MC794813 – Microsoft Defender for Office 365: Tenant Allow/Block Lists will support entry removal 45 days after last used date (archived)

Product:

Defender, Defender for Office 365, Defender XDR, Exchange, Microsoft 365 Defender

Platform:

Online, US Instances, Web, World tenant

Status:

Launched

Change type:

New feature, Admin impact

Links:

372670

Details:

Summary:
Microsoft Defender for Office 365 will introduce a feature to automatically remove allow list entries 45 days after their last use, starting late June 2024. This applies to customers with Microsoft Exchange Online Protection and Defender for Office 365 Plan 1 or 2. Users are advised to update their allow entries to utilize this new feature.

Details:
This message applies to customers with Microsoft Exchange Online Protection and Microsoft Defender for Office 365 Plan 1 or Plan 2.
Soon, it will be possible for you to create allow entries in the Tenant Allow/Block Lists in Microsoft Defender from Submissions, with a Remove on value set to 45 days after the last used date.
This message is associated with Microsoft 365 Roadmap ID 372670.
[When this will happen:]
General Availability (Worldwide): We will begin rolling out in late June 2024 and expect to complete by late July 2024.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2024-05-22

updated:
2024-05-22

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

Direct effects for Operations**

- Direct Impact on IT Operations
- Changes in Email Filtering Mechanism
- The automatic removal of allow list entries after 45 days may lead to unintended blocking of legitimate emails if the entries are not frequently used.
- Roles impacted: IT Administrators, Security Analysts
- Dependencies: Email flow and filtering systems, user access to email services
- Reference: [Microsoft Defender for Office 365 Documentation](https://learn.microsoft.com/defender-office-365/submissions-admin)

- Need for Updated Documentation and Training
- IT administrators will need to update internal documentation and potentially train users on the new feature to ensure they understand how it works and the importance of maintaining their allow list entries.
- Roles impacted: IT Administrators, Helpdesk Support, End Users
- Dependencies: Knowledge management systems, training platforms
- Reference: [Microsoft 365 Security Documentation](https://learn.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list-about)