MC532602 – Tenant Allow/Block List will allow related URLs (archived)

Admin impact, Exchange Online, Feature update, Microsoft 365 Defender, Stay Informed

check before: 2023-04-07

Product:

Defender, Exchange, Microsoft 365 Defender

Platform:

Online, World tenant

Status:

Change type:

Feature update, Admin impact

Links:

Details:

Applicable to Tenants with Exchange Online Protection, Microsoft Defender for Plan 1 or Plan 2 or Microsoft 365 Defender plan.

Email messages can be blocked because of a bad URL where the URL is a matched based on a sub path or portion of the URL contained in the message. In the case of a legitimate email getting blocked, this was difficult to correct through a submission. We have updated the way that we handle allowed URLs such that the partial matching behavior is included without the need to include wild cards or making multiple URL submissions.
Emails with this URL are being blocked www.contoso.com/abc.
You submit the email or the URL to Microsoft for analysis, and an allow entry is created for www.contoso.com/abc in the Tenant Allow/Block List.
If future emails contain URLs that are related to the allow entry, the emails won’t be blocked based on the URL. For example (but not limited to): www.contoso.com/abc or www.contoso.com/abc?id=1 or www.contoso.com/abc/def/gty/uyt?id=5.
[When this will happen:]
We will begin rolling out late March 2023 and expect to complete by mid-April 2023.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2023-03-25

updated:
2023-03-25

Task Type