How to Configure Blacklists and Whitelists in Office 365 Using Transport Rules and the Security Portal

Introduction

In Office 365, managing email flow efficiently is essential for maintaining security and productivity. Using transport rules and the security portal, you can create custom policies to control which emails are allowed or blocked. This includes setting up blacklists (for blocking unwanted senders) and whitelists (for ensuring safe and trusted senders are not blocked). In this guide, we will walk you through how to configure both.

1. Understanding Transport Rules in Office 365

Transport rules in Office 365 (also known as mail flow rules) help you manage the flow of messages in your organization based on specific conditions. You can apply these rules to filter out spam, block or allow specific senders, and more.

2. Creating a Transport Rule for Blacklisting and Whitelisting

Transport rules are useful for blocking or allowing emails from specific senders or domains. Here’s how to set them up:

Step-by-Step for Blacklisting:

Login to Office 365 Admin Center:
- Go to the Microsoft 365 admin center.
- In the left-hand pane, expand Admin centers and select Exchange.
Create a New Mail Flow Rule:
- In the Exchange Admin Center (EAC), select Mail Flow in the left-hand pane.
- Click on + to create a new rule and select Create a new rule.
Configure Rule Name:
- Name your rule (e.g., “Blacklist - Block Specific Sender”).
Set Conditions:
- In the Apply this rule if… dropdown, choose The sender is… or The sender’s domain is… depending on whether you want to block a specific address or entire domain.
- Enter the email address or domain you want to block.
Define the Action:
- In the Do the following dropdown, select Delete the message without notifying anyone or Reject the message with the explanation depending on your desired action.
Set Additional Options (Optional):
- You can choose to audit this rule or add exceptions based on other criteria (e.g., bypassing certain internal emails).
Save the Rule:
- Once you’ve configured the rule, click Save.

Step-by-Step for Whitelisting:

Follow Steps 1–3 Above to create a new rule for whitelisting.
Configure Rule Name:
- Name your rule (e.g., “Whitelist - Allow Trusted Sender”).
Set Conditions:
- In the Apply this rule if… dropdown, select The sender is… or The sender’s domain is… depending on whether you want to whitelist a specific address or domain.
- Enter the email address or domain you want to whitelist.
Define the Action:
- In the Do the following dropdown, select Set the message header to “X-MS-Exchange-Organization-AuthAs: Internal” to ensure the email bypasses filtering mechanisms.
Save the Rule:
- Click Save to apply the whitelist rule.

3. Managing Blacklists and Whitelists in the Security & Compliance Portal

The Microsoft Defender portal (formerly part of the Security & Compliance Center) offers an additional way to configure and manage blacklists and whitelists via anti-spam policies.

Accessing Anti-Spam Policies:

Login to Microsoft Defender Portal:
- Navigate to the Microsoft 365 Defender portal at https://security.microsoft.com.
- In the left-hand pane, select Email & collaboration and then Policies & rules.
Configure Anti-Spam Policies:
- Select Anti-spam policies under Threat policies.
- To create a new policy, click on + Create a policy, and choose Anti-spam policy.
Set Up Custom Block or Allow Lists:
- Under Inbound spam filter policy, scroll down to Allowed senders and domains or Blocked senders and domains.
- Add the email addresses or domains you want to whitelist or blacklist.
Save the Policy:
- After configuring your desired lists, click Save.

4. Testing and Monitoring the Rules

Once your rules are in place, it’s crucial to test them to ensure they are functioning as expected. You can use the following methods:

Test Email Flow: Send test emails from the blacklisted and whitelisted addresses/domains to verify if the rule is applied correctly.
Monitor through the Security Portal: Check the Threat Protection Status in the Defender portal for any email filtering actions or alerts triggered by the blacklist or whitelist rules.

5. Best Practices

Regularly Review Rules: Ensure your blacklists and whitelists are up to date to avoid false positives and negatives.
Use Transport Rules for Granular Control: If you need more specific control over email flow, transport rules are the way to go.
Integrate with Other Protection Layers: Combine these rules with Microsoft Defender’s anti-phishing and anti-malware policies for comprehensive email security.

Conclusion

By leveraging transport rules and the Microsoft Defender security portal, you can create a robust system for managing blacklists and whitelists in Office 365. With proper configuration, these tools help ensure a smooth and secure email experience while minimizing unwanted spam or potentially dangerous emails.

Search This Blog

O365