When are Tenant Block/Allow List and Journaling applied in Exchange Mail Flow

Question

I am trying to understand whereabouts the following Exchange actions would be performed

* Tenant Allow/Block list exceptions applied to a message?
  * I think it happens after Anti-Malware but before Mail-Flow Rules based on my testing
* A message be journaled if using a legacy journal rule?
  * Is it within the EOP steps, or afterwards?

based on the stages displayed in the diagram on this page:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/eop-about?view=o365-worldwide#how-eop-works

I've read endless MS articles but cannot find a clear answer.

Answer 1

Hi,

• Tenant Allow/Block list exceptions applied to a message?

• I think it happens after Anti-Malware but before Mail-Flow Rules based on my testing

May I ask how did you test it? What are the settings in Tenant Allow/Block list and mail flow rules?

• A message be journaled if using a legacy journal rule?

• Is it within the EOP steps, or afterwards?

It should work after the EOP process.

If you are blocking the sender in Tenant Allow/Block list, journaling email would not be sent.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.