Not receiving Microsoft 365 passcodes for encrypted messages

For encrypted Microsoft 365 messages that require a one-time passcode, non-delivery of the code is almost always due to spam/junk filtering, quarantine, or security throttling/blocks on verification messages.

Use these checks and steps:

1. Check the correct mailbox and folders

• Verification codes sent by email can only go to the address configured as the sign-in/verification method (primary alias or added verification email), not to arbitrary addresses.
• Confirm that the address shown in the prompt is actually the mailbox being checked.
• Look in Junk/Spam and any server-side filtered folders for the passcode message.
• For SharePoint/secure-link style flows, Microsoft specifically notes that external recipients often find the verification code in Junk/Spam rather than Inbox.

2. Look for quarantine or aggressive filtering

• DKIM/DMARC and other filtering can cause one-time passcode messages to be treated as spam or quarantined.
• If using Microsoft 365 with admin controls, an admin should check quarantine in the Microsoft Purview portal for messages containing one-time passcodes.

3. Avoid excessive or repeated code requests

• Excessive or repetitive requests for verification codes can cause Microsoft to temporarily block sending codes to protect against abuse.
• If many attempts have already been made, wait for the temporary block to clear before trying again.

4. Check for security blocks or unusual-activity flags

• If Microsoft detects unusual activity or heavy compromised traffic from a region, it may delay or block verification messages.
• These conditions are usually temporary and resolve automatically after a period of time; avoid repeated attempts during that period.

5. Confirm the email address is valid and allowed

• Ensure the email address used for the passcode is entered correctly and is not a VOIP/SMS-only scenario (VOIP numbers are not supported for codes; a mobile number is required when phone is used).
• For email-based codes, verify that messages from @accountprotection.microsoft.com are not blocked and are marked as trusted senders so future codes arrive in Inbox.

6. If opening encrypted mail from non-Microsoft services

• When receiving an encrypted message and choosing the one-time passcode option, the passcode is sent by email and must be entered within its validity window (typically 15 minutes). If it expires or never arrives, reopen the encrypted message and restart the process once the above checks are complete.

If, after these steps, passcodes still never arrive for any encrypted messages from different senders, an administrator should review spam/quarantine policies and any transport rules that might be blocking or redirecting messages from Microsoft’s verification services.

References:

• Message encryption FAQ
• Troubleshoot Microsoft verification code issues
• Open encrypted and protected messages
• No verification code when external recipients access shared secure links