How to block an IPv4 blacklisted IP.

Question

How to block an IPv4 blacklisted IP.

Ford, Edward 6

I have an IPv4 address that keeps trying to get into our mailboxes. So far the account keeps locking out instead of letting them in. What is the typical solution for a bad address trying to get in? Block them or is there something else that should be done with an IPv4 address?

Thank You

Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-04-29T16:43:04.2133333+00:00

Hello Ford, Edward,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-04-29T16:50:14.1266667+00:00
In my case our typical solution is making sure that is a not know Ip address you can check it on Virus total web page, we use conditional access too.

This is like a check list:

Start with Blocking: Use Solution 1 (Tenant Allow/Block List) for immediate relief, as it’s simple and targets email-based attacks directly.

Combine with MFA: Solution 3 (MFA) is critical to prevent credential-based attacks, especially if the attacker bypasses the blocked IP.

Use Conditional Access: Solution 4 (Conditional Access) offers broader protection against sign-in attempts, ideal for persistent threats.

Test Changes: Apply blocks and policies to a test group first to avoid blocking legitimate traffic (e.g., a user’s home IP misidentified as malicious).

Monitor Logs: Regularly check sign-in logs and Defender alerts to detect new IPs or attack patterns.

False Positives: Be cautious with permanent blocks, as IPs can be shared (e.g., NAT gateways). Use temporary blocks (e.g., 30 days) unless the IP is confirmed malicious.

Licensing: Ensure you have Defender for Office 365 Plan 1 or 2 for Tenant Allow/Block List features. Your M365 E3 non-profit license (from prior context) includes EOP but may require Plan 1 for advanced features. Check licensing in the Microsoft 365 admin center.

Rollback Plan: If a block causes issues (e.g., legitimate emails blocked), remove the IP from the Tenant Allow/Block List or Connection Filter Policy via the Defender portal.

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-04-30T11:09:28.7533333+00:00

Hello Ford, Edward,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-04-30T13:41:35.4966667+00:00

Just following up, Do you need more guidance or assistance ?

1 answer

Your answer

Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-04-29T16:43:04.2133333+00:00

Hello Ford, Edward,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-04-29T16:50:14.1266667+00:00

In my case our typical solution is making sure that is a not know Ip address you can check it on Virus total web page, we use conditional access too.

This is like a check list:

Start with Blocking: Use Solution 1 (Tenant Allow/Block List) for immediate relief, as it’s simple and targets email-based attacks directly.

Combine with MFA: Solution 3 (MFA) is critical to prevent credential-based attacks, especially if the attacker bypasses the blocked IP.

Use Conditional Access: Solution 4 (Conditional Access) offers broader protection against sign-in attempts, ideal for persistent threats.

Test Changes: Apply blocks and policies to a test group first to avoid blocking legitimate traffic (e.g., a user’s home IP misidentified as malicious).

Monitor Logs: Regularly check sign-in logs and Defender alerts to detect new IPs or attack patterns.

False Positives: Be cautious with permanent blocks, as IPs can be shared (e.g., NAT gateways). Use temporary blocks (e.g., 30 days) unless the IP is confirmed malicious.

Licensing: Ensure you have Defender for Office 365 Plan 1 or 2 for Tenant Allow/Block List features. Your M365 E3 non-profit license (from prior context) includes EOP but may require Plan 1 for advanced features. Check licensing in the Microsoft 365 admin center.

Rollback Plan: If a block causes issues (e.g., legitimate emails blocked), remove the IP from the Tenant Allow/Block List or Connection Filter Policy via the Defender portal.

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!
Venkata Jagadeep 1,400 Reputation points Microsoft External Staff Moderator

2025-04-30T11:09:28.7533333+00:00

Hello Ford, Edward,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Jose Benjamin Solis Nolasco 3,506 Reputation points

2025-04-30T13:41:35.4966667+00:00

Just following up, Do you need more guidance or assistance ?

Answer 1

Hello Ford, Edward,

As per the description, we understand that you want to block IPv4 address to your mailboxes.

I request you to sign-in to Defender portal at https://security.microsoft.com

Navigate to Email & collaboration > Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists.

Here you can add your IPv4 address which you want to block in the block option as shown in the below screenshot.

block ip

If you manually create a block entry, all incoming email messages from that IP address are dropped at the edge of the service.

I suggest you refer the below document.

https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about

Share via

How to block an IPv4 blacklisted IP.

1 answer

Your answer