How Exchange Online Protection decides inbox placement - and how to diagnose and fix Microsoft-specific spam problems.
Why Microsoft 365 Is Different
Most deliverability advice is written for Gmail. Microsoft 365 (formerly Office 365) behaves differently, and that is why so many senders watch the same campaign sail into Gmail and drop straight into the Microsoft Junk folder. Microsoft runs its own filtering stack - Exchange Online Protection (EOP) and Microsoft Defender for Office 365 - and it leans heavily on its own reputation signals rather than on engagement the way Gmail does.
The practical consequence: you can have perfect SPF, DKIM and DMARC, a clean list, and still land in Junk at Microsoft if your sending IP or domain reputation is weak in Microsoft's eyes. Fixing Microsoft placement is a distinct discipline, and it is the one I spend most of my time on.
The Four Levers That Decide Microsoft Placement
1. Authentication. SPF, DKIM and a published DMARC record are table stakes. Microsoft now expects them for bulk senders and treats their absence as a strong negative signal.
2. IP and domain reputation. Microsoft scores both the sending IP and the From domain. New or lightly-used IPs start with little reputation and are filtered conservatively until they earn trust through consistent, low-complaint sending.
3. Complaint rate. Microsoft users clicking “Junk” is the fastest way to tank reputation. Microsoft exposes this through the Junk Mail Reporting Program (JMRP) and Smart Network Data Services (SNDS) for IPs you control.
4. List quality and sending patterns. Hitting dead mailboxes, spam traps, or sending in erratic bursts all read as spammer behavior to EOP.
How Exchange Online Protection Filters Mail
EOP assigns each message a Spam Confidence Level (SCL) and, for bulk mail, a Bulk Complaint Level (BCL) from 0 to 9. A high BCL means Microsoft considers the mail bulk and is receiving complaints about it. Administrators can tune the BCL threshold at which mail is treated as junk, which is why the same message can inbox for one Microsoft tenant and junk for another.
Because tenant admins can override Microsoft's defaults, part of diagnosing a Microsoft problem is separating what Microsoft is doing globally from what an individual recipient's IT department has configured.
Diagnosing a Microsoft 365 Problem
A proper diagnosis walks the whole path: confirm authentication passes as Microsoft sees it, check the sending IP against Microsoft's reputation and any blocks, review complaint data from SNDS/JMRP, inspect list hygiene for dead and risky addresses, and look at sending cadence. Only then does a fix make sense - whether that is authentication repair, a warmup plan, list cleaning, or working with an Office 365 deliverability expert to clear a hard block.
When to Bring in a Consultant
If your mail inboxes everywhere except Microsoft, if you have been placed on a Microsoft block and the self-service delisting form keeps bouncing you back, or if reputation keeps sliding despite clean lists, those are the classic signs the problem is Microsoft-specific and worth an expert set of eyes.
Frequently Asked Questions
Why do my emails go to spam only on Microsoft 365 and Outlook?
Does Microsoft 365 require DMARC?
What is a Bulk Complaint Level (BCL)?
What if a hard block won't lift on its own?
Emails landing in spam?
Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.
Book a free consultation