Security Policy Errors

Where to Block Email Addresses and Domains in Microsoft 365

Ayan Masood Oct 21, 2026 868 views

Question details

The user needs to know the correct administrative locations within Microsoft 365 to block specific email senders and domains.

Where to Block Email Addresses and Domains in Microsoft 365

Product: Microsoft 365
Device & OS: not provided
Scenario: An administrator is attempting to configure tenant-wide security policies to prevent spam or malicious emails but is unsure which admin center to use.
Observed behavior: The user is seeking guidance on navigating between Microsoft Defender, Exchange Admin Center, and Purview to implement domain and sender block lists properly.

Before you start

Ensure you are logged in with Global Administrator or Security Administrator credentials, as standard user accounts do not have permission to configure tenant-wide email filtering policies.

Solution 1Recommended

Block Senders via the Tenant Allow/Block List in Microsoft Defender

Microsoft Defender for Office 365 is the recommended centralized location to override spam filtering verdicts and explicitly block malicious domains or senders.

Microsoft 365 relies heavily on the Tenant Allow/Block List in Defender to manage explicit block actions for the entire tenant. This is the primary method for stopping unwanted incoming email addresses and domains before they reach user inboxes.

Access Microsoft 365 Defender

Navigate to the Microsoft 365 Defender portal at security.microsoft.com and log in with your administrative credentials.

Open Policies and Rules

In the left navigation pane, expand 'Email & collaboration', select 'Policies & rules', and then click on 'Threat policies'.

Manage Tenant Allow/Block List

Under the 'Rules' section on the Threat policies page, select 'Tenant Allow/Block Lists'. Click on the 'Domains & addresses' tab.

Add Blocked Entities

Click the 'Block' button. Enter the specific email addresses or domains you want to block (one per line or comma-separated), configure the expiration settings (or set to 'Never expire'), and click 'Add'.

Block Senders via the Tenant Allow/Block List in Microsoft Defender

Policy Precedence: Always review your existing allowed senders and anti-spam settings. Microsoft 365 uses policy precedence, meaning a conflicting 'Allow' rule elsewhere might override your new block list.

Solution 2

Create Mail Flow Rules in the Exchange Admin Center (EAC)

Use the Exchange Admin Center to create customized mail flow (transport) rules if you need to block senders based on complex conditions beyond just the email address.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Microsoft Office Productivity Apps?

While Microsoft 365 handles robust enterprise email and security policies, you might be looking for a simpler, cost-effective solution for everyday document creation. WPS Office is a free, lightweight suite that is fully compatible with Microsoft Word, Excel, and PowerPoint.

Fully compatible with Microsoft Office document formats (.docx, .xlsx, .pptx)Free to download and use with essential office and PDF toolsLightweight software that runs smoothly on older or low-spec devicesAll-in-one interface allowing you to open documents, spreadsheets, and presentations in one tabbed window

microsoft office alternative - wps office

Frequently Asked Questions

Why is a blocked sender still able to email my Microsoft 365 users?

This usually happens due to policy precedence in Microsoft 365. If the sender's domain is listed in your 'Allowed Senders' list or if a specific mail flow rule bypasses spam filtering, it will override the block list. Check your anti-spam policies and Tenant Allow/Block List rules to ensure no conflicting configurations exist.

Can I block a domain for a single user rather than the whole tenant?

Yes, individual users can block senders or domains by adding them to their personal Blocked Senders list directly in Outlook on the web or the Outlook desktop app. However, tenant-wide blocks managed in Defender or Exchange Admin Center will apply to all users.

What is the difference between blocking in Defender and Exchange Admin Center?

Microsoft Defender uses the Tenant Allow/Block List which integrates directly with M365's security and filtering stack, making it ideal for combating spam and malware threats. The Exchange Admin Center uses mail flow rules (transport rules), which are better suited for broader, highly customized compliance and mail routing policies.

Microsoft Office Security Issues