Why Your Cold Emails Aren't Reaching M365 Inboxes (And What to Do Instead)

In May 2026, Microsoft rolled out a policy change that flipped B2B outreach on its head. Microsoft 365 tenants now quarantine email from unknown senders by default. The message does not land in spam; it does not appear in the inbox at all. It sits in a quarantine folder most users never check, and after a set number of days the system deletes it.

If your ideal customer profile runs on M365 (and statistically, they probably do), your cold email campaign just became invisible. The shift is not about deliverability tweaks or subject-line split tests. It is structural. Cold email to a stranger inside a protected tenant does not arrive.

This article explains what changed, why it happened, how to confirm whether your prospects are affected, and what warm LinkedIn outreach does that email no longer can.

What did Microsoft 365 change in 2026?

Microsoft enabled default quarantine for email from external senders who do not appear in the recipient's contacts, safe-sender list, or prior correspondence history. The policy rolled out to Enterprise and Business Premium tenants first, with broader deployment across commercial subscriptions through the spring.

The mechanics are simple. When an email arrives from a domain the recipient has never interacted with, Microsoft's Exchange Online Protection scans the sender reputation, DMARC alignment, and historical engagement. If the recipient has no prior relationship with the sender, the message bypasses the inbox entirely and moves to the tenant-level quarantine.

Quarantine is not spam. Spam folders are visible to the user. Quarantine is managed by the IT administrator, and in most organizations the end user never sees a notification. The email effectively vanishes.

Why did Microsoft make this change?

Volume. Microsoft reported that phishing attempts, business email compromise, and spam targeting M365 tenants more than doubled between 2023 and 2025. Default-allow for external email became a liability, and the trust model flipped to default-deny for unknown senders.

The policy is also a response to regulatory pressure. Data protection authorities in the EU and the UK have pushed enterprise software providers to adopt stronger default security postures, particularly around email, which remains the primary vector for credential theft and ransomware delivery.

From Microsoft's perspective, the change reduces support burden, lowers breach risk, and aligns with zero-trust architecture. From the perspective of a sales team running cold email campaigns, it closes the door.

How do you know if your prospects are affected?

Check the domain. If your prospect's email address ends in a domain managed by Microsoft 365 (you can verify by looking up the MX records, which will point to domains like example-com.mail.protection.outlook.com), assume the quarantine policy is active.

Look for engagement signals that disappeared. If your cold email open rates to enterprise contacts fell off a cliff in early 2026 and your bounce rate stayed flat, quarantine is the likely cause. Quarantined messages do not generate opens, clicks, or bounces. They generate silence.

Ask your prospects. If you have a relationship with a customer or a closed deal, ask whether they ever saw your initial outreach email. Many will say no. That is not a deliverability problem you can fix with a warmer IP or a better subject line. The email was never delivered to a place they could see it.

What does this mean for cold outreach?

Cold email to M365-protected inboxes is now structurally unreliable. You can still send the messages, but if the recipient has no prior relationship with you, the default behavior is quarantine. Your sequence, your personalization, your offer: none of it matters if the message never renders in front of the buyer.

The change does not affect email to contacts who have opted in, replied before, or added you to their safe-sender list. It affects the cold first touch, the moment when you reach out to someone who does not know you exist. That first message is now invisible by default.

Workarounds exist. Some senders try to game the system by sending from shared domains, by routing through third-party SMTP services, or by impersonating internal senders. All of these tactics violate Microsoft's acceptable-use policies, put your domain at risk of permanent blocklisting, and in some jurisdictions constitute wire fraud. The risk is not worth the temporary gain.

Why warm LinkedIn outreach works when email does not

LinkedIn is not email. It is a social platform where familiarity is built in public, in the feed, before the connection request ever lands. Microsoft's quarantine policy does not apply to LinkedIn messages because LinkedIn is not routing through Exchange Online Protection.

The play is simple. You identify the buyers. You comment on their posts every day for two weeks. The comments are real, relevant, and visible to the buyer in their notifications. Familiarity builds through repeated exposure. When the connection request finally arrives, it is not cold. It is warm. The buyer recognizes the name because they have seen it in their feed.

Once the connection is accepted, the conversation opens. You are now in their LinkedIn inbox, which they check. You are not in a quarantine folder managed by IT. The reply rate on a warmed connection request is several times higher than a cold one, because the mere-exposure effect has already done the work.

Well Met runs this play as a productized service. We comment daily on your buyers' posts, send warmed connection requests, handle replies, nurture the conversation, and book the call. The Your Profile plan ($697 per month) operates your own LinkedIn profile. The Rented Agent plan ($997 per month) gives you an additional operated profile to scale past your own network. Both include a $300 one-time setup. Roughly 100 comments per day, 100 to 200 connection requests per week, every reply handled, weekly reporting, all tooling covered.

What if I still want to use email?

Email still works for follow-up, for opted-in lists, for existing relationships, and for contacts who have already replied. It does not work reliably for the cold first touch to a stranger inside an M365 tenant.

If you are committed to email as the first touch, you need a warm introduction. A referral from a mutual connection, a co-marketing campaign with a trusted partner, or a conference opt-in list where the recipient expects to hear from exhibitors. All of those create the prior-relationship signal that tells Exchange Online Protection to deliver the message.

Another option is multi-channel. Start warm on LinkedIn, build familiarity, connect, then ask for the email address in the conversation. Once they have replied to you on LinkedIn, your email will have context, and the likelihood of quarantine drops. You are no longer unknown.

Is this change permanent?

Yes. Microsoft has no incentive to roll back default-quarantine. The policy reduces breach risk, aligns with regulatory expectations, and improves the user experience for the recipient. The fact that it disrupts cold email is a feature, not a bug, from Microsoft's perspective.

Other providers are watching. Google Workspace has tightened sender requirements significantly over the past two years, and while Gmail does not quarantine by default in the same way M365 does, the trend is clear. Email platforms are moving toward default-deny for unknown senders.

If your go-to-market motion relies on cold email as the primary first touch, 2026 is the year to rebuild it around warm outreach. The window for cold email to enterprise inboxes has closed.