63% Of The Spoofed Phish Had An Exception Applied. Who Signed Off Your Allow-List?

Microsoft's latest email threat report has a number that should change how you think about phishing filters. In September, among malicious messages spoofing well-known business services, tenant- or user-level overrides applied to 63% of those with a recorded security outcome. Most of those were tenant-level. In other words, the filter flagged the message and an exception someone had configured let it through.

The figure comes from Microsoft Threat Intelligence's Q3 2026 email threat landscape, published on 5 November. Microsoft is careful to say the numbers don't show that recipients opened the messages or that accounts were compromised. But they do show where the weak point is, and it isn't the detection.

The quarter in numbers

• About 7.3 billion email phishing threats from July to September, with nearly 3 billion in September alone, up 41% on August.
• About 129 million malicious messages spoofing the sender domains of tracked business services, steady at 41 to 46 million a month since at least May.
• QR code phishing fell to about 12.1 million attacks, down 67% on Q2. CAPTCHA-gated phishing climbed back to 3.1 million by September, mostly delivered as SVG attachments.
• About 141,000 malicious Teams call attempts. By September, 88% of the callers used ordinary personal names rather than "IT Support"-style names.

Attackers keep changing format. Exceptions are what stay the same, so they're worth more attention than any single technique.

How exceptions pile up

Microsoft's own explanation is fair to the people who create them: "An organization may create an exception to avoid interrupting a legitimate business workflow, but an overly broad exception can also weaken protection against messages impersonating that workflow."

The report doesn't say which settings were involved. In the Microsoft 365 tenants we review, these are the ones we usually find:

• Allow entries for whole domains of payroll, e-signature, invoicing or delivery services, added the week a genuine notification went to junk.
• Mail flow rules that bypass spam filtering for a partner, a scanner or a marketing platform, often matched on sender domain alone, which is the easiest thing to spoof.
• Users' safe senders lists, which carry years of one-off decisions with no review.
• Spoofing allowances created to stop a third-party sending service failing authentication, then never narrowed once the service was set up properly.

Each one made sense on the day. Very few have an owner, a reason written down or an end date. The spoofed messages in Microsoft's data failed authentication and were still identified as malicious. They got through because the exception came after the verdict.

Our view: an exception is a control, so govern it like one

A firewall rule that allows all traffic from a partner's address range would get questioned at the next review. An email allow entry for the same partner's whole domain usually doesn't. It should, because it does the same job. We'd apply four rules.

1. Every exception has an owner and a reason

Write down who asked, which workflow it protects and which messages it was meant to rescue. If nobody can answer, it goes.

2. Every exception is as narrow as possible

Allow a specific authenticated sender rather than a whole domain. Never bypass filtering for a domain that doesn't pass SPF, DKIM and DMARC. Fix the authentication instead.

3. Every exception expires

Set entries to expire and make renewal a conscious decision. Most of the exceptions we find were meant to be temporary.

4. What an exception lets through gets reviewed

This is the one most organisations miss. If a message would have been blocked except for an override, someone should see it. Defender for Office 365 records this. A starting point to tune:

EmailEvents
| where Timestamp > ago(30d)
| where DeliveryAction == "Delivered"
| where ThreatTypes has_any ("Phish", "Malware", "Spam")
| where OrgLevelAction == "Allow" or UserLevelAction == "Allow"
| summarize Messages = count(), Recipients = dcount(RecipientEmailAddress),
            Policies = make_set(strcat(OrgLevelPolicy, " / ", UserLevelPolicy), 10)
          by SenderFromDomain, ThreatTypes
| order by Messages desc

Run it once and you'll see which exceptions are doing the most work. Expect some surprises.

Where this fits with everything else

Tidying exceptions doesn't replace the controls that cope with what gets through. Phishing-resistant MFA, blocking device code flow and requiring managed devices still matter, because some messages will always reach someone. Our guides to phishing-as-a-service and business email compromise cover those. But it makes no sense to pay for detection and then switch it off for the senders attackers most like to impersonate.

How we help

Our Microsoft security consultancy reviews allow lists, mail flow rules and spoofing settings in Microsoft 365 and narrows or removes what isn't needed, without breaking the workflows they protect. On our managed service, our SOCs, staffed 24/7, investigate email that was delivered because of an override alongside the sign-ins that follow, so a message that slips through on an exception is caught at the next step.

If you'd like to know how many malicious messages your own exceptions let through last month, book a demo or talk to our team.