How Microsoft 365 Spam Filtering Works

Henry Timmes Email Deliverability Consultant · Named contributor to RFC 7489 & RFC 9989 (DMARC)

EOP, SCL, BCL and connection filtering - what actually decides whether Microsoft inboxes your mail.

EOP and Defender: The Microsoft Filtering Stack

Every message sent to a Microsoft 365 mailbox passes through Exchange Online Protection (EOP), Microsoft's built-in filter, and - for tenants that license it - Microsoft Defender for Office 365 on top. EOP handles connection filtering, anti-spam, anti-malware and authentication checks before mail ever reaches a mailbox.

SCL and BCL: The Two Scores That Matter

EOP assigns a Spam Confidence Level (SCL) to every message and a Bulk Complaint Level (BCL) from 0 to 9 to bulk mail. A high SCL routes a message to Junk or quarantine. A high BCL means Microsoft sees the mail as bulk and is receiving complaints. Tenant admins set the BCL threshold at which bulk mail is treated as junk - the default sits in the middle of the range.

This is why identical mail can inbox for one organization and junk for another: the recipient's admin decides how aggressive the bulk threshold is.

Connection Filtering and Reputation

Before content is even examined, EOP checks the sending IP against Microsoft's own reputation data and block lists. A poor-reputation IP can see mail rejected at connection time, before any score is assigned. This is the layer that most “why is Microsoft blocking me” problems actually live in.

What You Can and Can't Control

You control authentication, IP and domain reputation, complaint rate and list quality. You do not control the recipient tenant's admin settings. A good diagnosis separates the two, so you spend effort where it will actually move placement.

Frequently Asked Questions

What is the difference between SCL and BCL in Microsoft 365?

What is Exchange Online Protection?

Why does the same email junk for one company and inbox for another on Microsoft?