Validating through firewall
Mange your connection filter settings by adding IP addresses to IP Allow and IP Block lists, and by selecting the Enable safe list option, which should reduce the number of false positives (good mail that’s classified as spam) you receive.Learn more at Configure the connection filter policy.While most conditions are available in both deployments, there is a small set that is specific to a particular deployment scenario. If you want to inspect email attachments for messages in-transit within your organization, you can do this by setting up mail flow rules.Then, take action on the messages that were inspected based on the content or characteristics of those attachments.Once you are satisfied that the rule is working in the manner intended, change the rule mode to Enforce.
This can be done by using the Any attachment file extension includes these words condition.
For more spam settings that apply to the whole organization, take a look at How to help ensure that a message isn't marked as spam or Block email spam with the Office 365 spam filter to prevent false negative issues.
These are helpful if you have administrator-level control and you want to prevent false positives or false negatives.
Learn more at Configure your spam filter policies and Advanced spam filtering (ASF) options.
If you are using the default content filter action, Move message to Junk Email folder, in order to ensure that this action will work with on-premises mailboxes, you must configure Exchange mail flow rules, also called transport rules, on your on-premises servers to detect spam headers added by EOP.If you are in a hybrid deployment configuration, with part of your organization on-premises and part in Office 365, you can create rules that apply to the entire organization.