Forum Discussion
add to whitelist or safe senders from quarantine
- Only from the admin quarantine, IIRC. Which in turn adds it to the org-wide allow list.
That is potentially good, but I am not entirely clear about the alert. Are we talking about something entirely new, or is it the informational alert "Removed an entry in Tenant Allow/Block List" as seen in the Policies & Rules \ Alert Policy table?
If it is something entirely new then an example of what to expect would be good.
If it is the informational alert, does that trigger for any removal from the TABL or just for these automated weedings? I ask because I block lots of routine breached genuine M365 tenants (strangely enough, other providers don't seem to have the same volume of breaches) on a 7-day or 30-day basis or however long I think it will take them to clean up their act. I don't fancy the idea of receiving an alert when each one of those expires.
I suppose the best option is to experiment and then get busy with a mail flow rule if there is enough leverage.
-------------------------------
Defender new feature Whitelist auto remove
Microsoft Defender for Office 365 will introduce a feature to automatically remove allow list entries 45 days after their last use, starting late June 2024. This applies to customers with Microsoft Exchange Online Protection and Defender for Office 365 Plan 1 or 2. Users are advised to update their allow entries to utilize this new feature.
Go to the URL below to view the info I pasted below the URL. From what I understand, the Whitelist/Allow List will autoremove after the specified time and/or due to inactivity, but there are no permanent whitelisting options.
-----------------------------------------------
https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=372670
Defender new feature Whitelist auto remove
Microsoft Defender for Office 365 will introduce a feature to automatically remove allow list entries 45 days after their last use, starting late June 2024. This applies to customers with Microsoft Exchange Online Protection and Defender for Office 365 Plan 1 or 2. Users are advised to update their allow entries to utilize this new feature. https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=372670