Block IP v4

Question

Block IP v4

Marcel Ghioca TANAGER 0

How can I block IPv4 and also check the list of the blocked IPs in Microsoft Defender

0 comments

2 answers

Your answer

Answer 1

Marcel Ghioca TANAGER 0

Hi Hani-Ng,

that is the scenario I am talking about. IPv4 cannot be blocked in Tenant Allow/Block List, and the workaround using the Email Collaboration >Policies&Rules>Threat Policies>Anti-spam Policies>Connection Filter Policy appears to not work. Even if it works, I couldn't find a way to review what IPs are added to either blocked or allowed list.

Hani-Ng 12,745 Reputation points Microsoft External Staff Moderator

2026-06-26T03:30:36.0166667+00:00
Hi Marcel Ghioca TANAGER

Thank you for the clarification.

Based on Microsoft documentation, IPv4 addresses are not supported in the Tenant Allow/Block List. For Exchange Online protection, IPv4 addresses are managed through the Connection Filter policy instead.

Regarding the Connection Filter policy, could you share a bit more about what you are seeing?

Are you unable to locate a list of the configured allowed/blocked IP addresses?

Or are you able to add the IPv4 address, but email traffic from that IP is still not being handled as expected?

If possible, please also let us know whether you are using the Microsoft Defender portal or Exchange Online PowerShell, and what you see when you open the Connection Filter policy settings.
Marcel Ghioca TANAGER 0 Reputation points

2026-06-26T15:16:29.46+00:00

This is the way where I can block or allow IP v4 addresses.image.png

The issue is I have seen the IP I blocked still sending phishing emails the following day.

This is the view of the Connection Filter Policy Settings where I don't have a way to see a list of what I blocked or allowed in the past.image.png

If there is different way to check on that list, please point me to that. Thank you!
Hani-Ng 12,745 Reputation points Microsoft External Staff Moderator

2026-06-29T02:36:28.25+00:00

Hi Marcel Ghioca TANAGER

Thank you for the additional details and screenshots.

Based on the screenshots, it appears that you are using the default Connection Filter Policy, which is the mechanism used for IPv4 allow/block entries in Exchange Online Protection. Microsoft documentation also indicates that IPv4 addresses are managed through the Connection Filter Policy rather than the Tenant Allow/Block List.

Regarding the list of blocked or allowed IP addresses, the screenshots show the Connection Filter Policy page, but no IP addresses are visible in either the IP Allow List or IP Block List. Could you let me know whether the previously blocked IP address is currently displayed after selecting Edit connection filter policy?

As for the phishing messages, do the message headers show the same source IP address that was previously added to the IP Block List?

If possible, please share a screenshot of the Edit connection filter policy page showing the configured entries (with any sensitive information removed) or the relevant message header details from one of the phishing emails.

For your information: Configure the default connection filter policy - Microsoft Defender for Office 365 | Microsoft Learn

Answer 2

Hi Marcel Ghioca TANAGER

To better understand your scenario, could you let me know whether you are referring to blocking an IPv4 address in the Tenant Allow/Block List in Microsoft Defender for Office 365 (Email & collaboration > Policies & rules > Threat policies > Tenant Allow/Block Lists) for Exchange Online email protection?

Manage allows and blocks in the Tenant Allow/Block List - Microsoft Defender for Office 365 | Micro…

Allow or block IPv6 addresses using the Tenant Allow/Block List - Microsoft Defender for Office 365…

If not, could you share a few more details about what you are trying to achieve?
I look forward to your response!

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.