam keeps coming in to any email address published on the school website), as they'll be able to tell if an email is legitimate more than IT can, if there is specific context in place that can affect that.

 

Depending on how you have it set up, you can get a copy sent to a dedicated shared mailbox (either on its own so you can review for personal info before sending to Microsoft from Actions & Submissions if you're concerned about GDPR, or both to you and to MS together).

 

Sending admin submissions as "I've confirmed this as clean" also lets you add an allow entry (and add your own opinion if Microsoft have clearly got it wrong with their first analysis from the user report), and the current default is "45 days after last used", so it will usually stay until Microsoft fix it on their end.