You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/allow-deny-list.md
+20-20Lines changed: 20 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
3
3
title: Allow or block invites to specific organizations - Azure AD
4
-
description: Shows how an administrator can use the Azure portal or PowerShell to set an access or deny list to allow or block B2B users from certain domains.
4
+
description: Shows how an administrator can use the Azure portal or PowerShell to set an access or blocklist to allow or block B2B users from certain domains.
# Allow or block invitations to B2B users from specific organizations
20
20
21
-
You can use an allow list or a deny list to allow or block invitations to B2B collaboration users from specific organizations. For example, if you want to block personal email address domains, you can set up a deny list that contains domains like Gmail.com and Outlook.com. Or, if your business has a partnership with other businesses like Contoso.com, Fabrikam.com, and Litware.com, and you want to restrict invitations to only these organizations, you can add Contoso.com, Fabrikam.com, and Litware.com to your allow list.
21
+
You can use an allowlist or a blocklist to allow or block invitations to B2B collaboration users from specific organizations. For example, if you want to block personal email address domains, you can set up a blocklist that contains domains like Gmail.com and Outlook.com. Or, if your business has a partnership with other businesses like Contoso.com, Fabrikam.com, and Litware.com, and you want to restrict invitations to only these organizations, you can add Contoso.com, Fabrikam.com, and Litware.com to your allowlist.
22
22
23
-
This article discusses two ways to configure an allow or deny list for B2B collaboration:
23
+
This article discusses two ways to configure an allow or blocklist for B2B collaboration:
24
24
25
25
- In the portal by configuring collaboration restrictions in your organization's [External collaboration settings](external-collaboration-settings-configure.md)
26
26
- Through PowerShell
27
27
28
28
## Important considerations
29
29
30
-
- You can create either an allow list or a deny list. You can't set up both types of lists. By default, whatever domains are not in the allow list are on the deny list, and vice versa.
30
+
- You can create either an allowlist or a blocklist. You can't set up both types of lists. By default, whatever domains aren't in the allowlist are on the blocklist, and vice versa.
31
31
- You can create only one policy per organization. You can update the policy to include more domains, or you can delete the policy to create a new one.
32
-
- The number of domains you can add to an allow list or deny list is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allow list or deny list and any other parameters configured for other features.
33
-
- This list works independently from OneDrive for Business and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or deny list for OneDrive for Business and SharePoint Online. For more information, see [Restricted domains sharing in SharePoint Online and OneDrive for Business](https://support.office.com/article/restricted-domains-sharing-in-sharepoint-online-and-onedrive-for-business-5d7589cd-0997-4a00-a2ba-2320ec49c4e9).
34
-
- The list does not apply to external users who have already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation will fail.
32
+
- The number of domains you can add to an allowlist or blocklist is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allowlist or blocklist and any other parameters configured for other features.
33
+
- This list works independently from OneDrive for Business and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or blocklist for OneDrive for Business and SharePoint Online. For more information, see [Restricted domains sharing in SharePoint Online and OneDrive for Business](https://support.office.com/article/restricted-domains-sharing-in-sharepoint-online-and-onedrive-for-business-5d7589cd-0997-4a00-a2ba-2320ec49c4e9).
34
+
- The list doesn't apply to external users who have already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation will fail.
35
35
36
-
## Set the allow or deny list policy in the portal
36
+
## Set the allow or blocklist policy in the portal
37
37
38
38
By default, the **Allow invitations to be sent to any domain (most inclusive)** setting is enabled. In this case, you can invite B2B users from any organization.
39
39
40
-
### Add a deny list
40
+
### Add a blocklist
41
41
42
42
This is the most typical scenario, where your organization wants to work with almost any organization, but wants to prevent users from specific domains to be invited as B2B users.
43
43
44
-
To add a deny list:
44
+
To add a blocklist:
45
45
46
46
1. Sign in to the [Azure portal](https://portal.azure.com).
47
47
2. Select **Azure Active Directory** > **Users** > **User settings**.
@@ -55,14 +55,14 @@ To add a deny list:
55
55
56
56
After you set the policy, if you try to invite a user from a blocked domain, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
57
57
58
-
### Add an allow list
58
+
### Add an allowlist
59
59
60
-
This is a more restrictive configuration, where you can set specific domains in the allow list and restrict invitations to any other organizations or domains that aren't mentioned.
60
+
This is a more restrictive configuration, where you can set specific domains in the allowlist and restrict invitations to any other organizations or domains that aren't mentioned.
61
61
62
-
If you want to use an allow list, make sure that you spend time to fully evaluate what your business needs are. If you make this policy too restrictive, your users may choose to send documents over email, or find other non-IT sanctioned ways of collaborating.
62
+
If you want to use an allowlist, make sure that you spend time to fully evaluate what your business needs are. If you make this policy too restrictive, your users may choose to send documents over email, or find other non-IT sanctioned ways of collaborating.
63
63
64
64
65
-
To add an allow list:
65
+
To add an allowlist:
66
66
67
67
1. Sign in to the [Azure portal](https://portal.azure.com).
68
68
2. Select **Azure Active Directory** > **Users** > **User settings**.
@@ -74,20 +74,20 @@ To add an allow list:
74
74
75
75
6. When you're done, select **Save**.
76
76
77
-
After you set the policy, if you try to invite a user from a domain that's not on the allow list, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
77
+
After you set the policy, if you try to invite a user from a domain that's not on the allowlist, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
78
78
79
-
### Switch from allow list to deny list and vice versa
79
+
### Switch from allowlist to blocklist and vice versa
80
80
81
81
If you switch from one policy to the other, this discards the existing policy configuration. Make sure to back up details of your configuration before you perform the switch.
82
82
83
-
## Set the allow or deny list policy using PowerShell
83
+
## Set the allow or blocklist policy using PowerShell
84
84
85
85
### Prerequisite
86
86
87
87
> [!Note]
88
88
> The AzureADPreview Module is not a fully supported module as it is in preview.
89
89
90
-
To set the allow or deny list by using PowerShell, you must install the preview version of the Azure Active Directory Module for Windows PowerShell. Specifically, install the AzureADPreview module version 2.0.0.98 or later.
90
+
To set the allow or blocklist by using PowerShell, you must install the preview version of the Azure Active Directory Module for Windows PowerShell. Specifically, install the AzureADPreview module version 2.0.0.98 or later.
91
91
92
92
To check the version of the module (and see if it's installed):
93
93
@@ -128,7 +128,7 @@ If the module is not installed, or you don't have a required version, do one of
128
128
129
129
### Use the AzureADPolicy cmdlets to configure the policy
130
130
131
-
To create an allow or deny list, use the [New-AzureADPolicy](/powershell/module/azuread/new-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. The following example shows how to set a deny list that blocks the "live.com" domain.
131
+
To create an allow or blocklist, use the [New-AzureADPolicy](/powershell/module/azuread/new-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. The following example shows how to set a blocklist that blocks the "live.com" domain.
To set the allow or deny list policy, use the [Set-AzureADPolicy](/powershell/module/azuread/set-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. For example:
145
+
To set the allow or blocklist policy, use the [Set-AzureADPolicy](/powershell/module/azuread/set-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. For example:
0 commit comments