Review the multi-recipient behavior of first-contact email safety tips

Source facts

For messages with multiple recipients, Microsoft uses a majority model to decide whether the first-contact safety tip appears and who receives it. When most recipients rarely or never hear from the sender, affected recipients receive a warning referring to some recipients of the message. Microsoft advises reviewing this behavior where exposing recipient communication habits is a concern. Microsoft Learn.

Applicability

Use this review before enabling the first-contact safety tip in Microsoft 365 anti-phishing policy, or when explaining inconsistent-looking warnings on a message addressed to several people.

DSE recommendation

DSE recommends including the wording and recipient behavior in the policy owner’s review. Explain the warning as a contextual cue and agree on the organization’s acceptable disclosure before choosing the policy setting. If an alternative is needed, have the messaging team review the documented mail-flow approach and its intended scope.

Verification

Use approved internal test recipients with different sender histories to inspect the displayed wording. Record the recipient set and expected result without disclosing unnecessary correspondence history. Confirm that support guidance explains the multi-recipient behavior, and retain the policy decision separately from any claim that an individual sender is malicious.

Official references

Microsoft Learn: Anti-phishing policies in cloud organizations. Source reviewed September 17, 2026.