Set-TenantAllowBlockListItems

This cmdlet is available only in the cloud-based service.

Use the Set-TenantAllowBlockListItems cmdlet to modify entries in the Tenant Allow/Block List in the Microsoft Defender portal.

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.

Syntax

Set-TenantAllowBlockListItems
   -Ids <String[]>
   -ListType <ListType>
   [-Allow]
   [-Block]
   [-ExpirationDate <DateTime>]
   [-ListSubType <ListSubType>]
   [-NoExpiration]
   [-Notes <String>]
   [-OutputJson]
   [<CommonParameters>]
Set-TenantAllowBlockListItems
   -Entries <String[]>
   -ListType <ListType>
   [-Allow]
   [-Block]
   [-ExpirationDate <DateTime>]
   [-ListSubType <ListSubType>]
   [-NoExpiration]
   [-Notes <String>]
   [-OutputJson]
   [<CommonParameters>]

Description

In most cases, you can't modify the URL, file, or sender values of an existing entry. The only exception is allow URL entries for phishing simulations (Action = Allow, ListType = URL, and ListSubType = AdvancedDelivery). For more information about allowing URLs for phishing simulations, see Configure the advanced delivery policy for third-party phishing simulations and email delivery to SecOps mailboxes.

You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.

Examples

Example 1

Set-TenantAllowBlockListItems -ListType Url -Ids "RgAAAAAI8gSyI_NmQqzeh-HXJBywBwCqfQNJY8hBTbdlKFkv6BcUAAAl_QCZAACqfQNJY8hBTbdlKFkv6BcUAAAl_oSRAAAA" -ExpirationDate (Get-Date "5/30/2021 9:30 AM").ToUniversalTime()

This example changes the expiration date of the specified entry.

Example 2

Set-TenantAllowBlockListItems -ListType Url -ListSubType AdvancedDelivery -Entries *.fabrikam.com -ExpirationDate 9/11/2021

This example changes the expiration date of the URL allow entry for the specified third-party phishing simulation URL.

Parameters

-Allow

The Allow switch specifies that you're modifying an allow entry. You don't need to specify a value with this switch.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-Block

The Block switch specifies that you're modifying a block entry. You don't need to specify a value with this switch.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-Entries

The Entries parameter specifies the entries that you want to modify based on the ListType parameter value. Valid values are:

  • FileHash: The exact SHA256 file hash value.
  • Sender domains and email addresses: The exact domain or email address value.
  • Url: The exact URL value.

This value is shown in the Value property of the entry in the output of the Get-TenantAllowBlockListItems cmdlet.

You can't mix value types (file, sender, or URL) or allow and block actions in the same command.

You can't use this parameter with the Ids parameter.

Type:String[]
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-ExpirationDate

The ExpirationDate parameter filters the results by expiration date in Coordinated Universal Time (UTC).

To specify a date/time value for this parameter, use either of the following options:

  • Specify the date/time value in UTC: For example, "2021-05-06 14:30:00z".
  • Specify the date/time value as a formula that converts the date/time in your local time zone to UTC: For example, (Get-Date "5/6/2020 9:30 AM").ToUniversalTime(). For more information, see Get-Date.

You can't use this parameter with the NoExpiration switch.

Type:DateTime
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-Ids

The Ids parameter specifies the entries that you want to modify. This value is shown in the Identity property in the output of the Get-TenantAllowBlockListItems cmdlet.

An example value for this parameter is RgAAAAAI8gSyI_NmQqzeh-HXJBywBwCqfQNJY8hBTbdlKFkv6BcUAAAl_QCZAACqfQNJY8hBTbdlKFkv6BcUAAAl_oSPAAAA0.

You can't use this parameter with the Entries parameter.

Type:String[]
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-ListSubType

The ListSubType parameter further specifies the entry that you want to modify. Valid values are:

Type:ListSubType
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-ListType

The ListType parameter specifies the type of entry that you want to modify. Valid values are:

  • FileHash
  • Sender
  • Url

Use the Entries or Ids parameter with this parameter to identify the entry itself.

Type:ListType
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-NoExpiration

The NoExpiration switch specifies that the entry should never expire. You don't need to specify a value with this switch.

This switch is available to use with block entries or with url allow entries where the ListSubType parameter value is AdvancedDelivery.

You can't use this switch with the ExpirationDate parameter.

Type:SwitchParameter
Position:Named
Default value:None
Required:True
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-Notes

The Notes parameters specifies additional information about the object. If the value contains spaces, enclose the value in quotation marks (").

Type:String
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection

-OutputJson

The OutputJson switch specifies whether to return all entries in a single JSON value. You don't need to specify a value with this switch.

You use this switch to prevent the command from halting on the first entry that contains a syntax error.

Type:SwitchParameter
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False
Applies to:Exchange Online, Security & Compliance, Exchange Online Protection