Security Policy Errors

How to Block Spam Email for All Microsoft 365 Users via IP

Chanuka Geekiyanage Oct 12, 2026 869 views

Question details

Microsoft 365 administrators need to block incoming spam messages for all users across the organization, especially when malicious senders use rotating domains.

Block Spam Email for All Microsoft 365 Users

Product: Microsoft 365
Device & OS: not provided
Scenario: Administrators are attempting to set up a robust, organization-wide spam filter because traditional domain-based blocking is failing against rotating domains.
Observed behavior: Spam bypasses standard domain filters due to changing domains, requiring a network-level block using source IP addresses or address ranges.

Before you start

Ensure you have the necessary administrator privileges in Microsoft 365 to access and modify policies within the Microsoft Defender portal.

Solution 1Recommended

Configure the IP Block List in the Connection Filter Policy

Block known malicious source IP addresses or address ranges directly at the network edge to prevent spam from reaching any users in your organization.

By adding IP addresses to the IP Block List within the connection filter policy, Microsoft 365 will reject incoming messages from those sources before they even hit your users' mailboxes or junk folders.

Access the Microsoft Defender Portal

Navigate to security.microsoft.com and sign in with your Microsoft 365 administrator credentials.

Navigate to Anti-spam Policies

In the left-hand navigation pane, go to Email & Collaboration > Policies & Rules > Threat policies, and then click on Anti-spam under the Policies section.

Edit the Connection Filter Policy

Select 'Connection filter policy (Default)' from the list of policies. In the flyout pane that appears, click on 'Edit connection filter policy'.

Add IPs to the Block List

Locate the 'Always block messages from the following IP addresses or address range' section. Enter the specific malicious IP addresses or CIDR ranges you wish to block.

Save Your Changes

Click 'Save' at the bottom of the pane. The new IP blocking rules will be applied to incoming mail across your entire organization.

Configure the IP Block List in the Connection Filter Policy

Caution with Shared Infrastructure: Review the impact carefully. Avoid blocking shared or legitimate mail infrastructure, as this may result in unintentionally blocking valid emails from reaching your organization.

Free Microsoft Office alternative

Looking for a Reliable Document Suite? Try WPS Office

While you manage your organization's Microsoft 365 email security, equip your team with WPS Office. It is a highly compatible, lightweight, and user-friendly alternative to Microsoft Office that meets all everyday document needs without the heavy subscription fees.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Run the Setup: Open the downloaded installation file and follow the simple on-screen instructions.
3. Start Creating: Launch WPS Office to immediately start working with documents, spreadsheets, and presentations.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight application that requires minimal system resourcesFamiliar user interface for a seamless, zero-learning-curve transitionBuilt-in robust tools for advanced PDF editing and conversions

microsoft office alternative - wps office

Frequently Asked Questions

Why is blocking by IP address more effective than blocking by domain for spam?

Spammers frequently change or spoof sender domains to bypass content filters. Blocking the source IP address is generally more effective because changing physical network infrastructure is much harder and more expensive for malicious senders.

Can I block entire countries or regions from sending emails to my Microsoft 365 users?

Yes. In addition to specifying IP addresses, you can configure international spam filter settings within your Anti-spam policies to block emails originating from specific countries or written in specific languages.

What happens to emails sent from an IP address on the Block List?

Messages originating from IP addresses listed in the IP Block List are rejected at the Microsoft 365 network edge. This means the emails will not reach your users' inboxes or their Junk Email folders.

How long does it take for the connection filter policy changes to take effect?

Changes to the connection filter policy in Microsoft 365 typically take effect within an hour, though it may occasionally take a bit longer to propagate fully across Microsoft's global network servers.

Microsoft Office Security Issues