Automatic Tenant Allow/Block List expiration management is now available in Microsoft Defender for Office 365
Analysis / inference: Microsoft Defender for Office 365 now automatically removes or extends Tenant Allow/Block List entries based on system learning status.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Office 365 - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft introduced automatic expiration management for allow entries within the Tenant Allow/Block List, which removes entries when the system learns from them or extends them if learning is incomplete.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisAutomatic management of Tenant Allow/Block List entries reduces manual administrative overhead and prevents stale bypass rules from lingering indefinitely. This update ensures that temporary allows for legitimate mail are cleaned up automatically once machine learning models adapt.
Reduces the risk of lingering permanent allow entries and minimizes manual oversight needed for cleaning up temporary mail bypasses.
Section 03 · Recommended actions
- Review existing Tenant Allow/Block List entries and observe how automated expiration handles temporary rules.
- Review current custom allow entries in the Tenant Allow/Block List to verify expiration states and understand automated removal behavior.