> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/email/administration/tenant-allow-block-lists.md).
# Tenant Allow/Block Lists
Exchange Online Protection's tenant allow/block list holds the manual overrides that sit in front of the filtering stack: senders, URLs, file hashes, and IP addresses that a tenant should always block or always allow. This page shows every list type in a single table and lets you add entries to one tenant or several at once.
{% hint style="warning" %}
Allow entries weaken filtering and Microsoft treats them as temporary by design. Use them to unblock something Exchange has wrongly caught, not as a standing exemption, and prefer an expiring entry over one that never expires.
{% endhint %}
## Action Buttons
Add Entry
Opens the **Add Tenant Allow/Block List Entry** drawer.
| Field | Description |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Select Tenants | The tenants the entries are added to. More than one can be chosen, and the tenant you are currently on is preselected. Required. |
| Entries | The values to allow or block, separated by commas or semicolons. Required, and validated against the chosen list type. |
| Notes | Free text stored with the entries in Exchange, useful for recording who asked for them and why. |
| List Type | What the entries are: **Sender**, **Url/IPv4**, **FileHash**, or **IPv6**. Required. |
| Block or Allow Entry | Whether the entries are blocked or allowed. Required. |
| No Expiration | Keeps the entries in place indefinitely rather than letting Exchange expire them. |
| Remove After 45 Days | Removes the entries 45 days after they were last used. |
**Add Entry** submits the form. The drawer stays open afterwards with the button reading **Add Another**, so several entries can be added in one sitting.
The form adjusts itself as you choose a list type and method, since Exchange does not accept every combination:
| Rule | Behaviour |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| FileHash entries can only be blocked | Choosing **FileHash** forces the method to **Block** and locks the selector. |
| No Expiration is not available for every allow entry | It can be set on any block entry, and on allow entries only when the list type is **Url/IPv4** or **IPv6**. |
| Remove After 45 Days applies to allow entries only | It can be set only on an allow entry whose list type is **Sender**, **Url/IPv4**, or **FileHash**. |
| The two expiry switches are mutually exclusive | Turning one on turns the other off. |
Entry formats are validated before the form can be submitted, and the hint under **Entries** changes to match the list type.
| List Type | Expected format |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Sender | Domains or email addresses, for example `contoso.com` or `user@example.com`. Wildcards are accepted in the form `*.domain.com`. |
| Url/IPv4 | Hostnames, hostname paths such as `test.com/test`, IPv4 addresses, or IPv6 addresses. Do not include `http://` or `https://`. Entries are limited to 250 characters, and wildcards such as `*.domain.com` or `domain.*` are accepted. |
| FileHash | SHA256 hashes, each exactly 64 characters. |
| IPv6 | IPv6 addresses only, in colon-hexadecimal or CIDR notation. |
{% hint style="info" %}
Each tenant is submitted separately, so a failure against one tenant does not stop the rest. The results panel reports the outcome for every tenant you selected, and it is worth reading rather than assuming a single success line covers them all.
{% endhint %}
## Table Details
| Column | Description |
| ------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Value | The sender, URL, file hash, or IP address the entry applies to. |
| List Type | Which list the entry belongs to: `Sender`, `Url`, `FileHash`, or `IP`. |
| Action | Whether the entry blocks or allows. |
| Notes | The note recorded against the entry when it was created. |
| Last Used Date | When Exchange last matched mail against the entry. Empty if it has never been used. |
| Last Modified Date Time | When the entry was last changed. |
| Expiration Date | When Exchange will remove the entry. Empty on an entry set never to expire. |
| Remove After (Days of Last Use) | The number of days after last use that the entry is removed, set to 45 when the removal option is used. |
{% hint style="info" %}
**List Type** shows the value Exchange uses rather than the label on the form, so an entry added as **Url/IPv4** lists as `Url`, and one added as **IPv6** lists as `IP`.
{% endhint %}
If a tenant does not support one of the four list types, that type is skipped and a warning is written to the CIPP logs. The other three still load, so a partial table is not necessarily an error.
## Table Actions
Action
Description
Bulk Action Available
Remove
Removes the entry from the tenant's allow/block list. Removal is immediate and the entry cannot be recovered, so a block that is still needed has to be added again.
true
***
## Feature Requests / Ideas
We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cipp.app/user-documentation/email/administration/tenant-allow-block-lists.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.