Allow or block files using the Tenant Allow/Block List
Tip
Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub. Learn about who can sign up and trial terms here.
Applies to
- Exchange Online Protection
- Microsoft Defender for Office 365 plan 1 and plan 2
- Microsoft 365 Defender
This article describes how to manage file allow and block entries that are available in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see Manage your allows and blocks in the Tenant Allow/Block List.
You manage allow and block entries for files in the Microsoft 365 Defender Portal or in Exchange Online PowerShell.
What do you need to know before you begin?
You open the Microsoft 365 Defender portal at https://security.microsoft.com. To go directly to the Tenant Allow/Block List page, use https://security.microsoft.com/tenantAllowBlockList. To go directly to the Submissions page, use https://security.microsoft.com/reportsubmission.
To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell. To connect to standalone EOP PowerShell, see Connect to Exchange Online Protection PowerShell.
You specify files by using the SHA256 hash value of the file. To find the SHA256 hash value of a file in Windows, run the following command in a Command Prompt:
certutil.exe -hashfile "<Path>\<Filename>" SHA256
An example value is
768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3a
. Perceptual hash (pHash) values are not supported.For files, the maximum number of allow entries is 500, and the maximum number of block entries is 500 (1000 file entries total).
You can enter a maximum of 64 characters in a file entry.
An entry should be active within 30 minutes, but it might take up to 24 hours for the entry to be active.
You need to be assigned permissions in Exchange Online before you can do the procedures in this article:
- To add and remove values from the Tenant Allow/Block List, you need to be a member of one of the following role groups:
- Organization Management or Security Administrator role group (Security admin role)
- Security Operator role group (Tenant AllowBlockList Manager).
- For read-only access to the Tenant Allow/Block List, you need to be a member of one of the following role groups:
- Global Reader role group
- Security Reader role group
- View-Only configuration role group
For more information, see Permissions in Exchange Online.
Notes:
- Adding users to the corresponding Azure Active Directory role in the Microsoft 365 admin center gives users the required permissions and permissions for other features in Microsoft 365. For more information, see About admin roles.
- The View-Only Organization Management role group in Exchange Online also gives read-only access to the feature.
- To add and remove values from the Tenant Allow/Block List, you need to be a member of one of the following role groups:
Create block entries for files
You have the following options to create block entries for files:
- The Submissions page in the Microsoft 365 Defender portal
- The Tenant Allow/Block List in the Microsoft 365 Defender portal or in PowerShell
Use the Microsoft 365 Defender portal to create block entries for files in the Submissions portal
When you use the Submissions portal at https://security.microsoft.com/reportsubmission to report files as Should have been blocked (False negative), you can select Block this file to add a block entry on the Files tab in the Tenant Allow/Block List.
For instructions, see Report questionable email attachments to Microsoft.
Use the Microsoft 365 Defender portal to create block entries for files in the Tenant Allow/Block List
You can create block entries for files directly in the Tenant Allow/Block List.
Email messages that contain these blocked files are blocked as malware.
In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists. Or, to go directly to the Tenant Allow/Block List page, use https://security.microsoft.com/tenantAllowBlockList.
On the Tenant Allow/Block List page, select the Files tab.
On the Files tab, click
Block.
In the Block files flyout that appears, configure the following settings:
Add file hashes: Enter one SHA256 hash value per line, up to a maximum of 20.
Remove block entry after: The default value is 30 days, but you can select from the following values:
- 1 day
- 7 days
- 30 days
- Never expire
- Specific date: The maximum value is 90 days from today.
Optional note: Enter descriptive text for the entries.
When you're finished, click Add.
Use PowerShell to create block entries for files in the Tenant Allow/Block List
In Exchange Online PowerShell, use the following syntax:
New-TenantAllowBlockListItems -ListType <FileHash> -Block -Entries "Value1","Value2",..."ValueN" <-ExpirationDate Date | -NoExpiration> [-Notes <String>]
This example adds a block entry for the specified files that never expires.
New-TenantAllowBlockListItems -ListType FileHash -Block -Entries "768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3","2c0a35409ff0873cfa28b70b8224e9aca2362241c1f0ed6f622fef8d4722fd9a" -NoExpiration
For detailed syntax and parameter information, see New-TenantAllowBlockListItems.
Use the Microsoft 365 Defender portal to create allow entries for files in the Submissions portal
You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the Submissions portal at https://security.microsoft.com/reportsubmission to report the message attachment as a false positive, which also adds an allow entry on the Files tab in the Tenant Allow/Block List.
For instructions, see Report good email attachments to Microsoft.
Important
Because Microsoft manages allow entries for you, unneeded allow entries for files will be removed. This behavior protects your organization and helps prevent misconfigured allow entries. If you disagree with the verdict, you might need to open a support case to help determine why a file is still considered bad.
Use the Microsoft 365 Defender portal to view allow or block entries for files in the Tenant Allow/Block List
In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Tenant Allow/Block Lists in the Rules section. Or, to go directly to the Tenant Allow/Block Lists page, use https://security.microsoft.com/tenantAllowBlockList.
Select the Files tab. The following columns are available:
- Value: The file hash.
- Action: The value Allow or Block.
- Modified by
- Last updated
- Remove on: The expiration date.
- Notes
You can click on a column heading to sort in ascending or descending order.
Click
Group to group the results by None or Action.
Click
Search, enter all or part of a value, and then press ENTER to find a specific value. When you're finished, click
Clear search.
Click
Filter to filter the results. The following values are available in the Filter flyout that appears:
- Action: Allow and Block.
- Never expire:
or
- Last updated: Select From and To dates.
- Remove on: Select From and To dates.
When you're finished, click Apply. To clear existing filters, click
Clear filters in the Filter flyout.
Use PowerShell to view allow or block entries for files in the Tenant Allow/Block List
In Exchange Online PowerShell, use the following syntax:
Get-TenantAllowBlockListItems -ListType FileHash [-Allow] [-Block] [-Entry <FileHashValue>] [<-ExpirationDate Date | -NoExpiration>]
This example returns all allowed and blocked files.
Get-TenantAllowBlockListItems -ListType FileHash
This example returns information for the specified file hash value.
Get-TenantAllowBlockListItems -ListType FileHash -Entry "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
This example filters the results by blocked files.
Get-TenantAllowBlockListItems -ListType FileHash -Block
For detailed syntax and parameter information, see Get-TenantAllowBlockListItems.
Use the Microsoft 365 Defender portal to modify allow or block entries for files in the Tenant Allow/Block List
You can make the following modifications to entries for files in the Tenant Allow/Block list:
- Block enries: The expiration date and notes.
- Allow entries: Notes.
In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists. Or, to go directly to the Tenant Allow/Block List page, use https://security.microsoft.com/tenantAllowBlockList.
Select the Files tab
On the Files tab, select the check box of the entry that you want to modify, and then click the
Edit button that appears.
The following settings are available in the Edit file flyout that appears:
- Remove block entry after: You can extend block entries for a maximum of 90 days after the creation date or set them to Never expire.
- Optional note
When you're finished, click Save.
Note
For allow entries only, if you select the entry by clicking anywhere in the row other than the check box, you can select View submission in the details flyout that appears to go to the Submissions page at https://security.microsoft.com/reportsubmission.
Use PowerShell to modify allow or block entries for files in the Tenant Allow/Block List
In Exchange Online PowerShell, use the following syntax:
Set-TenantAllowBlockListItems -ListType <FileHash> <-Ids <Identity value> | -Entries <Value value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]
This example changes the expiration date of the specified file block entry.
Set-TenantAllowBlockListItems -ListType FileHash -Entries "27c5973b2451db9deeb01114a0f39e2cbcd2f868d08cedb3e210ab3ece102214" -ExpirationDate "9/1/2022"
For detailed syntax and parameter information, see Set-TenantAllowBlockListItems.
Use the Microsoft 365 Defender portal to remove allow or block entries for files from the Tenant Allow/Block List
In the Microsoft 365 Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists. Or, to go directly to the Tenant Allow/Block List page, use https://security.microsoft.com/tenantAllowBlockList.
Select the Files tab.
On the Files tab, do one of the following steps:
- Select the check box of the entry that you want to remove, and then click the
Delete icon that appears.
- Select the entry that you want to remove by clicking anywhere in the row other than the check box. In the details flyout that appears, click
Delete.
- Select the check box of the entry that you want to remove, and then click the
In the warning dialog that appears, click Delete.
Note
You can select multiple entries by selecting each check box, or select all entries by selecting the check box next to the Value column header.
Use PowerShell to remove allow or block entries for files from the Tenant Allow/Block List
In Exchange Online PowerShell, use the following syntax:
Remove-TenantAllowBlockListItems -ListType FileHash <-Ids <Identity value> | -Entries <Value value>>
This example removes the specified file block from the Tenant Allow/Block List.
Remove-TenantAllowBlockListItems -ListType FileHash -Entries "27c5973b2451db9deeb01114a0f39e2cbcd2f868d08cedb3e210ab3ece102214"
For detailed syntax and parameter information, see Remove-TenantAllowBlockListItems.
Related articles
- Use the Submissions portal to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft
- Report false positives and false negatives
- Manage your allows and blocks in the Tenant Allow/Block List
- Allow or block emails in the Tenant Allow/Block List
- Allow or block URLs in the Tenant Allow/Block List
Feedback
Submit and view feedback for