How to Resolve Tenant Allow/Block List vs. Transport Rules Conflicts in Exchange Online
Question details
The user needs to understand how Exchange Online processes the Tenant Allow/Block List compared to transport rules, particularly when a transport rule fails to override a tenant-level block for a sender.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Configuring email filtering and mail flow rules to allow trusted senders to bypass spam filters while maintaining security.
- Observed behavior
- Messages are blocked by the Tenant Allow/Block List even when a mail flow transport rule is explicitly configured to allow the sender.
Ensure you are signed in with Exchange Administrator or Global Administrator credentials in your Microsoft 365 environment before attempting to modify threat policies or mail flow rules.
Review and Modify the Tenant Allow/Block List
Since Microsoft 365 filtering generally prioritizes the Tenant Allow/Block List over standard transport rules, you should manage trusted senders directly within the tenant list.
Transport rules process messages in transit, but a tenant-level block is enforced by Microsoft 365's core filtering system. Relying on a transport rule to bypass a strict block is not recommended and often fails to override the protection.
Log in to the Microsoft 365 Defender portal and navigate to 'Policies & rules' under the Email & collaboration section on the left-hand menu.
Click on 'Threat policies' and then select 'Tenant Allow/Block Lists' from the list of available policies.
Check the domains, senders, spoofed senders, and URLs tabs for any blocked entries that might be incorrectly affecting your mail flow.
If a trusted sender is being blocked, remove their block entry and add them to the Allow list to ensure their emails bypass filtering successfully.
Run a Message Trace to Analyze Mail Flow
Use the message trace tool to determine exactly which rule or threat policy is intercepting and blocking the message.
Experience a Seamless Productivity Suite with WPS Office
While managing Exchange server security policies requires Microsoft administrative tools, your daily document management needs a reliable office suite. WPS Office provides a lightweight, free alternative to Microsoft Office desktop apps, fully compatible with your existing documents.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installer.
- 2. Install the Application: Run the installer and follow the simple on-screen instructions to set up the software.
- 3. Open Your Files: Launch WPS Office and instantly open any existing Microsoft Office files with perfect formatting retention.
Frequently Asked Questions
Why is my transport rule not bypassing a blocked sender?
Exchange Online evaluates tenant allow and block settings as part of its core filtering process. A transport rule processes messages in transit and typically cannot override a strict tenant-level block. You must remove the block or add an allow entry directly in the Tenant Allow/Block List.
Where can I find the Tenant Allow/Block List in Microsoft 365?
You can find it in the Microsoft 365 Defender portal under the 'Email & collaboration' section. Go to 'Policies & rules', click 'Threat policies', and then select 'Tenant Allow/Block Lists'.
How do I know if a message was blocked by a transport rule or a tenant policy?
You can run a Message Trace in the Exchange admin center. The trace details will provide a step-by-step breakdown of the mail flow, showing exactly which transport rule or threat policy intercepted and blocked the message.
Is it safe to add domains to the Tenant Allow List?
You should only add domains or senders to the allow list if you explicitly trust them and have verified their identity. Allowing untrusted senders bypasses essential security filtering, which can expose your organization to phishing, spoofing, or malware.
