Workaround over Tennant Allow/Block lists Allow entries expiration

Question

Workaround over Tennant Allow/Block lists Allow entries expiration

Stanislav Iliev 20

I'm trying to find a workaround for the new limitation that Allow entries in Exchange Online Protection will expire.

Has anyone found a solution?

Accepted answer

0 additional answers

Your answer

Answer 1

Xintao Qiao-MSFT 6,595 Microsoft External Staff

Hi, @Stanislav Iliev

From your short description, I can't understand your question exactly. Can you describe your problem in detail so that I can better help?

Are you worried that the Allowed Entries in EOP will expire and you want to find a new way to restrict them?

In fact, you can't create Allow entries for domains and email addresses directly in the tenant Allow/Block list. Unnecessary Allow Entries expose your organization to system-filtered malicious emails.

By default, Allowed entries for domains and email addresses, files, and URLs are retained for 45 days after the filtering system determines that the entity is clean, and then the Allowed entries are removed. More information can be found Manage allows and blocks in the Tenant Allow/Block List - Microsoft Defender for Office 365 | Microsoft Learn

Here are some alternatives you can try:

Allow entries to be manually recreated when they are about to expire. This will reset the time period of the entry.
Enhanced filtering (Skiplist) can be configured to solve the problem of IP Allowed entries.
Partner connectors can be created based on the sender's IP or certificate.

How to create an allow entry to be visible Allow or block email using the Tenant Allow/Block List - Microsoft Defender for Office 365 | Microsoft Learn

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Stanislav Iliev 20 Reputation points

2024-09-06T10:52:05.95+00:00

Hi @Xintao Qiao-MSFT thank you for the initiative to help. I'm worried that I can no longer create an Allow entire that stays for indefinite period untill manually removed. This creates the need for somebody to manually recreate those entries once they expire. I'm looking for a way to set the same behavior as before if there is such, or to automate/task the process so that it does not require an effort for the system administrators. Previously I've set such entries and configured as "Never expire" but recently this is no longer possible for the setting to "Allow", it can be set to Never expire only for blocked entries.
Xintao Qiao-MSFT 6,595 Reputation points Microsoft External Staff

2024-09-09T09:21:08.6166667+00:00

Hi, @Stanislav Iliev

As you said, currently the system only allows "Never Expire" settings for allowed entries, not allowed for allowed entries. This means that allowing entries to need to be manually recreated after expiration.

Manually creating new entries is also part of routine mail maintenance when allowed entries have expired. This does require time and effort on the part of the administrator.

Another workaround is to use scripts (such as Power Shell) to periodically check for expired entries and recreate them, which can help automate the process and reduce manual effort.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Stanislav Iliev 20 Reputation points

2024-09-09T09:26:41.1066667+00:00

Great thanks for your assistance.
Nathaniel Kemmer 0 Reputation points

2025-03-27T19:25:37.83+00:00

Where would we submit feedback to have the "Never Expire" option re-added to the system?

As a MS-CSP Partner, I have over 50 clients to support on a daily basis and I am not going to log into each one, every day, to check if allow rules that have been put in place to correct system issues/deficiencies have disappeared. I am also not going to waste my time writing scripts to fix a feature that wasn't broken but now is thanks to another infamous "Microsoft Feature Enhancement". It was viable email filtering solution before some know-it-all developer, that has clearly never had to support a customer's tenant, changed it.

Assuming this will all move at Microsoft speed, is there link to an article that explains how to completely bypass the system, so it doesn't block anything? I would rather give my 3rd party email filtering solution to clients for free rather than waste time with this until it is fixed.

Share via

Workaround over Tennant Allow/Block lists Allow entries expiration

0 additional answers

Your answer