Search

MC335609 – Retirement of Get/Set-PhishFilterPolicy PowerShell (legacy) to manage spoofed senders using new Tenant Allow Block list (archived)

Microsoft Exchange Logo

check before: 2022-03-10

Product:

Defender, Defender for Office 365, Exchange, Microsoft Defender for Office 365, SharePoint

Platform:

Germany, Online, US Instances, Web, World tenant

Status:

Launched

Change type:

Admin impact, Retirement

Links:

MC248392
70590

Details:

We will be retiring the "Get-/Set-PhishFilterPolicy" PowerShell cmdlets. Instead, we recommend the utilization of the updated feature called "Spoof intelligence insight" in order to view spoofing activity and the new feature called "Tenant allow block lists-Spoofing" in order to manage spoofing activity respectively, which is where we will continue to invest our development resources.
[Key points:]
Timing:
Standard: late March through end of September
GCC, GCC-High and DoD: late April through end of September
Action: review and assess impact on your organization

Change Category:
XXXXXXX ...

Scope:
XXXXXXX ...

Release Phase:
General Availability

Created:
2022-02-24

updated:
2022-08-27

the free basic plan is required to see all details. Sign up here


A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.


changes*

DatePropertyoldnew
2022-09-15MC prepareInstead of using "Get-PhishFilterPolicy" or "Set-PhishFilterPolicy" PowerShell cmdlets, we recommend using "Spoof intelligence insight" in order to view and "Tenant allow block lists-Spoofing" in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:
The rule called "Tenant Allow/Block Lists" in the list of Threat policies page, which will provide a page for "Spoofing" from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
Get-TenantAllowBlockListSpoofItems
New-TenantAllowBlockListSpoofItems
Set-TenantAllowBlockListSpoofItems
Remove-TenantAllowBlockListSpoofItems
Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as "Allowed" / "Blocked" by Spoof intelligence system. This can be viewed by clicking on the link "View spoofing activity" from Tenant Allow/Block Lists page-Spoofing tab. Optionally, 'Get-SpoofIntelligenceInsight' PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the "Tenant Allow/Block lists-Spoofing" page as this is now considered tenant specific spoof domain pair.
Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet 'Get-SpoofMailReport' will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).
Please review to learn more.
Learn more about the functionality being retired here: Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP
To learn more about the new functionality already available in your tenant, please refer to the following articles:
Spoof intelligence insight in EOP
Manage the Tenant Allow/Block List: View spoofed sender entries
ps://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-world
ps://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide#open-the-spoof-intelligence-insight-in-the-microsoft-365-defender-portal
ps://docs.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#view-spoofed-sender-entri
ps://docs.microsoft.com/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-world
Instead of using "Get-PhishFilterPolicy" or "Set-PhishFilterPolicy" PowerShell cmdlets, we recommend using "Spoof intelligence insight" in order to view and "Tenant allow block lists-Spoofing" in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:
The rule called "Tenant Allow/Block Lists" in the list of Threat policies page, which will provide a page for "Spoofing" from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
Get-TenantAllowBlockListSpoofItems
New-TenantAllowBlockListSpoofItems
Set-TenantAllowBlockListSpoofItems
Remove-TenantAllowBlockListSpoofItems
Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as "Allowed" / "Blocked" by Spoof intelligence system. This can be viewed by clicking on the link "View spoofing activity" from Tenant Allow/Block Lists page-Spoofing tab. Optionally, 'Get-SpoofIntelligenceInsight' PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the "Tenant Allow/Block lists-Spoofing" page as this is now considered tenant specific spoof domain pair.
Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet 'Get-SpoofMailReport' will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).
Please review to learn more.
Learn more about the functionality being retired here: Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP
To learn more about the new functionality already available in your tenant, please refer to the following articles:
Spoof intelligence insight in EOP
Manage the Tenant Allow/Block List: View spoofed sender entries
https://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide
https://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide#open-the-spoof-intelligence-insight-in-the-microsoft-365-defender-portal
https://docs.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#view-spoofed-sender-entries
https://docs.microsoft.com/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-worldwide
2022-08-27MC prepareInstead of using "Get-PhishFilterPolicy" or "Set-PhishFilterPolicy" PowerShell cmdlets, we recommend using "Spoof intelligence insight" in order to view and "Tenant allow block lists-Spoofing" in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:
The rule called "Tenant Allow/Block Lists" in the list of Threat policies page, which will provide a page for "Spoofing" from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
Get-TenantAllowBlockListSpoofItems
New-TenantAllowBlockListSpoofItems
Set-TenantAllowBlockListSpoofItems
Remove-TenantAllowBlockListSpoofItems
Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as "Allowed" / "Blocked" by Spoof intelligence system. This can be viewed by clicking on the link "View spoofing activity" from Tenant Allow/Block Lists page-Spoofing tab. Optionally, 'Get-SpoofIntelligenceInsight' PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the "Tenant Allow/Block lists-Spoofing" page as this is now considered tenant specific spoof domain pair.
Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet 'Get-SpoofMailReport' will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).
Please review to learn more.
Learn more about the functionality being retired here: Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP
To learn more about the new functionality already available in your tenant, please refer to the following articles:
Spoof intelligence insight in EOP
Manage the Tenant Allow/Block List: View spoofed sender entries
https://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide
https://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide#open-the-spoof-intelligence-insight-in-the-microsoft-365-defender-portal
https://docs.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#view-spoofed-sender-entries
https://docs.microsoft.com/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-worldwide
Instead of using "Get-PhishFilterPolicy" or "Set-PhishFilterPolicy" PowerShell cmdlets, we recommend using "Spoof intelligence insight" in order to view and "Tenant allow block lists-Spoofing" in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:
The rule called "Tenant Allow/Block Lists" in the list of Threat policies page, which will provide a page for "Spoofing" from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
Get-TenantAllowBlockListSpoofItems
New-TenantAllowBlockListSpoofItems
Set-TenantAllowBlockListSpoofItems
Remove-TenantAllowBlockListSpoofItems
Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as "Allowed" / "Blocked" by Spoof intelligence system. This can be viewed by clicking on the link "View spoofing activity" from Tenant Allow/Block Lists page-Spoofing tab. Optionally, 'Get-SpoofIntelligenceInsight' PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the "Tenant Allow/Block lists-Spoofing" page as this is now considered tenant specific spoof domain pair.
Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet 'Get-SpoofMailReport' will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).
Please review to learn more.
Learn more about the functionality being retired here: Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP
To learn more about the new functionality already available in your tenant, please refer to the following articles:
Spoof intelligence insight in EOP
Manage the Tenant Allow/Block List: View spoofed sender entries
ps://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-world
ps://docs.microsoft.com/microsoft-365/security/office-365-security/learn-about-spoof-intelligence?view=o365-worldwide#open-the-spoof-intelligence-insight-in-the-microsoft-365-defender-portal
ps://docs.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide#view-spoofed-sender-entri
ps://docs.microsoft.com/microsoft-365/security/office-365-security/walkthrough-spoof-intelligence-insight?view=o365-world

*starting April 2022

Last updated 12 months ago

Share to MS Teams

Login to your account

Welcome Back, We Missed You!