What is the SCL in Outlook?
The spam confidence level (SCL) is a number from -1 to 9 that Microsoft's filtering stamps in the X-Forefront-Antispam-Report header. Microsoft now says that in cloud organizations it does not decide whether a message is spam or what happens to it, and points to other values in the header, such as the CAT category.
Reading the result
Paste the headers of a message from an Outlook.com or Microsoft 365 mailbox. You get the filtering verdict (SFV) and category (CAT) first, then SCL and the bulk complaint level (BCL), then composite authentication with its reason code, and last every X-Forefront-Antispam-Report field with Microsoft's own meaning. A field Microsoft does not document is marked as such, never guessed at.
Common problems it finds
compauth=fail reason=001
Microsoft's reason 001: the message failed implicit authentication, and the From domain publishes no authentication records or only weak ones (SPF ~all or ?all, DMARC p=none). Aligned SPF and DKIM with a DMARC record is the fix.
A high BCL
BCL 8 or 9 means a bulk sender that draws many complaints. At or above the policy's threshold (7 by default, 6 in the Standard preset, 5 in Strict) the message goes to Junk, or to quarantine under Strict, according to Microsoft's BCL page.
SFV:SPM with authentication passing
Spam filtering marked the message as spam on its content. Authentication is not the problem then: look at what the message says and links to, and at the reputation of the sending IP and domains.
SCL read as the verdict
Microsoft says the same SCL value can appear on messages with different verdicts, so an SCL alone tells you little about why a message landed where it did. Read SFV and CAT.