Whitelist mailboxes from being blocked from sending emails due to the "User restricted from sending email" alert policy in microsoft365 security?

Question

I have a couple of mailboxes that are periodically being blocked from sending emails due to the "User restricted from sending email" alert policy within the security and compliance center in microsoft 365. I can unblock them fine, but would like to see if there is a way to just whitelist them. I have set their spam confidence level to high within the mail flow rules in exchange online, but other than that is there any way to definitively whitelist them? They aren't even sending extraordinarily high amounts too frequently. But paradoxically as we are a cyber security company, we need to occasionally test that our own product's alerts to this kind of behaviour are working.

Answer 1

As far as I know, the default alert policy "User restricted from sending email" generates an alert when someone in your organization is restricted from sending outbound mail: Default alert policies

According to the official docs, the available method to unblock these users is to remove blocked users from the Restricted users, besides it, perhaps you could Create safe sender lists in EOP for these users in EOP and see if there is any difference:

1. Mail flow rules

2. Outlook Safe Senders

3. IP Allow List (connection filtering)

4. Allowed sender lists or allowed domain lists (anti-spam policies)