I can't imagine anyone using an "onmicrosoft" email address for a message they expect to get through spam filters. I've just blanket flagged any that aren't specific marked as whitelisted, which none are so far. Microsoft better get their act together, because they're letting their brand name become a spam filtering criterion: