Add Or Remove Tenant Allow Block List

Add or remove entries from the Tenant Allow/Block List

Description

Adds or removes entries from the Tenant Allow/Block List in Microsoft Defender for Office 365. The runbook supports senders, URLs, and file hashes and sets new entries to expire after 30 days by default.

Location

Organization → Mail → Add Or Remove Tenant Allow Block List

Full Runbook name

rjgit-org_mail_add-or-remove-tenant-allow-block-list

Details

Property	Value
Version	1.0.1
Required modules	RealmJoin.RunbookHelper (>= 0.8.9) ExchangeOnlineManagement (>= 3.9.2)
Schedulable	no

Permissions

Application permissions

• Type: Office 365 Exchange Online

  • Exchange.ManageAsApp

    • Runs Get/New/Remove-TenantAllowBlockListItems in the app-only Exchange Online session

RBAC roles

• Exchange Administrator

  • Required for the app-only Exchange Online session to manage Defender Tenant Allow/Block List entries

Parameters

Entry

The entry to add or remove (for example: domain, email address, URL, or file hash).

Property	Value
Required	true
Default Value
Type	String

ListType

Type of entry to manage.

Property	Value
Required	false
Default Value	Sender
Type	String

Block

"Block List (block entry)" (final value: $true) or "Allow List (permit entry)" (final value: $false) can be selected as list type.

Property	Value
Required	false
Default Value	True
Type	Boolean

Remove

"Add entry to the list" (final value: $false) or "Remove entry from the list" (final value: $true) can be selected as action to perform.

Property	Value
Required	false
Default Value	False
Type	Boolean

DaysToExpire

Number of days until a newly added entry expires.

Property	Value
Required	false
Default Value	30
Type	Int32

Back to Runbook Reference overview