Called out the 7 rollover logic

Called out how submission rollover from email address into domain

Author: dhairyya

defender-office-365/submissions-admin.md

@@ -309,6 +309,7 @@ After a few moments, the associated allow entries appear on the **Domains & addr
 > - By default, allow entries for domains and email addresses are kept for 45 days after the filtering system determines that the entity is clean, and then the allow entry is removed. For all other values like 1 day, 7 days, 30 days, specific date the allow entry expire at the defined date. By default, allow entries for spoofed senders never expire.
 > - For messages that were incorrectly blocked by [domain or user impersonation protection](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365), the allow entry for the domain or sender is not created in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains** section in the [anti-phishing policy](anti-phishing-policies-mdo-configure.md#use-the-microsoft-defender-portal-to-modify-anti-phishing-policies) that detected the message.
 > - When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** on the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>.
+> - If you have allowed atleast 7 email addresses from a particular domain inside Tenant Allow/Block List, submissions will automatically rollup the email addresses into a domain allow entry. This happens when submission is trying to add an email address allow for that domain. 
 
 ### Report good email attachments to Microsoft