The Tenant Allow/Block List is where you override Microsoft's filtering verdicts. You use it to block a phishing domain, a malicious URL or a file, or to let a legitimate service send as your domain. It's easy to use and just as easy to misuse: block entries do more than most admins expect, and allow entries have deliberate limits. In this post I'll explain what each entry type does, how to create entries in the portal and in PowerShell, and how to verify them.
Errors this guide fixes
550 5.7.703 Your message can't be delivered because messages to XXX, YYY are blocked by your organization using Tenant Allow Block List.NDR
How it works#
The list is in the Microsoft Defender portal at Email & collaboration › Policies & rules › Threat policies › Tenant Allow/Block Lists (in the Rules section). It's applied during mail flow and at time of click. Sender entries match the From address that users see (5322.From), not the envelope sender, and they apply to both internal and external senders. New entries take effect within about five minutes. In a list, block entries take precedence over allow entries.
| Entry type | What a block entry does | How you get an allow entry |
|---|---|---|
| Domains & addresses | Inbound mail is marked high confidence phishing and quarantined. Users also can't send to the blocked address or domain. | Directly, for bulk, spam, high confidence spam and phishing verdicts. Through Submissions, for malware and high confidence phishing. |
| URLs | Messages containing the URL are quarantined as high confidence phishing | Same as domains & addresses |
| Files | Messages with the file are blocked as malware and quarantined | Through Submissions only |
| Spoofed senders | The domain pair is treated as phishing; the anti-spam policy's phishing action decides what happens | Directly as a domain pair, or by overriding spoof intelligence or reporting through Submissions |
| IP addresses (IPv6) | Mail from the address is rejected at the edge of the service | Directly; an allow bypasses IP-based checks |
Expiry matters more than people think. Block entries for domains and addresses, URLs and files expire after 30 days by default; you can extend that to 90 days or to never. Spoofed sender and IP address entries never expire. Allow entries are removed 45 days after the last time they were used (when the filters see the item as clean), unless you choose an expiry of up to 30 days. Allow entries for spoofed senders never expire.
Prerequisites#
- Permissions: Organization Management or Security Administrator in Exchange Online, the Security Administrator role in Microsoft Entra ID, or the matching Defender XDR unified RBAC permission (Detection tuning, manage). Security Operator (with the Tenant AllowBlockList Manager role) works only when it's assigned directly in the Exchange admin center.
- Limits for domains and addresses: 500 allow and 500 block entries without Defender for Office 365, 1,000 of each with Plan 1, and 5,000 allow plus 10,000 block entries with Plan 2. Spoofed senders share 1,024 entries.
Step-by-step#
1. Block a sender or domain#
On the Domains & addresses tab, select Add › Block, enter up to 20 values, and set Remove block entry after (the default is 30 days). A block on contoso.com doesn't cover subdomains, and *.contoso.com doesn't cover the domain itself, so add both:
Connect-ExchangeOnline
New-TenantAllowBlockListItems -ListType Sender -Block -Entries "fabrikam-billing.com","*.fabrikam-billing.com" `
-NoExpiration -Notes "Invoice phishing campaign"
Get-TenantAllowBlockListItems -ListType Sender -BlockAnyone who then writes to that domain gets this NDR, and the whole message is blocked for every recipient, not just the blocked one:
550 5.7.703 Your message can't be delivered because messages to XXX, YYY are blocked by your organization using Tenant Allow Block List.Want spam treatment rather than high confidence phishing? Use the blocked senders or domains list in an anti-spam policy instead.
2. Block URLs and files#
New-TenantAllowBlockListItems -ListType Url -Block -Entries "login-portal.fabrikam-billing.com" -NoExpiration
New-TenantAllowBlockListItems -ListType FileHash -Block -Entries "<SHA256 hash>" -NoExpirationRemember that a URL or domain block hits every message that contains it, even from a legitimate sender. If good mail suddenly lands in quarantine as high confidence phishing, check your URL and domain blocks first.
3. Create allow entries the right way#
For a false positive, report the message on the Submissions page as I've confirmed it's clean and select Allow this message. That's the only way to override malware and high confidence phishing. It also creates entries only for what the filters actually flagged (sender, URL or file). My quarantine guide walks through it. Direct allow entries work for lower verdicts:
New-TenantAllowBlockListItems -ListType Sender -Allow -Entries "billing@partner.example" -RemoveAfter 45 -Notes "Misclassified as spam"Impersonation false positives are different. Submitting them adds the sender to Trusted senders and domains in the anti-phishing policy that caught them, not to this list.
4. Allow or block a spoofed sender#
A spoofed sender entry is a domain pair: the spoofed user (the From address or domain) plus the sending infrastructure. The infrastructure is the PTR domain of the sending IP, a verified DKIM domain or, when there's no PTR, the IP/24 range. Only that exact pair is affected. Here a mailing service sends as your own domain:
New-TenantAllowBlockListSpoofItems -Identity Default -Action Allow -SpoofedUser contoso.com `
-SendingInfrastructure 203.0.113.25/24 -SpoofType Internal
Get-TenantAllowBlockListSpoofItems -Action Allow -SpoofType InternalYou can put a wildcard in the spoofed user or in the infrastructure, but not in both. If you use a domain for the infrastructure, it has to match the PTR shown for the connecting IP in the Authentication-Results header. Microsoft recommends the organizational domain, so use contoso.com rather than smtp.inbound.contoso.com. The lasting fix is still correct SPF, DKIM and DMARC for the real sender.
Verify#
- On each tab, check Last used date to see whether an entry is actually matching mail, and Remove on to see when it expires.
- Send a test from a blocked external address. It should land in quarantine as high confidence phishing. A test sent to a blocked domain should come back with the 5.7.703 NDR.
- Open the message in Explorer or Real-time detections and check the Overrides section of the email entity page. It shows which overrides affected the verdict.
- With Plan 2, find allow overrides on mail that had no threat at all. Those are candidates for removal:
EmailEvents
| where OrgLevelAction == "Allow" and ThreatTypes == ""
| summarize count() by SenderFromAddress
| top 10 by count_Tips & gotchas#
- Silent expiry. A 30-day block that disappears looks like "the block stopped working". Choose the expiry on purpose.
- Outbound side effects. Blocking a domain your users also write to breaks their replies, with 5.7.703.
- Wrong tool for simulations. Third-party phishing simulation URLs belong in the advanced delivery policy, not in URL allow entries.
- Self-cleaning allows. Microsoft removes allow entries it no longer needs. The Removed an entry in Tenant Allow/Block List alert tells you when it does.
- Gateway in front? Fix the routing first with Enhanced Filtering for Connectors, then add spoofed sender allows only where you still need them.
