You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/tenant-allow-block-list-about.md
+10-3Lines changed: 10 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ manager: deniseb
8
8
audience: ITPro
9
9
ms.topic: how-to
10
10
ms.localizationpriority: medium
11
-
ms.date: 09/19/2024
11
+
ms.date: 09/20/2024
12
12
search.appverid:
13
13
- MET150
14
14
ms.collection:
@@ -32,7 +32,7 @@ appliesto:
32
32
33
33
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you might disagree with the EOP or Microsoft Defender for Office 365 filtering verdict. For example, a good message might be marked as bad (a false positive), or a bad message might be allowed through (a false negative).
34
34
35
-
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override the Defender for Office 365 or EOP filtering verdicts. The list is used during mail flow for incoming messages from external senders.
35
+
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override the Defender for Office 365 or EOP filtering verdicts. The list is used during mail flow or time of click for incoming messages from external senders.
36
36
37
37
Entries for **Domains and email addresses** and **Spoofed senders** apply to internal messages sent within the organization. Block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
38
38
@@ -43,6 +43,7 @@ For usage and configuration instructions, see the following articles:
43
43
-**Domains and email addresses** and **spoofed senders**: [Allow or block emails using the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md)
44
44
-**Files**: [Allow or block files using the Tenant Allow/Block List](tenant-allow-block-list-files-configure.md)
45
45
-**URLs**: [Allow or block URLs using the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md).
46
+
-**IP addresses**: [Allow or block IP addresses using the Tenant Allow/Block List](tenant-allow-block-list-ip-addresses-configure.md).
46
47
47
48
These articles contain procedures in the Microsoft Defender portal and in PowerShell.
48
49
@@ -70,7 +71,11 @@ In the Tenant Allow/Block List, you can also directly create block entries for t
70
71
71
72
-**[Spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders)**: If you manually override an existing allow verdict from [spoof intelligence](anti-spoofing-spoof-intelligence.md), the blocked spoofed sender becomes a manual block entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List.
72
73
73
-
By default, block entries for [domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses), [files](tenant-allow-block-list-files-configure.md#create-block-entries-for-files) and [URLs](tenant-allow-block-list-urls-configure.md#create-block-entries-for-urls) expire after 30 days, but you can set them to expire up 90 days or to never expire. Block entries for [spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders) never expire.
74
+
-**[IP addresses](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses)**: If you manually create a block entry, all incoming email messages from that IP address are dropped at the edge of the service.
75
+
76
+
By default, block entries for [domains and email addresses](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-domains-and-email-addresses), [files](tenant-allow-block-list-files-configure.md#create-block-entries-for-files) and [URLs](tenant-allow-block-list-urls-configure.md#create-block-entries-for-urls) expire after 30 days, but you can set them to expire up 90 days or to never expire.
77
+
78
+
Block entries for [spoofed senders](tenant-allow-block-list-email-spoof-configure.md#create-block-entries-for-spoofed-senders) and [IP addresses](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses) never expire.
74
79
75
80
## Allow entries in the Tenant Allow/Block List
76
81
@@ -82,6 +87,8 @@ In most cases, you can't directly create allow entries in the Tenant Allow/Block
82
87
- If spoof intelligence already blocked the message as spoofing, use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to [report the email to Microsoft](submissions-admin.md#report-good-email-to-microsoft) as **I've confirmed it's clean**, and then select **Allow this message**.
83
88
- You can proactively create [an allow entry for a spoofed sender](tenant-allow-block-list-email-spoof-configure.md#create-allow-entries-for-spoofed-senders) on the **Spoofed sender** tab in the Tenant Allow/Block List before [spoof intelligence](anti-spoofing-spoof-intelligence.md) identifies and blocks the message as spoofing.
84
89
90
+
-**IP Addresses**: You can proactively create an [an allow entry for an IP address](tenant-allow-block-list-ip-addresses-configure.md#create-block-entries-for-ip-addresses) on the **IP addresses** tab in the Tenant Allow/Block List to override the IP filters for incoming messages.
91
+
85
92
The following list describes what happens in the Tenant Allow/Block List when you submit something to Microsoft as a false positive on the **Submissions** page:
86
93
87
94
-**Email attachments** and **URLs**: An allow entry is created and the entry appears on the **Files** or **URLs** tab in the Tenant Allow/Block List respectively.
0 commit comments