How to whitelist certain domains in M365 as an admin:
To whitelist and blacklist domains in Microsoft 365 Exchange admin center, you need to create a spam policy at first, since spam filter feature will be removed from Exchange admin center by December 1, 2020, we recommend you create a spam policy in its new home - Security and Compliance Center, for detailed steps, please view below:
1. Log in to the M365 portal as an ADMIN
2. Security (Admin center)> Policies & Rules > Threat policies > Anti Spam
3. Click “Create a policy” button to create a new spam policy, fill in the name and description.
4. Expand “Allow lists” list and click Edit button next to “Allow domain” to add the domain that you want to whitelist, expand “Block lists” list and click Edit button next to “Block domain” to add the domain that you want to blacklist. Note: Only subdomain is allowed for allow domain and block domain, top-level domain is not allowed.
5. Select the recipient that you’d like to apply the policy to, add an exception if it is needed, then click Save button to save it