Quick answer
Right-click the message → Junk → Not Junk, and add the sender or their whole domain to Safe Senders. If it's happening to lots of staff, the fix belongs at the mail-filtering level, not each inbox.
WHY IT HAPPENS
The filter is doing its job — a bit too well.
Outlook and Microsoft 365 filter spam automatically using sender reputation, content and rules. Legitimate senders sometimes get caught — especially brand-new contacts, bulk senders, or senders whose email authentication (SPF/DKIM/DMARC) isn't set up well. To the filter they simply look less trustworthy, so their mail gets tucked into Junk to be safe.
THE FIX
Work through these in order.
- Mark it Not JunkRight-click the message and choose Junk → Not Junk. This moves it back to your Inbox and tells Outlook it got this one wrong.
- Add the sender or their domain to Safe SendersGo to Junk → Junk E-mail Options → Safe Senders → Add. Enter the person's address, or use @theirdomain.com to trust everyone at a whole company.
- Check the Blocked Senders listStill in Junk E-mail Options, open the Blocked Senders tab and make sure the sender or their domain isn't accidentally listed there.
- Lower the Junk filter levelIf too much good mail is being caught, open Junk E-mail Options → Options and set the protection level to Low so only the most obvious junk is filtered.
- Check a mail Rule isn't moving itGo to File → Manage Rules & Alerts and look for any rule quietly filing that sender into Junk or another folder. Disable or delete it if so.
- Look in Quarantine (Microsoft 365)In Microsoft 365 the message may be held in Quarantine rather than Junk. In Outlook on the web (or the security portal), find it and choose Release and allow the sender.
- Fix it org-wide with ITIf it's happening across the business, ask IT to allow the sender or domain at the Microsoft 365 filtering level, and to check the sender's email authentication so their mail is trusted for everyone at once.
Don't over-whitelist. Attackers spoof trusted domains, so blanket "safe sender" rules can backfire and let real phishing through. If staff constantly rescue good email from Junk — or miss client emails altogether — that's a filtering-tuning job IT should do once, centrally, rather than everyone loosening their own inbox.
