Whitelisting senders is one of those settings that keep moving around in the Office 365 web console management circus.
To access and configure the Office 365 whitelist open up the Office 365 Security Center, aka Microsoft 365 Defender.
(you can also click Security in the Microsoft 365 Admin Center).
From there, select Policies & rules and click Threat Policies:
- Then select Anti-spam
- Then double click Anti-spam inbound policy (Default)
- On the right side, scroll to the bottom and select Edit allowed and blocked senders and domains
- On the right hand side, click Manage sender/domains
- from here you can allow/block domains and users
