You can specify the following types of overrides: The Tenant Allow/Block List is used during mail flow for incoming messages (does not apply to intra-org messages) and at the time of user clicks. The Tenant Allow/Block List in the Microsoft 365 Defender portal gives you a way to manually override the Microsoft 365 filtering verdicts. For example, a good message might be marked as bad (a false positive), or a bad message might be allowed through (a false negative). In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, you might disagree with the EOP filtering verdict. If your organization does not have the spoof features as described in this article, see the older spoof management experience at Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP. Some of the features described in this article are in Preview, are subject to change, and are not available in all organizations.
