Introduction

It has been brought to our attention that Microsoft recently updated their anti-phising engine in Microsoft 365 which has led to increase in HCS-Company Microsoft Services invoices being marked as spam due to:

  • Brand Impersonation (our company has the name Microsoft in it)
  • Different Return Path than sender email address (we use SendGrid to send email)
  • Request for payment (which is kind of the point with invoices)


Mail Flow rule in Office 365 for safely receiving HCS-Company Microsoft Service invoices

  1. Login to the Exchange Admin Center at Exchange admin center (microsoft.com) 
  2. Click Rules
  3. Add A rule - Create new Rule
  4. Click More options... to have all conditions and actions become available, before actually creating the rule:
  5. Give the rule a meaningful name, for example: HCS-MS invoice reception
  6. Click on *Apply this rul if.., select A message header includes. For Specify header name use Authentication-Results. For specify words or phrases use dmarc=pass and using the + button add dmarc=bestguesspass
  7. Add an condition for the sender's domain is.. with the value hcs-company.com
  8. Add an Action Modify the Message Properties followed by Set the message header to this value....  The Message header is X-ETR. The header value is: Bypass spam filtering for authenticated sender 'hcs-company.com'
  9. Add another Action Modify the Message Properties followed by Set the Spam Confidence Level (SCL) to Bypass Spam filtering
  10. Leave the rest of the options at default values and click [Save] to save the Mail Flow Rule