New-TenantAllowBlockListItems

Reference

Module:: ExchangePowerShell

Applies to:: Exchange Online, Security & Compliance, Exchange Online Protection

Note: The features described in this topic are in Preview, are subject to change, and are not available in all organizations.

This cmdlet is available only in the cloud-based service.

Use the New-TenantAllowBlockListItems cmdlet to add entries to the Tenant Allow/Block List in the Microsoft 365 Defender portal.

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.

Syntax

New-TenantAllowBlockListItems
   -Entries <String[]>
   -ListType <ListType>
   [-ExpirationDate <DateTime>]
   [-Allow]
   [-Block]
   [-ListSubType <ListSubType>]
   [-Notes <String>]
   [-OutputJson]
   [-SubmissionID <String>]
   [<CommonParameters>]

New-TenantAllowBlockListItems
   -Entries <String[]>
   -ListType <ListType>
   [-NoExpiration]
   [-Allow]
   [-Block]
   [-ListSubType <ListSubType>]
   [-Notes <String>]
   [-OutputJson]
   [-SubmissionID <String>]
   [<CommonParameters>]

Description

You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.

Examples

Example 1

New-TenantAllowBlockListItems -ListType Url -Block -Entries ~contoso.com~

This example adds a URL block entry for contoso.com and all subdomains (for example, contoso.com, www.contoso.com, xyz.abc.contoso.com, and www.contoso.com/b). Because we didn't use the ExpirationDate or NoExpiration parameters, the entry expires after 30 days.

Example 2

New-TenantAllowBlockListItems -ListType FileHash -Block -Entries "768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3","2c0a35409ff0873cfa28b70b8224e9aca2362241c1f0ed6f622fef8d4722fd9a" -NoExpiration

This example adds a file block entry for the specified files that never expires.

Parameters

-Allow

The Allow switch specifies that this is an allow entry for advanced delivery (third-party phishing simulation URLs). You don't need to specify a value with this switch.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Exchange Online Protection

-Block

The Block switch specifies that this is a block entry. You don't need to specify a value with this switch.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-Entries

The Entries parameter specifies the URL or files that you want to add to the Tenant Allow/Block List based on the value of the ListType parameter:

URLs: Use IPv4 or IPv6 addresses or hostnames. Wildcards (* and ~) are supported in hostnames. Protocols, TCP/UDP ports, or user credentials are not supported. For details, see URL syntax for the Tenant Allow/Block List.
Files: Use the SHA256 hash value of the file. In Windows, you can find the SHA256 hash value by running the following command in a Command Prompt: certutil.exe -hashfile "<Path>\<Filename>" SHA256. An example value is 768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3.

To enter multiple values, use the following syntax: "Value1","Value2",..."ValueN".

You can't mix URL and file values or allow and block actions in the same command.

You can't modify the URL or file values after you create the entry.

Type:	String[]
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-ExpirationDate

The ExpirationDate parameter filters the results by expiration date in Coordinated Universal Time (UTC).

To specify a date/time value for this parameter, use either of the following options:

Specify the date/time value in UTC: For example, "2021-05-06 14:30:00z".
Specify the date/time value as a formula that converts the date/time in your local time zone to UTC: For example, (Get-Date "5/6/2020 9:30 AM").ToUniversalTime(). For more information, see Get-Date.

You can't use this parameter with the NoExpiration switch.

Type:	DateTime
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-ListSubType

The ListSubType parameter specifies the subtype for this entry. Valid values are:

AdvancedDelivery
Tenant: This is the default value.

Type:	ListSubType
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Exchange Online Protection

-ListType

The ListType parameter specifies the type of entry to add. Valid values are:

FileHash
Url

Type:	ListType
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-NoExpiration

The NoExpiration switch specifies that the block entry should never expire. You don't need to specify a value with this switch.

You can't use this switch with the ExpirationDate parameter.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-Notes

The Notes parameters specifies additional information about the object. If the value contains spaces, enclose the value in quotation marks (").

Type:	String
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-OutputJson

The OutputJson switch specifies whether to return all entries in a single JSON value. You don't need to specify a value with this switch.

You use this switch to prevent the command from halting on the first entry that contains a syntax error.

Type:	SwitchParameter
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Security & Compliance, Exchange Online Protection

-SubmissionID

This parameter is reserved for internal Microsoft use.

Type:	String
Position:	Named
Default value:	None
Accept pipeline input:	False
Accept wildcard characters:	False
Applies to:	Exchange Online, Exchange Online Protection