Rather than try and cover this quite complex subject and redo work that has already been documented by Microsoft, here are some links to the relevant areas of the Microsoft documentation relating to this subject and it's relevance to Office365:


For end users:



For Admins:



If you have any questions or you would like to white list a user or domain that you regularly do business with, then get in touch and as an Office 365 Administrator we can change the configuration of your organisations SPAM/Protection policy settings.