diff --git a/filter-rules.py b/filter-rules.py
index b9c7b54..72bc0b6 100644
--- a/filter-rules.py
+++ b/filter-rules.py
@@ -6,9 +6,7 @@ BLOCK_EMAIL = [
     'diversity@oregonstate.edu',
     'jramiro@pagerduty.com',
     'info@snowflake.com',
-    'lisa@duo.com',
-    'cortana@microsoft.com',
-    'Viva-noreply@microsoft.com'
+    'lisa@duo.com'
 ]
 
 BLOCK_KEYWORDS = [
@@ -163,24 +161,30 @@ def filter_message(self, message):
         move_message(message, 'alerts-sig')
         return
 
-    # filter conference spam
-    if 'brocks+conf@onid.oregonstate.edu' in normalized_to:
-        self._log_result(message, 'deleting conference spam')
-        message.delete()
-        return
-
     # filter backup-nightly
     if 'backup-nightly@lists.oregonstate.edu' in message.to:
         self._log_result(message, 'moving to backup-nightly')
         move_message(message, 'backup-nightly')
         return
 
+    # delete conference spam
+    if 'brocks+conf@onid.oregonstate.edu' in normalized_to:
+        self._log_result(message, 'deleting conference spam')
+        message.delete()
+        return
+
     # delete HP alert spam
     if normalized_from == 'alerts@alerts.mail.hpe.com':
         self._log_result(message, 'deleting HP alert spam')
         message.delete()
         return
 
+    # delete Microsoft spam
+    if 'viva-noreply@microsoft.com' in normalized_from:
+        self._log_result(message, 'deleting M$ spam')
+        message.delete()
+        return
+
     # delete other spam
     if is_in_message(normalized['BLOCK_ANNOYING'], message):
         self._log_result(message, 'junking spam containing annoying content')