You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/tenant-allow-block-list-about.md
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ appliesto:
32
32
33
33
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you might disagree with the EOP or Microsoft Defender for Office 365 filtering verdict. For example, a good message might be marked as bad (a false positive), or a bad message might be allowed through (a false negative).
34
34
35
-
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override the Defender for Office 365 or EOP filtering verdicts. The list is used during mail flow or time of click for incoming messages from external senders.
35
+
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override the Defender for Office 365 or EOP filtering verdicts. The list is used during mail flow or time of click for incoming messages from external senders.
36
36
37
37
Entries for **Domains and email addresses** and **Spoofed senders** apply to internal messages sent within the organization. Block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
38
38
@@ -43,7 +43,7 @@ For usage and configuration instructions, see the following articles:
43
43
-**Domains and email addresses** and **spoofed senders**: [Allow or block emails using the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md)
44
44
-**Files**: [Allow or block files using the Tenant Allow/Block List](tenant-allow-block-list-files-configure.md)
45
45
-**URLs**: [Allow or block URLs using the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md).
46
-
-**IP addresses**: [Allow or block IPs using the Tenant Allow/Block List](tenant-allow-block-list-IP-configure.md).
46
+
-**IP addresses**: [Allow or block IP addresses using the Tenant Allow/Block List](tenant-allow-block-list-ip-addresses-configure.md).
47
47
48
48
These articles contain procedures in the Microsoft Defender portal and in PowerShell.
49
49
@@ -71,9 +71,11 @@ In the Tenant Allow/Block List, you can also directly create block entries for t
71
71
72
72
-**[Spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders)**: If you manually override an existing allow verdict from [spoof intelligence](anti-spoofing-spoof-intelligence.md), the blocked spoofed sender becomes a manual block entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List.
73
73
74
-
-**[IP addresses](tenant-allow-block-list-IP-configure.md#create-block-entries-for-IP-addresses)**: If you manually create a block, all incoming emails from that incoming sending IP address will get dropped on the edge.
74
+
-**[IP addresses](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses)**: If you manually create a block entry, all incoming email messages from that IP address are dropped at the edge of the service.
75
75
76
-
By default, block entries for [domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses), [files](tenant-allow-block-list-files-configure.md#create-block-entries-for-files) and [URLs](tenant-allow-block-list-urls-configure.md#create-block-entries-for-urls) expire after 30 days, but you can set them to expire up 90 days or to never expire. Block entries for [spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders) and [IP addresses](tenant-allow-block-list-email-IP-configure.md#create-block-entries-for-IP-addresses)never expire.
76
+
By default, block entries for [domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses), [files](tenant-allow-block-list-files-configure.md#create-block-entries-for-files) and [URLs](tenant-allow-block-list-urls-configure.md#create-block-entries-for-urls) expire after 30 days, but you can set them to expire up 90 days or to never expire.
77
+
78
+
Block entries for [spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders) and [IP addresses](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses) never expire.
77
79
78
80
## Allow entries in the Tenant Allow/Block List
79
81
@@ -85,8 +87,7 @@ In most cases, you can't directly create allow entries in the Tenant Allow/Block
85
87
- If spoof intelligence already blocked the message as spoofing, use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to [report the email to Microsoft](submissions-admin.md#report-good-email-to-microsoft) as **I've confirmed it's clean**, and then select **Allow this message**.
86
88
- You can proactively create [an allow entry for a spoofed sender](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders) on the **Spoofed sender** tab in the Tenant Allow/Block List before [spoof intelligence](anti-spoofing-spoof-intelligence.md) identifies and blocks the message as spoofing.
87
89
88
-
-**IP Addresses**:
89
-
- You can proactively create an [an allow entry for an IP address](tenant-allow-block-list-email-IP-configure.md#create-allow-entries-for-IP-addresses) on the **IP addresses** tab in the Tenant Allow/Block List to override the IP filters for incoming message from them.
90
+
-**IP Addresses**: You can proactively create an [an allow entry for an IP address](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses) on the **IP addresses** tab in the Tenant Allow/Block List to override the IP filters for incoming messages.
90
91
91
92
The following list describes what happens in the Tenant Allow/Block List when you submit something to Microsoft as a false positive on the **Submissions** page:
Copy file name to clipboardExpand all lines: defender-office-365/tenant-allow-block-list-ip-addresses-configure.md
+16-19Lines changed: 16 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,10 +36,10 @@ This article describes how admins can manage entries for IP addresses in the Mic
36
36
37
37
- To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell).
38
38
39
-
-Only support IPv6 addresses in the following format:
40
-
- Single IPv6 address in Colon-Hexadecimal Notation. for example, 2001:0db8:85a3:0000:0000:8a2e:0370:7334.
41
-
- Single IPv6 address in Zero Compression. for example, 2001:db8::1 represents 2001:0db8:0000:0000:0000:0000:0000:0001.
42
-
- CIDR IPv6 range. for example, 2001:0db8::/32. 1-128 range is supported
39
+
- IPv6 addresses are supported only in the following formats:
40
+
- Single addresses in colon-hexadecimal format. For example, 2001:0db8:85a3:0000:0000:8a2e:0370:7334.
41
+
- Single addresses in zero compression format. For example, 2001:db8::1 represents 2001:0db8:0000:0000:0000:0000:0000:0001.
42
+
- CIDR IPv6 range. For example, 2001:0db8::/32. 1-128 range is supported.
43
43
44
44
- Entry limits for IP addresses:
45
45
-**Exchange Online Protection**: The maximum number of allow entries is 500, and the maximum number of block entries is 500 (1000 IP entries in total).
@@ -66,9 +66,9 @@ This article describes how admins can manage entries for IP addresses in the Mic
66
66
67
67
## Create allow entries for IP addresses
68
68
69
-
The allow entry only override the IP filters for that sending IP address. You can create allow entries for IP addresses directly in the Tenant Allow/Block List, using either of the following methods:
69
+
The allow entry overrides only the IP filters for the specified sending IP address.
70
70
71
-
- From the **IP addresses** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section.
71
+
You can create allow entries for IP addresses directly in the Tenant Allow/Block List as described in this section.
72
72
73
73
### Use the Microsoft Defender portal to create allow entries for IP addresses in the Tenant Allow/Block List
74
74
@@ -85,7 +85,7 @@ This article describes how admins can manage entries for IP addresses in the Mic
85
85
-**Remove allow entry after**: Select from the following values:
86
86
-**1 day**
87
87
-**7 days**
88
-
-**30 days**
88
+
-**30 days**
89
89
-**Never expire** (default)
90
90
-**Specific date**: The maximum value is 90 days from today.
91
91
@@ -95,7 +95,7 @@ This article describes how admins can manage entries for IP addresses in the Mic
95
95
96
96
Back on the **IP addresses** tab, the entry is listed.
97
97
98
-
#####Use PowerShell to create allow entries for IP addresses in the Tenant Allow/Block List
98
+
#### Use PowerShell to create allow entries for IP addresses in the Tenant Allow/Block List
99
99
100
100
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
101
101
@@ -106,17 +106,16 @@ New-TenantAllowBlockListItems -ListType IP -Allow -Entries "IPAddress1","IPAddre
106
106
This example adds an allow entry for the specified IP address that never expires.
107
107
108
108
```powershell
109
-
New-TenantAllowBlockListItems -ListType IP -Allow -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
109
+
New-TenantAllowBlockListItems -ListType IP -Allow -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
110
110
```
111
111
112
112
For detailed syntax and parameter information, see [New-TenantAllowBlockListItems](/powershell/module/exchange/new-tenantallowblocklistitems).
113
113
114
-
115
114
## Create block entries for IP addresses
116
115
117
-
Email messages send from the blocked IP addresses are dropped on the edge. To create block entries for IP addresses, use either of the following methods:
116
+
You can create block entries for IP addresses directly in the Tenant Allow/Block List as described in this section.
118
117
119
-
- From the **IP addresses** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section.
118
+
Incoming email messages from IP addresses in block entries are blocked at the edge of the service.
120
119
121
120
### Use the Microsoft Defender portal to create block entries for IP addresses in the Tenant Allow/Block List
122
121
@@ -133,7 +132,7 @@ Email messages send from the blocked IP addresses are dropped on the edge. To cr
133
132
-**Remove block entry after**: Select from the following values:
134
133
-**1 day**
135
134
-**7 days**
136
-
-**30 days**
135
+
-**30 days**
137
136
-**Never expire** (default)
138
137
-**Specific date**: The maximum value is 90 days from today.
139
138
@@ -143,7 +142,7 @@ Email messages send from the blocked IP addresses are dropped on the edge. To cr
143
142
144
143
Back on the **IP addresses** tab, the entry is listed.
145
144
146
-
#####Use PowerShell to create block entries for IP addresses in the Tenant Allow/Block List
145
+
#### Use PowerShell to create block entries for IP addresses in the Tenant Allow/Block List
147
146
148
147
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
149
148
@@ -154,12 +153,11 @@ New-TenantAllowBlockListItems -ListType IP -Block -Entries "IPAddress1","IPAddre
154
153
This example adds an block entry for the specified IP address that never expires.
155
154
156
155
```powershell
157
-
New-TenantAllowBlockListItems -ListType IP -Block -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
156
+
New-TenantAllowBlockListItems -ListType IP -Block -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
158
157
```
159
158
160
159
For detailed syntax and parameter information, see [New-TenantAllowBlockListItems](/powershell/module/exchange/new-tenantallowblocklistitems).
161
160
162
-
163
161
## Use the Microsoft Defender portal to view entries for IP addresses in the Tenant Allow/Block List
164
162
165
163
In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules**\>**Threat Policies**\>**Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
@@ -248,19 +246,18 @@ For existing IP addresses entries, you can change the expiration date and note.
248
246
249
247
When you're finished in the **Edit IP addresses** flyout, select **Save**.
250
248
251
-
252
249
### Use PowerShell to modify existing allow or block entries for IP addresses in the Tenant Allow/Block List
253
250
254
251
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
255
252
256
253
```powershell
257
-
Set-TenantAllowBlockListItems -ListType IP <-Ids <Identity value> | -Entries <Value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]
254
+
Set-TenantAllowBlockListItems -ListType IP <-Ids <Identity value> | -Entries <Value> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]
258
255
```
259
256
260
257
This example changes the expiration date of the specified IP address block entry.
261
258
262
259
```powershell
263
-
Set-TenantAllowBlockListItems -ListType IP -Entries "2001:db8:3333:4444:5555:6666:7777:8882" -ExpirationDate "9/1/2022"
260
+
Set-TenantAllowBlockListItems -ListType IP -Entries "2001:db8:3333:4444:5555:6666:7777:8882" -ExpirationDate "9/1/2024"
264
261
```
265
262
266
263
For detailed syntax and parameter information, see [Set-TenantAllowBlockListItems](/powershell/module/exchange/set-tenantallowblocklistitems).
0 commit comments