# How does the Tenant Allow/Block List work in Microsoft 365?

URL: https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Running email day to day
Author: iBlockSpam Team

> How the Microsoft 365 Tenant Allow/Block List works: every entry type, default expiry, license limits, spoofed sender pairs, URL syntax and PowerShell.

## Short answer

The Tenant Allow/Block List is a Microsoft Defender portal page (security.microsoft.com/tenantAllowBlockList) where admins override Microsoft 365 filtering verdicts for senders, spoofed sender pairs, URLs, file hashes and IPv6 addresses. Block entries for senders, URLs and files expire after 30 days by default. Most allow entries are removed 45 days after last use. Blocks always beat allows.

The Tenant Allow/Block List is where Microsoft 365 admins overrule the filter. It holds six kinds of entries, each with its own expiry rules, limits and side effects, and getting one wrong can quarantine a partner's mail or let a spoofed message through.

This guide is the reference for the list itself. For the quick "block this sender" task, see [how to block a sender or domain in Microsoft 365](https://iblockspam.com/blog/block-sender-or-domain-microsoft-365). For safe allow entries, see [how to whitelist a sender safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace).

## What is the Tenant Allow/Block List?

The Tenant Allow/Block List is a page in the Microsoft Defender portal that lets admins "manually override filtering verdicts" for their whole organization ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)). Microsoft uses it during mail flow for email, and at time of click for links in email, Teams and Office apps.

Every Microsoft 365 organization with cloud mailboxes has it, with or without Defender for Office 365. Licenses only change how many entries you can store.

It has six tabs. The Teams tab blocks incoming Microsoft Teams communication from a domain or address and deletes existing messages; its block entries never expire. The other five handle email. Here's how they behave at the time of writing (October 2026):

| Tab | Matches | What a block does | Block default expiry | Allow default expiry |
|---|---|---|---|---|
| Domains & addresses | The From address (`5322.From`) | High confidence phishing, quarantined; also blocks outbound mail | 30 days (up to 90 or never) | 45 days after last used |
| Spoofed senders | A pair: spoofed user + sending infrastructure | Marked phishing; the anti-spam policy's action applies | Never expires | Never expires |
| URLs | Links in messages, at delivery and click | High confidence phishing, quarantined | 30 days (up to 90 or never) | 45 days after last used |
| Files | SHA256 hash of an attachment or embedded file | Malware, quarantined | 30 days (up to 90 or never) | 45 days after last used |
| IP addresses | IPv6 sending addresses only | Dropped at the edge of the service | Never expire (default) | Never expire (default) |

Two terms first. The **From address** (`5322.From`) is the sender address people see in Outlook. The **envelope sender** (`5321.MailFrom`) is the [hidden bounce address](https://iblockspam.com/blog/return-path-vs-from-address) used during SMTP. Entries on the Domains & addresses tab match the From address only.

## Where do you find the Tenant Allow/Block List?

In the [Microsoft Defender portal](https://security.microsoft.com), go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Tenant Allow/Block Lists** in the **Rules** section. The direct link is `https://security.microsoft.com/tenantAllowBlockList`.

To add or remove entries, you need the **Organization Management** or **Security Administrator** role group in Exchange Online, the **Security Administrator** role in Microsoft Entra ID, or the Defender XDR permission **Detection tuning (manage)**. The **Security Operator** role group works only if the Tenant AllowBlockList Manager role is assigned directly in the Exchange admin center ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)). Global Reader and Security Reader give read-only access.

## Why are allow entries so restricted?

Allow entries are restricted because, in Microsoft's words, "unnecessary allow entries expose your organization to malicious email that the system would otherwise filter." You can create allow entries directly for domains, addresses and URLs only to override four verdicts:

- Bulk
- Spam
- High confidence spam
- Phishing (not high confidence phishing)

For **malware** and **high confidence phishing**, and for any file allow, you must go through the **Submissions** page at `https://security.microsoft.com/reportsubmission`. Submit the item, choose **I've confirmed it's clean**, then **Allow this message**, **Allow this URL** or **Allow this file**. The **Override verdicts** column shows the difference: direct allows say "Up to regular confidence phishing", while sender allows created from submissions say "Up to high confidence phishing".

An allow entry is not a free pass. Microsoft says messages are delivered only if they "pass other checks in the filtering stack", and gives email authentication, URL filtering and file filtering as examples. That's the main reason the Tenant Allow/Block List is safer than a transport rule that sets the spam confidence level (SCL) to -1.

Expiry also works differently. Allow entries for senders, URLs and files stay for **45 days after the filter last needed them**, then disappear. You can instead pick 1 day, 7 days or a date up to 30 days ahead. If Microsoft decides an allow entry is no longer needed, it removes it and the alert **Removed an entry in Tenant Allow/Block List** fires.

## How do you add an entry?

The portal steps are the same pattern on every tab:

1. Open `https://security.microsoft.com/tenantAllowBlockList` and select the tab.
2. Select **Add**, then **Allow** or **Block**. (On the IP addresses tab, the buttons are **Allow** and **Block** directly.)
3. Enter up to 20 values, one per line.
4. Choose the expiry under **Remove block entry after** or **Remove allow entry after**.
5. Add an **Optional note** with the reason and a ticket number.
6. Select **Add**. Microsoft says the entry "should be active within 5 minutes."

In Exchange Online PowerShell, one set of cmdlets covers four tabs, selected with `-ListType`:

| Tab | `-ListType` value | Example |
|---|---|---|
| Domains & addresses | `Sender` | `New-TenantAllowBlockListItems -ListType Sender -Block -Entries "bad.example" -NoExpiration` |
| URLs | `Url` | `New-TenantAllowBlockListItems -ListType Url -Block -Entries "~bad.example" -ExpirationDate 12/31/2026` |
| Files | `FileHash` | `New-TenantAllowBlockListItems -ListType FileHash -Block -Entries "<SHA256>" -NoExpiration` |
| IP addresses (IPv6) | `IP` | `New-TenantAllowBlockListItems -ListType IP -Block -Entries "2001:db8::/32" -NoExpiration` |

Use `Get-TenantAllowBlockListItems -ListType Sender -Block` to list entries, `Set-` to change expiry or notes, and `Remove-` to delete them. For direct allow entries, `-RemoveAfter 45` gives the "45 days after last used" behavior, and leaving out both `-ExpirationDate` and `-RemoveAfter` has the same effect. Spoofed senders use their own cmdlets, covered next.

## How do spoofed sender entries work?

A spoofed sender entry allows or blocks a **domain pair**: the address being spoofed plus the infrastructure sending it. Microsoft says "only the combination of the spoofed user *and* the sending infrastructure" is affected ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)). Use it when a legitimate service sends as a domain without passing authentication, such as a payroll system sending as your own domain. Our [spoof intelligence guide](https://iblockspam.com/blog/microsoft-365-spoof-intelligence) explains where these detections come from.

The syntax is `<spoofed user>, <sending infrastructure>`. Example entries:

```text
contoso.com, 192.168.100.100/24
chris@contoso.com, fabrikam.com
*, contoso.net
```

- **Spoofed user** is an address, a domain or `*`.
- **Sending infrastructure** is the domain from the source server's reverse DNS (PTR) record, a verified DKIM domain, the source IP as a `/24` if there's no PTR record, or `*`.
- You can use a wildcard in one half, but not both. `*, *` isn't allowed.
- Choose **Internal** if the spoofed domain is one of your accepted domains, or **External** otherwise.

Microsoft warns that entries using a PTR domain fail if the PTR lookup fails, and recommends the organizational domain (`contoso.com`, not `smtp.inbound.contoso.com`). Check the record first with our [PTR Lookup](https://iblockspam.com/tools/ptr-lookup). The PowerShell equivalent is:

```powershell
New-TenantAllowBlockListSpoofItems -Identity Default -Action Allow `
  -SpoofedUser payroll@yourdomain.example `
  -SendingInfrastructure payrollvendor.example -SpoofType Internal
```

Spoofed sender entries never expire, and you can store 1,024 in total across allows and blocks. Better still, ask the service to sign with DKIM for your domain so it passes DMARC and needs no exception.

## How do URL and file entries work?

**URL entries** take up to 250 characters and follow strict wildcard rules ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-urls-configure)):

| Entry | Matches | Doesn't match |
|---|---|---|
| `contoso.com` (block) | `contoso.com`, `www.contoso.com`, `contoso.com/a` | `abc-contoso.com` |
| `contoso.com` (allow) | `contoso.com` only | `www.contoso.com`, `contoso.com/a` |
| `*.contoso.com` | `www.contoso.com`, `xyz.abc.contoso.com` | `contoso.com` |
| `~contoso.com` | `contoso.com` and every subdomain | `contoso.com/abc` |
| `contoso.com/*` | Any path under `contoso.com` | `contoso.com` itself |

Ports, file extensions, Unicode and middle wildcards are invalid. Notice that a plain block entry is broad while a plain allow entry is narrow. Left-wildcard and tilde allow patterns are supported only through the advanced delivery policy, which is also the right place for [third-party phishing simulation URLs](https://iblockspam.com/blog/microsoft-365-advanced-delivery-phishing-simulation).

**File entries** use the SHA256 hash, up to 64 characters. In Windows PowerShell:

```powershell
Get-FileHash -Path "C:\Temp\invoice.html" -Algorithm SHA256
```

Microsoft matches the hash against "all files extracted during message analysis", including standard attachments, images in the message body and files inside supported attachment types. Perceptual hashes aren't supported, so a file changed by one byte needs a new entry.

## How many entries can you have?

Limits depend on your license. Domains and addresses, URLs, files and IPv6 addresses each have the same separate limits:

| Subscription | Allow entries per tab | Block entries per tab |
|---|---|---|
| Microsoft 365 without Defender for Office 365 | 500 | 500 |
| Defender for Office 365 Plan 1 | 1,000 | 1,000 |
| Defender for Office 365 Plan 2 | 5,000 | 10,000 |

Spoofed senders share a single pool of 1,024 entries. If you're near a limit, you're probably blocking addresses that spammers rotate daily. That's a filtering problem, not a list problem; see [why spam gets through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through).

## What side effects should you know about?

- **Blocks beat allows.** Microsoft states that "block entries take precedence over allow entries."
- **Sender blocks stop outbound mail.** Users who write to a blocked domain or address get `550 5.7.703 Your message can't be delivered because messages to XXX, YYY are blocked by your organization using Tenant Allow Block List.` The whole message fails for every recipient. Decode similar bounces with the [SMTP error code lookup](https://iblockspam.com/tools/smtp-error-codes).
- **Subdomains need their own entry.** A block for `contoso.com` doesn't cover `marketing.contoso.com`. Add `*.contoso.com` too.
- **URL blocks can quarantine good senders.** Microsoft notes that a message containing a blocked URL or domain "can be classified as *high confidence phishing*... even if the sender is legitimate." If partner mail lands in quarantine, check your URL blocks first, then [release the message](https://iblockspam.com/blog/release-quarantined-email-microsoft-365).
- **Impersonation isn't handled here.** You can't allow a sender flagged by impersonation protection in Defender for Office 365. Submitting it adds the sender to the anti-phishing policy's trusted senders instead.
- **Bulk insight shows your entries.** The bulk senders insight's sender details show whether a Tenant Allow/Block List entry allowed or blocked each bulk sender ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-senders-insight)).

## Tenant Allow/Block List hygiene checklist

- [ ] Every entry has a note with the reason, requester and ticket number.
- [ ] Permanent blocks are set to **Never expire** on purpose; temporary ones lapse.
- [ ] No allow entry covers your own domain or a large public domain.
- [ ] Each blocked domain also has a `*.domain` entry where subdomains matter.
- [ ] Spoofed sender allows are reviewed quarterly, since they never expire.
- [ ] Before adding an allow, the sender's SPF, DKIM and DMARC were checked, for example with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
- [ ] Blocked messages were also submitted to Microsoft on the Submissions page.

## Next steps

1. Export what you have: `Get-TenantAllowBlockListItems -ListType Sender | Format-Table Value,Action,ExpirationDate,Notes`.
2. Repeat for `Url`, `FileHash` and `IP`, and run `Get-TenantAllowBlockListSpoofItems`.
3. Remove allow entries nobody can explain, and add notes to the rest.
4. Paste the headers of any surprising verdict into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) before you add a new entry.
5. If you'd rather keep allow and block decisions in one place in front of every mailbox, see how iBlockSpam works with [Microsoft 365](https://iblockspam.com/platforms/microsoft-365) and its [approved and blocked sender lists](https://iblockspam.com/features/allow-block-lists).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What is the difference between the Tenant Allow/Block List and the blocked senders list in an anti-spam policy?

A Tenant Allow/Block List block marks mail as high confidence phishing, quarantines it and also stops your users sending to that address. A blocked senders entry in an anti-spam policy marks mail as high confidence spam, applies that policy's action and leaves outbound mail alone. Microsoft points to the anti-spam list when you want spam handling instead.

### Why can't I add an allow entry for a message quarantined as high confidence phishing?

Microsoft only lets you create allow entries directly for bulk, spam, high confidence spam and phishing verdicts. For malware and high confidence phishing, submit the message on the Submissions page, choose I've confirmed it's clean, then Allow this message. That creates the allow entry after Microsoft has seen the evidence.

### Can I add IPv4 addresses to the Tenant Allow/Block List?

No. At the time of writing (October 2026), the IP addresses tab accepts only IPv6 addresses and ranges, from /1 to /128. Microsoft says to manage IPv4 addresses in the IP Allow List and IP Block List of the default connection filter policy instead, which accepts ranges from /24 to /32.

### How do I block an email attachment by file hash in Microsoft 365?

Compute the file's SHA256 hash, for example with Get-FileHash -Algorithm SHA256 in PowerShell, then add it on the Files tab or run New-TenantAllowBlockListItems -ListType FileHash -Block. Messages that contain the file are blocked as malware and quarantined. The entry expires after 30 days unless you choose another expiry.

### How long does a new Tenant Allow/Block List entry take to start working?

Microsoft says an entry should be active within 5 minutes, both for block entries you add directly and for allow entries created from the Submissions page. If mail still gets through after that, check the headers: the message may match a different address, a subdomain without its own entry, or a higher-priority allow.

## Sources

- [Microsoft Learn: Manage allows and blocks in the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)
- [Microsoft Learn: Allow or block URLs using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-urls-configure)
- [Microsoft Learn: Allow or block files using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-files-configure)
- [Microsoft Learn: Allow or block IPv6 addresses using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-ip-addresses-configure)
- [Microsoft Learn: Bulk senders insight (sender details and Tenant Allow/Block List status)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-senders-insight)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt