Skip to content

Commit 6affbe6

Browse files
dhairyyadhairyya
committed
IP address support in TABL
Added documentation to add support for IP address in Tenant Allow Block List
1 parent f24bc71 commit 6affbe6

6 files changed

+326
-3
lines changed

‎defender-office-365/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,8 @@
240240
href: tenant-allow-block-list-files-configure.md
241241
- name: Allow or block URLs using the Tenant Allow/Block List
242242
href: tenant-allow-block-list-urls-configure.md
243+
- name: Allow or block IP addresses using the Tenant Allow/Block List
244+
href: tenant-allow-block-list-IP-configure.md
243245
- name: Admin submissions
244246
href: submissions-admin.md
245247
- name: Create block sender lists

‎defender-office-365/tenant-allow-block-list-IP-configure.md‎

Lines changed: 312 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,312 @@
1+
---
2+
title: Allow or block IP addresses using the Tenant Allow/Block List
3+
f1.keywords:
4+
- NOCSH
5+
ms.author: chrisda
6+
author: chrisda
7+
manager: deniseb
8+
audience: ITPro
9+
ms.topic: how-to
10+
ms.localizationpriority: medium
11+
search.appverid:
12+
- MET150
13+
ms.collection:
14+
- m365-security
15+
- tier1
16+
description: Admins can learn how to allow or block IP addresses in the Tenant Allow/Block List.
17+
ms.service: defender-office-365
18+
ms.date: 09/20/2024
19+
appliesto:
20+
- ✅ <a href="https://learn.microsoft.com/defender-office-365/eop-about" target="_blank">Exchange Online Protection</a>
21+
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
22+
- ✅ <a href="https://learn.microsoft.com/defender-xdr/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a>
23+
---
24+
25+
# Allow or block IP addresses using the Tenant Allow/Block List
26+
27+
[!INCLUDE [MDO Trial banner](../includes/mdo-trial-banner.md)]
28+
29+
In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, admins can create and manage entries for IP addresses in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md).
30+
31+
This article describes how admins can manage entries for IP addresses in the Microsoft Defender portal and in Exchange Online PowerShell.
32+
33+
## What do you need to know before you begin?
34+
35+
- You open the Microsoft Defender portal at <https://security.microsoft.com>. To go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>. To go directly to the **Submissions** page, use <https://security.microsoft.com/reportsubmission>.
36+
37+
- To connect to Exchange Online PowerShell, see [Connect to Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell). To connect to standalone EOP PowerShell, see [Connect to Exchange Online Protection PowerShell](/powershell/exchange/connect-to-exchange-online-protection-powershell).
38+
39+
- Only support IPv6 addresses in the following format:
40+
- Single IPv6 address in Colon-Hexadecimal Notation. for example, 2001:0db8:85a3:0000:0000:8a2e:0370:7334.
41+
- Single IPv6 address in Zero Compression. for example, 2001:db8::1 represents 2001:0db8:0000:0000:0000:0000:0000:0001.
42+
- CIDR IPv6 range. for example, 2001:0db8::/32. 1-128 range is supported
43+
44+
- Entry limits for IP addresses:
45+
- **Exchange Online Protection**: The maximum number of allow entries is 500, and the maximum number of block entries is 500 (1000 IP entries in total).
46+
- **Defender for Office 365 Plan 1**: The maximum number of allow entries is 1000, and the maximum number of block entries is 1000 (2000 IP entries in total).
47+
- **Defender for Office 365 Plan 2**: The maximum number of allow entries is 5000, and the maximum number of block entries is 10000 (15000 IP entries in total).
48+
49+
- An entry should be active within 5 minutes.
50+
51+
- You need to be assigned permissions before you can do the procedures in this article. You have the following options:
52+
- [Microsoft Defender XDR Unified role based access control (RBAC)](/defender-xdr/manage-rbac) (If **Email & collaboration** \> **Exchange Online permissions** permissions is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **Active**. Affects the Defender portal only, not PowerShell): **Authorization and settings/Security settings/Detection tuning (manage)** or **Authorization and settings/Security settings/Core security settings (read)**.
53+
- [Exchange Online permissions](/exchange/permissions-exo/permissions-exo):
54+
- _Add and remove entries from the Tenant Allow/Block List_: Membership in one of the following role groups:
55+
- **Organization Management** or **Security Administrator** (Security admin role).
56+
- **Security Operator** (Tenant AllowBlockList Manager).
57+
- _Read-only access to the Tenant Allow/Block List_: Membership in one of the following role groups:
58+
- **Global Reader**
59+
- **Security Reader**
60+
- **View-Only Configuration**
61+
- **View-Only Organization Management**
62+
- [Microsoft Entra permissions](/entra/identity/role-based-access-control/manage-roles-portal): Membership in the **Global Administrator**<sup>\*</sup>, **Security Administrator**, **Global Reader**, or **Security Reader** roles gives users the required permissions _and_ permissions for other features in Microsoft 365.
63+
64+
> [!IMPORTANT]
65+
> <sup>\*</sup> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
66+
67+
## Create allow entries for IP addresses
68+
69+
The allow entry only override the IP filters for that sending IP address. You can create allow entries for IP addresses directly in the Tenant Allow/Block List, using either of the following methods:
70+
71+
- From the **IP addresses** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section.
72+
73+
### Use the Microsoft Defender portal to create allow entries for IP addresses in the Tenant Allow/Block List
74+
75+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
76+
77+
2. On the **Tenant Allow/Block Lists** page, select the **IP addresses** tab.
78+
79+
3. On the **IP addresses** tab, select :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Allow**.
80+
81+
4. In the **Allow IP addresses** flyout that opens, configure the following settings:
82+
83+
- **Add IP address**: Enter one IP address per line, up to a maximum of 20.
84+
85+
- **Remove allow entry after**: Select from the following values:
86+
- **1 day**
87+
- **7 days**
88+
- **30 days**
89+
- **Never expire** (default)
90+
- **Specific date**: The maximum value is 90 days from today.
91+
92+
- **Optional note**: Enter descriptive text for why you're allowing the IP addresses.
93+
94+
When you're finished in the **Allow IP addresses** flyout, select **Add**.
95+
96+
Back on the **IP addresses** tab, the entry is listed.
97+
98+
##### Use PowerShell to create allow entries for IP addresses in the Tenant Allow/Block List
99+
100+
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
101+
102+
```powershell
103+
New-TenantAllowBlockListItems -ListType IP -Allow -Entries "IPAddress1","IPAddress2",..."IPAddressN" <-ExpirationDate Date | -NoExpiration> [-Notes <String>]
104+
```
105+
106+
This example adds an allow entry for the specified IP address that never expires.
107+
108+
```powershell
109+
New-TenantAllowBlockListItems -ListType IP -Allow -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
110+
```
111+
112+
For detailed syntax and parameter information, see [New-TenantAllowBlockListItems](/powershell/module/exchange/new-tenantallowblocklistitems).
113+
114+
115+
## Create block entries for IP addresses
116+
117+
Email messages send from the blocked IP addresses are dropped on the edge. To create block entries for IP addresses, use either of the following methods:
118+
119+
- From the **IP addresses** tab on the **Tenant Allow/Block Lists** page or in PowerShell as described in this section.
120+
121+
### Use the Microsoft Defender portal to create block entries for IP addresses in the Tenant Allow/Block List
122+
123+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
124+
125+
2. On the **Tenant Allow/Block Lists** page, select the **IP addresses** tab.
126+
127+
3. On the **IP addresses** tab, select :::image type="icon" source="media/m365-cc-sc-create-icon.png" border="false"::: **Block**.
128+
129+
4. In the **Block IP addresses** flyout that opens, configure the following settings:
130+
131+
- **Add IP address**: Enter one IP address per line, up to a maximum of 20.
132+
133+
- **Remove block entry after**: Select from the following values:
134+
- **1 day**
135+
- **7 days**
136+
- **30 days**
137+
- **Never expire** (default)
138+
- **Specific date**: The maximum value is 90 days from today.
139+
140+
- **Optional note**: Enter descriptive text for why you're blocking the IP addresses.
141+
142+
When you're finished in the **Block IP addresses** flyout, select **Add**.
143+
144+
Back on the **IP addresses** tab, the entry is listed.
145+
146+
##### Use PowerShell to create block entries for IP addresses in the Tenant Allow/Block List
147+
148+
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
149+
150+
```powershell
151+
New-TenantAllowBlockListItems -ListType IP -Block -Entries "IPAddress1","IPAddress2",..."IPAddressN" <-ExpirationDate Date | -NoExpiration> [-Notes <String>]
152+
```
153+
154+
This example adds an block entry for the specified IP address that never expires.
155+
156+
```powershell
157+
New-TenantAllowBlockListItems -ListType IP -Block -Entries "2001:db8:3333:4444:5555:6666:7777:8882"-NoExpiration
158+
```
159+
160+
For detailed syntax and parameter information, see [New-TenantAllowBlockListItems](/powershell/module/exchange/new-tenantallowblocklistitems).
161+
162+
163+
## Use the Microsoft Defender portal to view entries for IP addresses in the Tenant Allow/Block List
164+
165+
In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
166+
167+
Select the **IP addresses** tab.
168+
169+
On the **IP addresses** tab, you can sort the entries by clicking on an available column header. The following columns are available:
170+
171+
- **Value**: The IP address.
172+
- **Action**: The available values are **Allow** or **Block**.
173+
- **Modified by**
174+
- **Last updated**
175+
- **Last used date**: The date the entry was last used in the filtering system to override the verdict.
176+
- **Remove on**: The expiration date.
177+
- **Notes**
178+
179+
To filter the entries, select :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filter** flyout that opens:
180+
181+
- **Action**: The available values are **Allow** and **Block**.
182+
- **Never expire**: :::image type="icon" source="media/scc-toggle-on.png" border="false"::: or :::image type="icon" source="media/scc-toggle-off.png" border="false":::
183+
- **Last updated**: Select **From** and **To** dates.
184+
- **Last used date**: Select **From** and **To** dates.
185+
- **Remove on**: Select **From** and **To** dates.
186+
187+
When you're finished in the **Filter** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.
188+
189+
Use the :::image type="icon" source="media/m365-cc-sc-search-icon.png" border="false"::: **Search** box and a corresponding value to find specific entries.
190+
191+
To group the entries, select :::image type="icon" source="media/m365-cc-sc-group-icon.png" border="false"::: **Group** and then select **Action**. To ungroup the entries, select **None**.
192+
193+
### Use PowerShell to view entries for IP addresses in the Tenant Allow/Block List
194+
195+
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
196+
197+
```powershell
198+
Get-TenantAllowBlockListItems -ListType IP [-Allow] [-Block] [-Entry <IPaddress>] [<-ExpirationDate Date | -NoExpiration>]
199+
```
200+
201+
This example returns all allowed and blocked IP addresses.
202+
203+
```powershell
204+
Get-TenantAllowBlockListItems -ListType IP
205+
```
206+
207+
This example returns information for the specified IP address.
208+
209+
```powershell
210+
Get-TenantAllowBlockListItems -ListType IP -Entry "2001:db8:3333:4444:5555:6666:7777:8882"
211+
```
212+
213+
This example filters the results by blocked IP address.
214+
215+
```powershell
216+
Get-TenantAllowBlockListItems -ListType IP -Block
217+
```
218+
219+
For detailed syntax and parameter information, see [Get-TenantAllowBlockListItems](/powershell/module/exchange/get-tenantallowblocklistitems).
220+
221+
## Use the Microsoft Defender portal to modify entries for IP addresses in the Tenant Allow/Block List
222+
223+
For existing IP addresses entries, you can change the expiration date and note.
224+
225+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
226+
227+
2. Select the **IP addresses** tab
228+
229+
3. On the **IP addresses** tab, select the entry from the list by selecting the check box next to the first column, and then select the :::image type="icon" source="media/m365-cc-sc-edit-icon.png" border="false"::: **Edit** action that appears.
230+
231+
4. In the **Edit IP addresses** flyout that opens, the following settings are available:
232+
- **Block entries**:
233+
- **Remove block entry after**: Select from the following values:
234+
- **1 day**
235+
- **7 days**
236+
- **30 days**
237+
- **Never expire**
238+
- **Specific date**: The maximum value is 90 days from today.
239+
- **Optional note**
240+
- **Allow entries**:
241+
- **Remove allow entry after**: Select from the following values:
242+
- **1 day**
243+
- **7 days**
244+
- **30 days**
245+
- **Never expire**
246+
- **Specific date**: The maximum value is 30 days from today.
247+
- **Optional note**
248+
249+
When you're finished in the **Edit IP addresses** flyout, select **Save**.
250+
251+
252+
### Use PowerShell to modify existing allow or block entries for IP addresses in the Tenant Allow/Block List
253+
254+
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
255+
256+
```powershell
257+
Set-TenantAllowBlockListItems -ListType IP <-Ids <Identity value> | -Entries <Value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]
258+
```
259+
260+
This example changes the expiration date of the specified IP address block entry.
261+
262+
```powershell
263+
Set-TenantAllowBlockListItems -ListType IP -Entries "2001:db8:3333:4444:5555:6666:7777:8882" -ExpirationDate "9/1/2022"
264+
```
265+
266+
For detailed syntax and parameter information, see [Set-TenantAllowBlockListItems](/powershell/module/exchange/set-tenantallowblocklistitems).
267+
268+
## Use the Microsoft Defender portal to remove entries for IP addresses from the Tenant Allow/Block List
269+
270+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
271+
272+
2. Select the **IP addresses** tab.
273+
274+
3. On the **IP addresses** tab, do one of the following steps:
275+
276+
- Select the entry from the list by selecting the check box next to the first column, and then select the :::image type="icon" source="media/m365-cc-sc-delete-icon.png" border="false"::: **Delete** action that appears.
277+
- Select the entry from the list by clicking anywhere in the row other than the check box. In the details flyout that opens, select :::image type="icon" source="media/m365-cc-sc-delete-icon.png" border="false"::: **Delete** at the top of the flyout.
278+
279+
> [!TIP]
280+
> To see details about other entries without leaving the details flyout, use :::image type="icon" source="media/updownarrows.png" border="false"::: **Previous item** and **Next item** at the top of the flyout.
281+
282+
4. In the warning dialog that opens, select **Delete**.
283+
284+
Back on the **IP addresses** tab, the entry is no longer listed.
285+
286+
> [!TIP]
287+
> You can select multiple entries by selecting each check box, or select all entries by selecting the check box next to the **Value** column header.
288+
289+
### Use PowerShell to remove entries for IP addresses from the Tenant Allow/Block List
290+
291+
In [Exchange Online PowerShell](/powershell/exchange/connect-to-exchange-online-powershell), use the following syntax:
292+
293+
```powershell
294+
Remove-TenantAllowBlockListItems -ListType IP <-Ids <Identity value> | -Entries <Value>>
295+
```
296+
297+
This example removes the specified IP address block from the Tenant Allow/Block List.
298+
299+
```powershell
300+
Remove-TenantAllowBlockListItems -ListType IP -Entries "2001:db8:3333:4444:5555:6666:7777:8882"
301+
```
302+
303+
For detailed syntax and parameter information, see [Remove-TenantAllowBlockListItems](/powershell/module/exchange/remove-tenantallowblocklistitems).
304+
305+
## Related articles
306+
307+
- [Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft](submissions-admin.md)
308+
- [Report false positives and false negatives](submissions-outlook-report-messages.md)
309+
- [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md)
310+
- [Allow or block emails in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md)
311+
- [Allow or block URLs in the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md)
312+
- [Allow or block files in the Tenant Allow/Block List](tenant-allow-block-list-files-configure.md)

0 commit comments

Comments
 (0)