How to create a rule in Defender for M365 to block sender domain age has less than 2 weeks ?

Hi,

You don't have to create rule. Just follow below mentioned simple steps-

Go to security portal.

Go to Policies

Go to threat policies - Tenant/Allow block list - set your domain expiration time. That's it !!

Thanks

Hello! vinaybabupamu

Sadly I dont believe this feature exists within Defender or Exchange Online Protection. There is other tools in the toolbox to protect against unwanted emails

But If you specifically want to check domain age and other information from WHOIS I would recommend that you take a look at Azure Sentinel, and specifically the "Domain tools" connector/Playbook, This could perhaps be what you are looking for

Let me know if this helps!

Cheers
Oliwer Sundgren