How do you block a sender or domain in Microsoft 365?

Microsoft 365 gives you five places to block a sender, and they behave differently. Some quarantine the mail, some send it to Junk Email, some also stop your staff from writing back, and some quietly expire after 30 days.

This guide shows which to use, the exact steps in the Defender portal and PowerShell, and how long each block lasts. If you want the opposite, see our guide to allowing a sender safely.

Which blocking method should you use in Microsoft 365?

Microsoft lists the options from most to least recommended (Microsoft Learn):

1. Block entries for domains and email addresses in the Tenant Allow/Block List.
2. Outlook Blocked Senders, which affect one mailbox.
3. Blocked sender or blocked domain lists in anti-spam policies.
4. Exchange mail flow rules (transport rules).
5. The IP Block List in the default connection filter policy.

Here's how they compare:

For most admins, the answer is the Tenant Allow/Block List. Use the others only when it can't do what you need.

How do you block a sender with the Tenant Allow/Block List?

You need the Security Administrator role, Organization Management, or another role Microsoft lists for the Tenant Allow/Block List (Microsoft Learn).

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists in the Rules section. The direct link is https://security.microsoft.com/tenantAllowBlockList.
2. Check that the Domains & addresses tab is selected.
3. Select Add, then Block.
4. In Domains & addresses, enter one address or domain per line, up to 20 at a time.
5. Under Remove block entry after, choose 1 day, 7 days, 30 days (the default), Never expire or Specific date (at most 90 days ahead).
6. Add a note saying why, so the next admin knows. Then select Add.

Microsoft says an entry "should be active within 5 minutes." The same thing in Exchange Online PowerShell:

New-TenantAllowBlockListItems -ListType Sender -Block `
  -Entries "invoices@bad-example.com","bad-example.net" `
  -NoExpiration `
  -Notes "Invoice fraud attempts, ticket 1042"

Use -ExpirationDate instead of -NoExpiration for a temporary block. To review what's there, run Get-TenantAllowBlockListItems -ListType Sender -Block. To remove an entry, run Remove-TenantAllowBlockListItems -ListType Sender -Entries "bad-example.net".

What a Tenant Allow/Block List block does

Microsoft's Tenant Allow/Block List article says mail from blocked domains and addresses is "marked as high confidence phishing and then moved to quarantine" (Microsoft Learn). Microsoft's older blocklist overview still says these messages are marked high confidence spam and handled by the anti-spam policy, but both Tenant Allow/Block List articles say high confidence phishing. Users can't release high confidence phishing themselves, so you'll handle any mistakes. Some other points:

• It checks the From address. Entries apply to the 5322.From address users see, not the envelope sender (5321.MailFrom).
• It covers internal and external senders.
• It blocks outbound mail too. Your users can't send to a blocked domain or address. They get 550 5.7.703 ... blocked by your organization using Tenant Allow Block List, and the whole message is refused for every recipient, even if only one matched.
• Subdomains need their own entry. Microsoft notes that an entry for contoso.com blocks only contoso.com, and *.contoso.com blocks subdomains but not the domain itself. Add both to cover everything.
• Blocks beat allows. In the Tenant Allow/Block List, "block entries take precedence over allow entries."

Entry limits

Limits depend on your licence (Microsoft Learn):

If you're close to the limit, you're probably blocking individual spam addresses that change every day. That's a sign the filter needs tuning, not a longer list.

How long does a block last?

This is the detail that catches people out. A Tenant Allow/Block List block on a domain or address expires after 30 days unless you change it. You can pick up to 90 days, or Never expire. Blocks for spoofed senders and IP addresses never expire (Microsoft Learn).

Blocks you create from the Submissions page, by selecting Block all emails from this sender or domain, also land in the Tenant Allow/Block List, so the same 30-day default applies.

Outlook Blocked Senders entries, anti-spam policy lists and mail flow rules don't expire. They stay until someone removes them, which is its own problem: old blocks pile up and nobody remembers why. Add notes and review the lists every quarter.

When should you use an anti-spam policy block list instead?

Use the Blocked senders and domains lists in an anti-spam policy when you want to stop inbound mail but still let staff write to that domain. Microsoft points to this list for exactly that case (Microsoft Learn).

Messages from listed senders are marked High confidence spam, and the policy's action for that verdict applies (Microsoft Learn). In the default policy, that action is Junk Email. In the Standard and Strict preset policies, it's quarantine.

1. Go to Email & collaboration > Policies & rules > Threat policies > Anti-spam (https://security.microsoft.com/antispam).
2. Open the policy, then edit the Allow & block list section.
3. Under Blocked, select Manage (nn) sender(s) or Block domains, add the entries and save.

Two catches. The lists hold about 1,000 entries, and the portal accepts only 30, so use PowerShell for more. And you can't add blocked lists to the Standard or Strict preset policies, whose settings override custom policies for anyone they cover (Microsoft Learn). If you use presets, this method may do nothing for those users.

When does a mail flow rule make sense for blocking?

A mail flow rule earns its place when you need something the lists can't do:

• Reject with a custom bounce message instead of quarantining.
• Match on more than the sender, such as a subject phrase plus a sender domain.
• Check the envelope sender as well as the From address.

The SenderDomainIs condition "matches domains and subdomains," and SenderAddressLocation lets you check the header, the envelope or both (Microsoft Learn). Start in audit mode so you can see what it would catch:

New-TransportRule -Name "Block bad-example.com" `
  -SenderDomainIs "bad-example.com" `
  -SenderAddressLocation HeaderOrEnvelope `
  -RejectMessageReasonText "Mail from this domain is not accepted." `
  -Mode Audit

Audit writes what the rule would have done to the message trace logs without touching delivery. When you're happy, switch it with Set-TransportRule -Identity "Block bad-example.com" -Mode Enforce. If you'd rather set a custom enhanced status code, -RejectMessageEnhancedStatusCode accepts 5.7.1 or 5.7.900 to 5.7.999, but Microsoft's reference says combining it with -RejectMessageReasonText resets one of the two to a default value, so use one or the other.

Microsoft's warning applies: "It's easy to create rules that block too many messages or that don't block enough messages." Use specific conditions and watch the rule's hits. For a wider set of useful rules, see our guide to mail flow rules for security.

How do users block a sender for their own mailbox?

When one person is bothered by one newsletter or contact, let them handle it. Users can add addresses and domains to their Blocked Senders list (Microsoft Support):

• New Outlook for Windows and Outlook on the web: Settings > Mail > Junk email, add the address under Blocked senders or the domain under Blocked domains, then Save.
• Classic Outlook for Windows: right-click a message, then Block > Block Sender.

Microsoft stamps these messages with SFV:BLK and treats them as spam. They go to Junk Email or quarantine depending on the anti-spam policy (Microsoft Learn). Admins can manage the same list in PowerShell:

Set-MailboxJunkEmailConfiguration -Identity "ori@example.com" `
  -BlockedSendersAndDomains @{Add="shopping@fabrikam.com"}

The @{Add=...} syntax keeps the user's existing entries. Without it, you overwrite the whole list.

What about blocking by IP address?

Only as a last resort. Microsoft says to use the IP Block List in the default connection filter policy "only then" when the other options won't work, to keep it small, and to avoid ranges that belong to shared or consumer services (Microsoft Learn). It accepts IPv4 ranges from /24 to /32. One IP often sends for thousands of unrelated senders, so a careless entry blocks real mail.

Why doesn't blocking stop most spam?

Blocking works on senders who keep the same address: a persistent marketer, a former supplier, a harasser. It does little against spam and phishing campaigns, which rotate addresses and domains faster than you can add them. A block also checks the From address, which an attacker can choose.

So pair each block with a report. Microsoft advises submitting blocked messages for analysis, because confirmed bad sources get blocked for everyone without list upkeep (Microsoft Learn). Before you block, read the headers in our Email Header Analyzer to check the real sending domain. Our guide to Microsoft 365 spam headers explains what each value means. If a flood of sign-up confirmations is the problem, blocking won't keep up. See our guide to email bombing instead.

If you need blocks applied before mail reaches Microsoft 365, a filtering gateway on your MX keeps its own lists. iBlockSpam's approved and blocked sender lists are one example.

Next steps

1. Open https://security.microsoft.com/tenantAllowBlockList and review existing block entries, their expiry dates and notes.
2. Move permanent blocks to Never expire on purpose, and let temporary ones lapse.
3. Find old mail flow rules that block senders, and replace simple ones with Tenant Allow/Block List entries.
4. Submit the messages behind each block to Microsoft from the Submissions page.
5. If spam keeps getting through despite blocks, work through why spam gets through Microsoft 365.

Browse more guides on running email day to day.