How does the Tenant Allow/Block List work in Microsoft 365?

The Tenant Allow/Block List is where Microsoft 365 admins overrule the filter. It holds six kinds of entries, each with its own expiry rules, limits and side effects, and getting one wrong can quarantine a partner's mail or let a spoofed message through.

This guide is the reference for the list itself. For the quick "block this sender" task, see how to block a sender or domain in Microsoft 365. For safe allow entries, see how to whitelist a sender safely.

What is the Tenant Allow/Block List?

The Tenant Allow/Block List is a page in the Microsoft Defender portal that lets admins "manually override filtering verdicts" for their whole organization (Microsoft Learn). Microsoft uses it during mail flow for email, and at time of click for links in email, Teams and Office apps.

Every Microsoft 365 organization with cloud mailboxes has it, with or without Defender for Office 365. Licenses only change how many entries you can store.

It has six tabs. The Teams tab blocks incoming Microsoft Teams communication from a domain or address and deletes existing messages; its block entries never expire. The other five handle email. Here's how they behave at the time of writing (October 2026):

Two terms first. The From address (5322.From) is the sender address people see in Outlook. The envelope sender (5321.MailFrom) is the hidden bounce address used during SMTP. Entries on the Domains & addresses tab match the From address only.

Where do you find the Tenant Allow/Block List?

In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists in the Rules section. The direct link is https://security.microsoft.com/tenantAllowBlockList.

To add or remove entries, you need the Organization Management or Security Administrator role group in Exchange Online, the Security Administrator role in Microsoft Entra ID, or the Defender XDR permission Detection tuning (manage). The Security Operator role group works only if the Tenant AllowBlockList Manager role is assigned directly in the Exchange admin center (Microsoft Learn). Global Reader and Security Reader give read-only access.

Why are allow entries so restricted?

Allow entries are restricted because, in Microsoft's words, "unnecessary allow entries expose your organization to malicious email that the system would otherwise filter." You can create allow entries directly for domains, addresses and URLs only to override four verdicts:

• Bulk
• Spam
• High confidence spam
• Phishing (not high confidence phishing)

For malware and high confidence phishing, and for any file allow, you must go through the Submissions page at https://security.microsoft.com/reportsubmission. Submit the item, choose I've confirmed it's clean, then Allow this message, Allow this URL or Allow this file. The Override verdicts column shows the difference: direct allows say "Up to regular confidence phishing", while sender allows created from submissions say "Up to high confidence phishing".

An allow entry is not a free pass. Microsoft says messages are delivered only if they "pass other checks in the filtering stack", and gives email authentication, URL filtering and file filtering as examples. That's the main reason the Tenant Allow/Block List is safer than a transport rule that sets the spam confidence level (SCL) to -1.

Expiry also works differently. Allow entries for senders, URLs and files stay for 45 days after the filter last needed them, then disappear. You can instead pick 1 day, 7 days or a date up to 30 days ahead. If Microsoft decides an allow entry is no longer needed, it removes it and the alert Removed an entry in Tenant Allow/Block List fires.

How do you add an entry?

The portal steps are the same pattern on every tab:

1. Open https://security.microsoft.com/tenantAllowBlockList and select the tab.
2. Select Add, then Allow or Block. (On the IP addresses tab, the buttons are Allow and Block directly.)
3. Enter up to 20 values, one per line.
4. Choose the expiry under Remove block entry after or Remove allow entry after.
5. Add an Optional note with the reason and a ticket number.
6. Select Add. Microsoft says the entry "should be active within 5 minutes."

In Exchange Online PowerShell, one set of cmdlets covers four tabs, selected with -ListType:

Use Get-TenantAllowBlockListItems -ListType Sender -Block to list entries, Set- to change expiry or notes, and Remove- to delete them. For direct allow entries, -RemoveAfter 45 gives the "45 days after last used" behavior, and leaving out both -ExpirationDate and -RemoveAfter has the same effect. Spoofed senders use their own cmdlets, covered next.

How do spoofed sender entries work?

A spoofed sender entry allows or blocks a domain pair: the address being spoofed plus the infrastructure sending it. Microsoft says "only the combination of the spoofed user and the sending infrastructure" is affected (Microsoft Learn). Use it when a legitimate service sends as a domain without passing authentication, such as a payroll system sending as your own domain. Our spoof intelligence guide explains where these detections come from.

The syntax is <spoofed user>, <sending infrastructure>. Example entries:

contoso.com, 192.168.100.100/24
chris@contoso.com, fabrikam.com
*, contoso.net

• Spoofed user is an address, a domain or *.
• Sending infrastructure is the domain from the source server's reverse DNS (PTR) record, a verified DKIM domain, the source IP as a /24 if there's no PTR record, or *.
• You can use a wildcard in one half, but not both. *, * isn't allowed.
• Choose Internal if the spoofed domain is one of your accepted domains, or External otherwise.

Microsoft warns that entries using a PTR domain fail if the PTR lookup fails, and recommends the organizational domain (contoso.com, not smtp.inbound.contoso.com). Check the record first with our PTR Lookup. The PowerShell equivalent is:

New-TenantAllowBlockListSpoofItems -Identity Default -Action Allow `
  -SpoofedUser payroll@yourdomain.example `
  -SendingInfrastructure payrollvendor.example -SpoofType Internal

Spoofed sender entries never expire, and you can store 1,024 in total across allows and blocks. Better still, ask the service to sign with DKIM for your domain so it passes DMARC and needs no exception.

How do URL and file entries work?

URL entries take up to 250 characters and follow strict wildcard rules (Microsoft Learn):

Ports, file extensions, Unicode and middle wildcards are invalid. Notice that a plain block entry is broad while a plain allow entry is narrow. Left-wildcard and tilde allow patterns are supported only through the advanced delivery policy, which is also the right place for third-party phishing simulation URLs.

File entries use the SHA256 hash, up to 64 characters. In Windows PowerShell:

Get-FileHash -Path "C:\Temp\invoice.html" -Algorithm SHA256

Microsoft matches the hash against "all files extracted during message analysis", including standard attachments, images in the message body and files inside supported attachment types. Perceptual hashes aren't supported, so a file changed by one byte needs a new entry.

How many entries can you have?

Limits depend on your license. Domains and addresses, URLs, files and IPv6 addresses each have the same separate limits:

Spoofed senders share a single pool of 1,024 entries. If you're near a limit, you're probably blocking addresses that spammers rotate daily. That's a filtering problem, not a list problem; see why spam gets through Microsoft 365.

What side effects should you know about?

• Blocks beat allows. Microsoft states that "block entries take precedence over allow entries."
• Sender blocks stop outbound mail. Users who write to a blocked domain or address get 550 5.7.703 Your message can't be delivered because messages to XXX, YYY are blocked by your organization using Tenant Allow Block List. The whole message fails for every recipient. Decode similar bounces with the SMTP error code lookup.
• Subdomains need their own entry. A block for contoso.com doesn't cover marketing.contoso.com. Add *.contoso.com too.
• URL blocks can quarantine good senders. Microsoft notes that a message containing a blocked URL or domain "can be classified as high confidence phishing... even if the sender is legitimate." If partner mail lands in quarantine, check your URL blocks first, then release the message.
• Impersonation isn't handled here. You can't allow a sender flagged by impersonation protection in Defender for Office 365. Submitting it adds the sender to the anti-phishing policy's trusted senders instead.
• Bulk insight shows your entries. The bulk senders insight's sender details show whether a Tenant Allow/Block List entry allowed or blocked each bulk sender (Microsoft Learn).

Tenant Allow/Block List hygiene checklist

• Every entry has a note with the reason, requester and ticket number.
• Permanent blocks are set to Never expire on purpose; temporary ones lapse.
• No allow entry covers your own domain or a large public domain.
• Each blocked domain also has a *.domain entry where subdomains matter.
• Spoofed sender allows are reviewed quarterly, since they never expire.
• Before adding an allow, the sender's SPF, DKIM and DMARC were checked, for example with the DMARC Checker.
• Blocked messages were also submitted to Microsoft on the Submissions page.

Next steps

1. Export what you have: Get-TenantAllowBlockListItems -ListType Sender | Format-Table Value,Action,ExpirationDate,Notes.
2. Repeat for Url, FileHash and IP, and run Get-TenantAllowBlockListSpoofItems.
3. Remove allow entries nobody can explain, and add notes to the rest.
4. Paste the headers of any surprising verdict into the Email Header Analyzer before you add a new entry.
5. If you'd rather keep allow and block decisions in one place in front of every mailbox, see how iBlockSpam works with Microsoft 365 and its approved and blocked sender lists.

Browse more guides on running email day to day.