In the Microsoft Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists. Or, to go directly to the Tenant Allow/Block Lists page, use https://security.microsoft.com/tenantAllowBlockList.

On the Tenant Allow/Block Lists page, verify that the Domains & addresses tab is selected.

On the Domains & addresses tab, select  Block.

In the Block domains & addresses flyout that opens, configure the following settings:

Domains & addresses: Enter one email address or domain per line, up to a maximum of 20.

Remove block entry after: Select from the following values:

1 day

7 days

30 days (default)

Never expire

Specific date: The maximum value is 90 days from today.

Optional note: Enter descriptive text for why you're blocking the email addresses or domains.

When you're finished in the Block domains & addresses flyout, select Add.

Back on the Domains & email addresses tab, the entry is listed.

1. 
   

2. In the Microsoft Defender portal at https://security.microsoft.com, go to Policies & rules > Threat Policies > Rules section > Tenant Allow/Block Lists. Or, to go directly to the Tenant Allow/Block Lists page, use https://security.microsoft.com/tenantAllowBlockList.

3. On the Tenant Allow/Block Lists page, verify that the Domains & addresses tab is selected.

4. On the Domains & addresses tab, select  Block.

5. In the Block domains & addresses flyout that opens, configure the following settings:

   • Domains & addresses: Enter one email address or domain per line, up to a maximum of 20.

   • Remove block entry after: Select from the following values:

     • 1 day

     • 7 days

     • 30 days (default)

     • Never expire

     • Specific date: The maximum value is 90 days from today.

   • Optional note: Enter descriptive text for why you're blocking the email addresses or domains.

6. When you're finished in the Block domains & addresses flyout, select Add.

Back on the Domains & email addresses tab, the entry is listed.