-The setting is available via the Microsoft 365 Admin Center Settings menu item. Select Settings, select Org Settings, and then the Organizational Settings profile tab as illustrated below.

-3. On the **Org settings** page, select **Organizational profile**.

-4. On the **Organizational profile** page, select **Send email notifications from your domain**.

-**Billing support hours:**\

-English: Monday through Friday, 9 AM-5 PM

-description: "Prepare for and deploy the Microsoft Purview Extension."

-# Get started with Microsoft Purview Chrome Extension

-Use these procedures to roll out the Microsoft Purview Chrome Extension.

-> Microsoft Purview Extension is only applicable to Windows devices. The extension is not necessary for the enforcement of data loss prevention on macOS devices.

-To use Microsoft Purview Chrome Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP

-# Learn about the Microsoft Purview Chrome Extension

-Once the Microsoft Purview Chrome Extension is installed on a Windows 10/11 device, organizations can monitor when a user attempts to access or upload a sensitive item to a cloud service using Google Chrome and enforce protective actions via DLP.

-See [Get started with the Microsoft Purview Chrome Extension](dlp-chrome-get-started.md) for complete deployment procedures and scenarios.

-> The **Service domains** setting only applies to files uploaded using Microsoft Edge or an instance of Google Chrome that has the [Microsoft Purview Chrome Extension](dlp-chrome-learn-about.md) installed.

-<!--### Scenario 2 Monitor or restrict user activities on sensitive service domains

-#### Scenario 2 pre-requisites and assumptions

-#### Scenario 2 policy intent statement and mapping

-#### Steps to create policy for scenario 2

-### Scenario 2

-5) Scenario 2 email - ΓÇ£Contoso needs to block all emails that contain a password protected OR a zip document file extension is zip/7z except it the recipient is in the contoso.com domain OR the fabrikam domain OR the sender is a member of the Contoso HR group. Introduces nested NOT with and OR

-### Scenario 3

-### Scenario 2 Show policy tip as oversharing popup (preview)

-description: "Prepare for and deploy the Microsoft Purview Firefox Extension."

-# Get started with Microsoft Purview Firefox Extension

-Use these procedures to roll out the Microsoft Purview Firefox Extension.

-To use Microsoft Purview Extension, the device must be onboarded into endpoint DLP. Review these articles if you are new to DLP or endpoint DLP

-#### Adding the Firefox Extension to the ForceInstall List

-### Test the Extension

-description: "The Microsoft Purview Firefox Extension extends monitoring and control of file activities and protective actions to the Firefox browser"

-# Learn about the Microsoft Purview Firefox Extension

-3. [Install the Firefox extension on your Windows 10 devices](dlp-firefox-extension-get-started.md)

-See [Get started with the Microsoft Purview Firefox Extension](dlp-firefox-extension-get-started.md) for complete deployment procedures and scenarios.

-hideEdit: true

-If you have an automated process that makes use of the business justification values, the process can access that information programmatically in the email X-header data.

-> The AIP add-in used PowerShell advanced settings for [oversharing popup messages in Outlook](/azure/information-protection/rms-client/clientv2-admin-guide-customizations#implement-pop-up-messages-in-outlook-that-warn-justify-or-block-emails-being-sent). When you use built-in labeling, the equivalent of this configuration is now available as a [DLP policy configuration](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview).

- - Justification for changing a label

- - Require users to label their meetings and calendar event (also known as mandatory labeling)

- - Help link to a custom help page

- - Prevent copy of meeting chat

- - Prevent copy of meeting chat

-This setting is currently unsupported for virtual desktop infrastructure (VDI).

-The methods supported to prevent copying chat: Select the text and then right-click \> **Copy** or Ctrl+C. Copying using developer tools or third-party apps won't be prevented.

-Now available in the Beta Channel for Android, and not yet for iOS, you can use a Microsoft Intune [Managed apps app configuration policy](/mem/intune/apps/app-configuration-policies-managed-app#add-a-managed-apps-app-configuration-policy) to configure a setting from the Intune App Software Development Kit (SDK) that changes when users are prompted to select a sensitivity label for Outlook Mobile.

-|[Preventing oversharing as DLP policy tip](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)|Preview: [Current Channel (Preview)](https://office.com/insider) |Under review |Under review |Under review |Under review |

- - [Show policy tips as an oversharing popup](dlp-create-deploy-policy.md#scenario-2-show-policy-tip-as-oversharing-popup-preview)

-See the following links to understand workload data location.

-152 | Default<BR>Optional<BR>**Notes:** These endpoints enables the Office Scripts functionality in Office clients available through the Automate tab. This feature can also be disabled through the Office 365 Admin portal. | No | `*.microsoftusercontent.com` | **TCP:** 443

-keywords: windows defender, defender for endpoint, next-generation, antivirus, compatibility, passive mode

-ms.pagetype: security

-ms.sitesec: library

-> [!NOTE]

-> In general, Microsoft Defender Antivirus does not run in passive mode on devices that are not onboarded to Defender for Endpoint.

-|Windows Server 2022<br/>Windows Server 2019<br/>Windows Server, version 1803, or newer <br/> Windows Server 2016 |A non-Microsoft antivirus/antimalware solution|Disabled (set manually) ^[[1](#fn1)]|

-(<a id="fn1">1</a>) On Windows Server, if you're running a non-Microsoft antivirus product, you can uninstall Microsoft Defender Antivirus by using the following PowerShell cmdlet (as an administrator): `Uninstall-WindowsFeature Windows-Defender`. Restart your server to finish removing Microsoft Defender Antivirus.

-> [!TIP]

-> On Windows Server 2016, you might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus*.

-| Windows version | Antivirus/antimalware solution | Onboarded to <br/> Defender for Endpoint? | Microsoft Defender Antivirus state |

-|:|:|:-|:-|

-| Windows 10 <br/> Windows 11| Microsoft Defender Antivirus | Yes | Active mode |

-| Windows 10 <br/> Windows 11 | Microsoft Defender Antivirus | No | Active mode |

-| Windows 10 <br/> Windows 11 | A non-Microsoft antivirus/antimalware solution | Yes | Passive mode (automatically) |

-| Windows 10 <br/> Windows 11 | A non-Microsoft antivirus/antimalware solution | No | Disabled mode (automatically) |

-| Windows Server 2022 <br/> Windows Server 2019 <br/>Windows Server, version 1803 or newer | Microsoft Defender Antivirus | Yes | Active mode |

-| Windows Server 2022 <br/> Windows Server 2019 <br/> Windows Server, version 1803 or newer | Microsoft Defender Antivirus | No | Active mode |

-| Windows Server 2022 <br/> Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> |

-| Windows Server 2022 <br/> Windows Server 2019 <p> Windows Server, version 1803 or newer | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)] |

-| Windows Server 2016 <br/> Windows Server 2012 R2 | Microsoft Defender Antivirus | Yes | Active mode |

-|Windows Server 2016 <br/> Windows Server 2012 R2 | Microsoft Defender Antivirus | No | Active mode |

-| Windows Server 2016 <br/> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | Yes | Microsoft Defender Antivirus must be set to passive mode (manually) <sup>[[2](#fn2)]<sup> |

-|Windows Server 2016 <br/> Windows Server 2012 R2 | A non-Microsoft antivirus/antimalware solution | No | Microsoft Defender Antivirus must be disabled (manually) <sup>[[3](#fn3)]<sup> |

-(<a id="fn2">2</a>) On Windows Server 2019, Windows Server, version 1803 or newer, Windows Server 2016, or Windows Server 2012 R2, Microsoft Defender Antivirus doesn't enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, set Microsoft Defender Antivirus to passive mode to prevent problems caused by having multiple antivirus products installed on a server. You can set Microsoft Defender Antivirus to passive mode using a registry key as follows:

- > [!NOTE]

- > For passive mode to work on endpoints running Windows Server 2016 and Windows Server 2012 R2, those endpoints must be onboarded with the modern, unified solution described in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016).

-(<a id="fn3">3</a>) On Windows Server 2016, Windows Server 2012 R2, Windows Server version 1803 or newer, Windows Server 2019, and Windows Server 2022, if you are using a non-Microsoft antivirus product on an endpoint that is *not* onboarded to Microsoft Defender for Endpoint, disable/uninstall Microsoft Defender Antivirus manually to prevent problems caused by having multiple antivirus products installed on a server.

-Defender for Endpoint includes capabilities that further extend the antivirus protection that is installed on your endpoint. You can benefit from running Microsoft Defender Antivirus alongside another antivirus solution.

-For example, [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md) provides added protection from malicious artifacts even if Microsoft Defender Antivirus is not the primary antivirus product. Such capabilities require Microsoft Defender Antivirus to be installed and running in passive mode or active mode.

-| [Real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md) | Yes | See note ^[[4](#fn4)] | No | No |

-| [File scanning and detection information](review-scan-results-microsoft-defender-antivirus.md) | Yes | Yes ^[[5](#fn5)] | No | Yes |

-| [Threat remediation](configure-remediation-microsoft-defender-antivirus.md) | Yes | See note ^[[6](#fn6)] | No | Yes |

-| [Security intelligence updates](microsoft-defender-antivirus-updates.md) | Yes | Yes ^[[7](#fn7)] | No | Yes ^[[7](#fn7)] |

-| [Web content filtering](web-content-filtering.md) | Yes | See note ^[[8](#fn8)] | No | No |

-(<a id="fn4">4</a>) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection doesn't provide any blocking or enforcement, even though it's enabled and in passive mode.

-(<a id="fn5">5</a>) When Microsoft Defender Antivirus is in passive mode, scans aren't scheduled. Note that scan tasks that are enabled in Windows Task Scheduler will continue to run according to their schedule. If you have such scheduled tasks, you can remove these if preferred.

-(<a id="fn6">6</a>) When Microsoft Defender Antivirus is in passive mode, it doesn't remediate threats. However, threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md). In this case, you might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.

-(<a id="fn7">7</a>) The security intelligence update cadence is controlled by Windows Update settings only. Defender-specific update schedulers (daily/weekly at specific time, interval-based) settings only work when Microsoft Defender Antivirus is in active mode. They're ignored in passive mode.

-(<a id="fn8">8</a>) When Microsoft Defender Antivirus is in passive mode, web content filtering only works with the Microsoft Edge browser.

-> Beginning with [platform version 4.18.2208.0 and later](microsoft-defender-antivirus-updates.md#monthly-platform-and-engine-versions): If a server has been onboarded to Microsoft Defender for Endpoint, the "Turn off Windows Defender" [group policy](configure-endpoints-gp.md#update-endpoint-protection-configuration) setting will no longer completely disable Windows Defender Antivirus on Windows Server 2012 R2 and later. Instead, it will place it into passive mode. In addition, the [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) feature will allow a switch to active mode but not to passive mode.

-> - If "Turn off Windows Defender" is already in place before onboarding to Microsoft Defender for Endpoint, there will be no change and Defender Antivirus will remain disabled.

-> - To switch Defender Antivirus to passive mode, even if it was disabled before onboarding, you can apply the [ForceDefenderPassiveMode configuration](switch-to-mde-phase-2.md#set-microsoft-defender-antivirus-to-passive-mode-on-windows-server) with a value of `1`. To place it into active mode, switch this value to `0` instead.

-> Note the modified logic for `ForceDefenderPassiveMode` when tamper protection is enabled: Once Microsoft Defender Antivirus is toggled to active mode, tamper protection will prevent it from going back into passive mode even when `ForceDefenderPassiveMode` is set to `1`.

-> Use this procedure only to confirm whether Microsoft Defender Antirivus is running on an endpoint.

-In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. Settings that are configured by using Configuration Manager, Group Policy, Microsoft Intune, or other management products will apply. Files are scanned, threats are remediated, and detection information is reported in your configuration tool (such as in the Microsoft Intune admin center or the Microsoft Defender Antivirus app on the endpoint).

-In passive mode, Microsoft Defender Antivirus isn't used as the antivirus app, and threats are *not* remediated by Microsoft Defender Antivirus. However, threats can be remediated by [Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md). Files are scanned by EDR, and reports are provided for threat detections that are shared with the Defender for Endpoint service. You might see alerts showing Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in passive mode.

-**Make sure to get your antivirus and antimalware updates, even if Microsoft Defender Antivirus is running in passive mode**. See [Manage Microsoft Defender Antivirus updates and apply baselines](microsoft-defender-antivirus-updates.md).<br/><br/>Note that passive mode is only supported on Windows Server 2012 R2 & 2016 when the machine is onboarded using the [modern, unified solution](/microsoft-365/security/defender-endpoint/configure-server-endpoints).

-3. Select the **Workload** and **Record type** from the list shown in the following table to further narrow your search

-

-

-

-In addition to using Audit New Search in the Microsoft Purview compliance portal, you can use PowerShell cmdlets to search for audit logs. [Learn more](/microsoft-365/compliance/audit-log-search-script)

-[Learn more about Microsoft's commercial licensing terms](https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA)

-Defender Experts for XDR requests for certain roles and permissions for you to fully access the service capabilities. [Learn more](dex-xdr-permissions.md)

-The following sections enumerate additional information about the serviceΓÇÖs data usage, compliance, and availability. For more information about Microsoft's commitment in valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/en-us/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **[Microsoft Defender Experts](https://aka.ms/trustcenter-defenderexperts)**

-All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft 365 Defender service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations)

-

-

-> If you turn off **Access security data from all devices**, our experts wonΓÇÖt be able to investigate incidents involving devices that belong to Microsoft Defender for Endpoint device groups. [Learn more about device groups](../defender-endpoint/machine-groups.md)

-

-

-

-Otherwise, if an incident is classified as _True Positive_, our experts then identify recommended response actions that need to be performed. The method in which the actions are performed depends on the permissions and access levels you have given the Defender Experts for XDR service. [Learn more about granting permissions to our experts](get-started-xdr.md#grant-permissions-to-our-experts)

-

-

-In the Microsoft 365 Defender portal, an incident that requires your attention using guided response has the **Assigned to** field set to _Customer_ and a task card on top of the **Incidents** pane. Your designated incident contacts also receives a corresponding email notification with a link to the Defender portal to view the incident. [Learn more about notification contacts](get-started-xdr.md#tell-us-who-to-contact-for-important-matters)

-

-

-

-> Before performing any of the recommended guided response actions, make sure that they are not already being addressed by your automated investigation and response configurations. [Learn more about automated investigation and response capabilities in Microsoft 365 Defender](m365d-autoir.md)

-> You can also monitor the status of in-portal response actions in the [Action center](m365d-action-center.md).

-

-

-

- 

- 

- When spoof intelligence is enabled, the **spoof intelligence insight** shows spoofed senders that were automatically detected and allowed or blocked by spoof intelligence. You can manually override the spoof intelligence verdict to allow or block the detected spoofed senders from within the insight. But when you do, the spoofed sender disappears from the spoof intelligence insight, and is now visible only on the **Spoofed senders** tab in the Tenant Allow/Block List. You can also manually create allow or block entries for spoofed senders in the Tenant Allow/Block List. For more information, see the following articles:

-This query allows admins to identify wanted and unwanted senders. If a bulk sender has a BCL score that's less than the bulk threshold, admins can [report the sender's messages to Microsoft for analysis](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-on-the-submissions-page). This action also adds the sender as an allow entry in the Tenant Allow/Block List.

-5. After you identify wanted and unwanted bulk senders, adjust the bulk threshold in the default anti-spam policy and in custom anti-spam policies. If some bulk senders don't fit within your bulk threshold, [report the messages to Microsoft for analysis](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-on-the-submissions-page).

-> - Only spoofed senders that were detected by spoof intelligence appear in the spoof intelligence insight. When you override the allow or block verdict in the insight, the spoofed sender becomes a manual allow or block entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List. You can also manually create allow or block entries for spoofed senders before they're detected by spoof intelligence. For more information, see [Manage the Tenant Allow/Block List in EOP](tenant-allow-block-list-about.md).

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & Collaboration** \> **Policies & Rules** \> **Threat policies** \> **Tenant Allow/Block Lists** in the **Rules** section. To go directly to the **Spoofed senders** tab on the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem>.

-> Remember, only spoofed senders that were detected by spoof intelligence appear on this page. When you override the allow or block verdict in the insight, the spoofed sender becomes a manual allow or block entry that appears only on the **Spoofed senders** tab in the Tenant Allow/Block List.

- - With **allow expiry management** (currently in private preview), if Microsoft hasn't learned from the allow, Microsoft will automatically extend the expiry time of allows, which are going to expire soon, by 30 days to prevent legitimate email from going to junk or quarantine again.

- - Customers in the government cloud environments will now be able to create allow and block entries for URLs and attachments in the Tenant Allow/Block List using the admin URL and email attachment submissions. The data submitted through the submissions experience won't leave the customer tenant, thus satisfying the data residency commitments for government cloud clients.

- - With the new lookback scenario, the "A potentially malicious URL click was detected" alert will now include any clicks during the _past 48 hours_ (for emails) from the time the malicious URL verdict is identified.

- - [Use the Microsoft 365 Defender portal to create allow entries for URLs on the Submissions page](tenant-allow-block-list-urls-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-urls-on-the-submissions-page)

- - [Use the Microsoft 365 Defender portal to create allow entries for files on the Submissions page](tenant-allow-block-list-files-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-files-on-the-submissions-page)

- - [Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses on the Submissions page](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-on-the-submissions-page)

-|Review the **Spoof intelligence insight** and the **Impersonation detection insights** at <ul><li><<https://security.microsoft.com/spoofintelligence>></li><li><https://security.microsoft.com/impersonationinsight></li></ul>.|Ad-hoc <br/><br/> Monthly|Use the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md) and the [impersonation insight](anti-phishing-mdo-impersonation-insight.md) to adjust filtering for spoof and impersonation detections.|Security Administration <br/><br/> Messaging Team|

-For the short-term mitigation of false positives, security teams can't directly manage allow entries for domains and email addresses in the Tenant Allow/Block List. Instead, they need to use [admin submissions](submissions-admin.md) to report the email message as a false positive. For instructions, see [Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses on the Submissions page](tenant-allow-block-list-email-spoof-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-on-the-submissions-page).

-You can sort the results by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (^\*):

-To filter the results, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filters** flyout that opens:

-When you're finished on the **Filters** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.

-You can sort the results by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (^\*):

-To filter the results, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filters** flyout that opens:

-When you're finished on the **Filters** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.

-You can sort the results by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (^\*):

-To filter the results, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filters** flyout that opens:

-When you're finished on the **Filters** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.

-You can sort the results by clicking on an available column header. Select :::image type="icon" source="../../media/m365-cc-sc-customize-icon.png" border="false"::: **Customize columns** to change the columns that are shown. The default values are marked with an asterisk (^\*):

-To filter the results, select :::image type="icon" source="../../media/m365-cc-sc-filter-icon.png" border="false"::: **Filter**. The following filters are available in the **Filters** flyout that opens:

-When you're finished on the **Filters** flyout, select **Apply**. To clear the filters, select :::image type="icon" source="../../media/m365-cc-sc-clear-filters-icon.png" border="false"::: **Clear filters**.

-|**Do not rewrite the following URLs in email** <br><br> _DoNotRewriteUrls_|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|Blank <br><br> `$null`|We have no specific recommendation for this setting. <br><br> **Note**: Entries in the "Do not rewrite the following URLs" list are not scanned or wrapped by Safe Links during mail flow. Use [allow URL entries in the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-urls-on-the-submissions-page) so URLs are not scanned or wrapped by Safe Links during mail flow _and_ at time of click.|

-> Entries in the "Do not rewrite the following URLs" list are not scanned or wrapped by Safe Links during mail flow but might still be blocked at time of click. Use [allow URL entries in the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-urls-on-the-submissions-page) to override the Safe Links URL verdict.

- > Entries in the "Do not rewrite the following URLs" list are not scanned or wrapped by Safe Links during mail flow. Use [URL allow entries in the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-urls-on-the-submissions-page) to override the Safe Links URL verdict.

-After a few moments, the block entry is available on the **Domains & addresses** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Sender>.

-After a few moments, the block entry is available on the **Files** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=FileHash>.

-After a few moments, the block entry is available on the **URL** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Url>.

- For spoofed senders, any value you enter here isn't shown in the allow entry on the **Spoofed senders** tab on the **Tenant Allow/Block List**.

-After a few moments, the associated allow entries appear on the **Domains & addresses**, **Spoofed senders**, **URL**, or **Files** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList>.

-> - By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages from those domains or email addresses are delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire.

-> - When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List.

-> - By default, allow entries for files exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those files are delivered, unless something else in the message is detected as malicious.

-After a few moments, the allow entry is available on the **URL** tab on the **Tenant Allow/Block List** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=Url>.

-> - By default, allow entries for URLs exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those URLs are delivered, unless something else in the message is detected as malicious.

-By default, allow entries for domains and email addresses, files, and URLs exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those entities will be delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire.

-description: Admins can learn how to allow or block email and spoofed sender entries in the Tenant Allow/Block List in the Security portal.

-This article describes how to create and manage allow and block entries for domains and email addresses (including spoofed senders) that are available in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md).

-You manage allow and block entries for email in the Microsoft 365 Defender Portal or in Exchange Online PowerShell.

-### Create block entries for domains and email addresses

-You have the following options to create block entries for domains and email addresses:

-To create block entries for spoofed senders, see the [Use the Microsoft 365 Defender portal to create block entries for spoofed senders in the Tenant Allow/Block List](#use-the-microsoft-365-defender-portal-to-create-block-entries-for-spoofed-senders-in-the-tenant-allowblock-list) section later in this article.

-By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those entities will be delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire.

-#### Use the Microsoft 365 Defender portal to create block entries for domains and email addresses on the Submissions page

-When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit email messages as **Should have been blocked (False negative)**, you can select **Block all emails from this sender or domain** to add a block entry for the sender email address or domain on the **Domains & addresses** tab in the Tenant Allow/Block List.

-For instructions, see [Submit questionable email to Microsoft](submissions-admin.md#report-questionable-email-to-microsoft).

-You can create block entries for domains and email addresses directly in the Tenant Allow/Block List.

-Email messages from these senders are marked as *high confidence spam* (SCL = 9). What happens to the messages is determined by the [anti-spam policy](anti-spam-policies-configure.md) that detected the message for the recipient. In the default anti-spam policy and new custom policies, messages that are marked as high confidence spam are delivered to the Junk Email folder by default. In Standard and Strict [preset security policies](preset-security-policies.md), high confidence spam messages are quarantined.

-> Users in the organization can't send email to these blocked domains and addresses. They'll receive the following non-delivery report (also known as an NDR or bounce message): `550 5.7.703 Your message can't be delivered because one or more recipients are blocked by your organization's tenant recipient block policy.` The entire message is blocked for all *external* recipients of the message, even if only one recipient email address or domain is defined in a block entry.

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. On the **Tenant Allow/Block List** page, verify that the **Domains & addresses** tab is selected.

-3. On the **Domains & addresses** tab, click  **Block**.

-4. In the **Block domains & addresses** flyout that appears, configure the following settings:

- - **Remove block entry after**: The default value is **30 days**, but you can select from the following values:

- - **30 days**

-5. When you're finished, click **Add**.

-### Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses on the Submissions page

-You can't create allow entries for domains and email addresses directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the message as a false positive, which also adds an allow entry for the sender on the **Domains & addresses** tab in the Tenant Allow/Block List.

-For instructions, see [Submit good email to Microsoft](submissions-admin.md#report-good-email-to-microsoft).

-By default, allow entries for domains and email addresses, files, and URLs exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those entities will be delivered, unless something else in the message is detected as malicious.

-> [!IMPORTANT]

-> Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system.

->

-> Microsoft manages the creation of allow entries from the **Submissions** page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a URL in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the URL.

->

-> When the entity in the allow entry is encountered again (during mail flow or time of click), all filters associated with that entity are skipped.

->

-> During mail flow, if messages containing the allowed entity pass other checks in the filtering stack, the messages will be delivered. For example, if a message passes [email authentication checks](email-authentication-about.md), URL filtering, and file filtering, a message from an allowed sender email address will be delivered.

-### Use the Microsoft 365 Defender portal to view existing allow or block entries for domains and email addresses in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. Verify the **Domains & addresses** tab is selected. The following columns are available:

- - **Value**: The domain or email address.

- - **Action**: The value **Allow** or **Block**.

- - **Modified by**

- - **Last updated**

- - **Remove on**: The expiration date.

- - **Notes**

- You can click on a column heading to sort in ascending or descending order.

- Click  **Group** to group the results by **None** or **Action**.

- Click  **Search**, enter all or part of a value, and then press the ENTER key to find a specific value. When you're finished, click  **Clear search**.

- Click  **Filter** to filter the results. The following values are available in the **Filter** flyout that appears:

- - **Action**: The values are **Allow** and **Block**.

- - **Never expire**:  or 

- - **Last updated**: Select **From** and **To** dates.

- - **Remove on**: Select **From** and **To** dates.

- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout.

-#### Use PowerShell to view existing allow or block entries for domains and email addresses in the Tenant Allow/Block List

-### Use the Microsoft 365 Defender portal to modify existing allow or block entries for domains and email addresses in the Tenant Allow/Block List

-You can make the following modifications to entries for domains and email addresses in the Tenant Allow/Block list:

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-3. On the **Domains & addresses** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears.

-4. The following settings are available in the **Edit domain & addresses** flyout that appears:

- - **Remove block entry after**: You can extend block entries for a maximum of 90 days from the system date or set them to **Never expire**.

- - **Remove allow entry after**: You can extend allow entries for a maximum of 30 days from the system date.

- - **Optional note**

- When you're finished, click **Save**.

-> For entries added via submission, if you select the entry by clicking anywhere in the row other than the check box next to the name, you can select  **View submission** in the details flyout that opens, which takes you to the submission details that added the entry.

-#### Use PowerShell to modify existing allow or block entries for domains and email addresses in the Tenant Allow/Block List

-Set-TenantAllowBlockListItems -ListType Sender <-Ids <Identity value> | -Entries <Value value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]

-### Use the Microsoft 365 Defender portal to remove existing allow or block entries for domains and email addresses in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

- - Select the check box of the entry that you want to remove, and then click the  **Delete** icon that appears.

- - Select the entry that you want to remove by clicking anywhere in the row other than the check box. In the details flyout that appears, click  **Delete**.

-4. In the warning dialog that appears, click **Delete**.

-#### Use PowerShell to remove existing allow or block entries for domains and email addresses from the Tenant Allow/Block List

-Remove-TenantAllowBlockListItems -ListType Sender <-Ids <Identity value> | -Entries <Value value>>

-You have the following options to create block entries for spoofed senders:

-> Allow entries for spoofed senders take care of intra-org, cross-org, and DMARC spoofing.

-> When you configure an allow entry for a domain pair, messages from that domain pair no longer appear in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md).

-#### Use the Microsoft 365 Defender portal to create allow entries for spoofed senders on the Submissions page

-Submitting messages that were blocked by [spoof intelligence](anti-spoofing-spoof-intelligence.md) to Microsoft in the **Submissions** portal at <https://security.microsoft.com/reportsubmission> adds the sender as an allow entry for the sender on the **Spoofed senders** tab in Tenant Allow/Block List.

-For instructions, see [Submit good email to Microsoft](submissions-admin.md#report-good-email-to-microsoft).

-> [!NOTE]

-> When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** tab in the Tenant Allow/Block List.

-> If the sender has not been blocked by spoof intelligence, submitting the email message to Microsoft won't create an allow entry in the Tenant Allow/Block List.

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. On the **Tenant Allow/Block List** page, select the **Spoofed senders** tab, and then click  **Add**.

-3. In the **Add new domain pairs** flyout that appears, configure the following settings:

- When you're finished, click **Add**.

-The only difference is: for the **Action** value in Step 3, choose **Block** instead of **Allow**.

-> Email messages from these senders are blocked as *phishing*.

-> When you configure a block entry for a domain pair, messages from that domain pair no longer appear in the [spoof intelligence insight](anti-spoofing-spoof-intelligence.md).

-### Use the Microsoft 365 Defender portal to view existing allow or block entries for spoofed senders in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. Verify the **Spoofed senders** tab is selected. The following columns are available:

- - **Spoof type**: The values are **Internal** or **External**.

- - **Action**: The values are **Block** or **Allow**.

- You can click on a column heading to sort in ascending or descending order.

- Click  **Group** to group the results by **None**, **Action**, or **Spoof type**.

- Click  **Search**, enter all or part of a value, and then press the ENTER key to find a specific value. When you're finished, click  **Clear search**.

- Click  **Filter** to filter the results. The following values are available in the **Filter** flyout that appears:

- - **Action**: **Allow** and **Block**.

- - **Spoof type**: **Internal** and **External**.

- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout.

-#### Use PowerShell to view existing allow or block entries for spoofed senders in the Tenant Allow/Block List

-### Use the Microsoft 365 Defender portal to modify existing allow or block entries for spoofed senders in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-3. On the **Spoofed senders** tab, select the entry that you want to modify, and then click the  **Edit** button that appears.

-4. In the **Edit spoofed sender** flyout that appears, choose **Allow** or **Block**.

-5. When you're finished, click **Save**.

-#### Use PowerShell to modify existing allow or block entries for spoofed senders in the Tenant Allow/Block List

-This example changes spoofed sender entry from allow to block.

-### Use the Microsoft 365 Defender portal to remove existing allow or block entries for spoofed senders in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-3. On the **Spoofed senders** tab, select the entry that you want to remove, and then click the  **Delete** icon that appears.

-4. In the warning dialog that appears, click **Delete**.

-> You can select multiple entries by selecting each check box, or selecting all entries by selecting the check box next to the **Spoofed user** column header.

-#### Use PowerShell to remove existing allow or block entries for spoofed senders from the Tenant Allow/Block List

- - The wildcard character (for example, \*).

-Adding a domain pair only allows or blocks the *combination* of the spoofed user *and* the sending infrastructure. It does not allow email from the spoofed user from any source, nor does it allow email from the sending infrastructure source for any spoofed user.

-For example, you add an allow entry for the following domain pair:

-> [!NOTE]

-> You can specify wildcards in the sending infrastructure or in the spoofed user, but not in both at the same time. For example, `*, *` is not permitted.

-You can't create allow entries in the Tenant Allow/Block List for messages that were detected as [domain or sender impersonation protection in Defender for Office 365](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365).

-Submitting a message that was incorrectly blocked as impersonation on the **Submissions** page at <https://security.microsoft.com/reportsubmission> does not add the sender or domain as an allow entry in the Tenant Allow/Block List.

-Instead, the domain or sender is added to the **Trusted senders and domains section** in the [anti-phishing policy](anti-phishing-policies-mdo-configure.md#use-the-microsoft-365-defender-portal-to-modify-anti-phishing-policies) that detected the message.

-The instructions to submit the message are identical to the steps in [Use the Microsoft 365 Defender portal to create allow entries for domains and email addresses in the Submissions page](#use-the-microsoft-365-defender-portal-to-create-allow-entries-for-domains-and-email-addresses-on-the-submissions-page).

-> Currently, Graph Impersonation is not taken care from here.

-description: Admins can learn how to allow or block files in the Tenant Allow/Block List in the Security portal.

-This article describes how to manage file allow and block entries that are available in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md).

-You manage allow and block entries for files in the Microsoft 365 Defender Portal or in Exchange Online PowerShell.

- An example value is `768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3a`. Perceptual hash (pHash) values are not supported.

-## Create block entries for files

-Email messages that contain these blocked files are blocked as *malware*. Messages containing the blocked files are quarantined.

-You have the following options to create block entries for files:

-### Use the Microsoft 365 Defender portal to create block entries for files on the Submissions page

-When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit files as **Should have been blocked (False negative)**, you can select **Block this file** to add a block entry on the **Files** tab in the Tenant Allow/Block List.

-For instructions, see [Submit questionable email attachments to Microsoft](submissions-admin.md#report-questionable-email-attachments-to-microsoft).

-### Use the Microsoft 365 Defender portal to create block entries for files in the Tenant Allow/Block List

-You can create block entries for files directly in the Tenant Allow/Block List.

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. On the **Tenant Allow/Block List** page, select the **Files** tab.

-3. On the **Files** tab, click  **Block**.

-4. In the **Block files** flyout that appears, configure the following settings:

- - **Remove block entry after**: The default value is **30 days**, but you can select from the following values:

- - **30 days**

-5. When you're finished, click **Add**.

-New-TenantAllowBlockListItems -ListType <FileHash> -Block -Entries "Value1","Value2",..."ValueN" <-ExpirationDate Date | -NoExpiration> [-Notes <String>]

-## Use the Microsoft 365 Defender portal to create allow entries for files on the Submissions page

-You can't create allow entries for files directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the message attachment as a false positive, which also adds an allow entry on the **Files** tab in the Tenant Allow/Block List.

-For instructions, see [Submit good email attachments to Microsoft](submissions-admin.md#report-good-email-attachments-to-microsoft).

-> [!IMPORTANT]

-> Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system.

->

-> Microsoft manages the creation of allow entries from the **Submissions** page. Allow entries are added during mail flow based on the filters that determined the message was malicious. For example, if the sender email address and a file in the message were determined to be bad, an allow entry is created for the sender (email address or domain) and the file.

->

-> When that entity is encountered again, all filters associated with that entity are overridden.

->

-> By default, allow entries for files exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those files will be delivered, unless something else in the message is detected as malicious.

->

-> During mail flow, if messages containing the allowed file pass other checks in the filtering stack, the messages will be delivered. For example, if a message passes [email authentication checks](email-authentication-about.md), a message containing an allowed file will be delivered.

->

-> During time of click, the file allow overrides all filters associated with the file entity, allowing the end user to access the file.

-## Use the Microsoft 365 Defender portal to view existing allow or block entries for files in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. Select the **Files** tab. The following columns are available:

- - **Action**: The values are **Allow** or **Block**.

- You can click on a column heading to sort in ascending or descending order.

- Click  **Group** to group the results by **None** or **Action**.

- Click  **Search**, enter all or part of a value, and then press the ENTER key to find a specific value. When you're finished, click  **Clear search**.

- Click  **Filter** to filter the results. The following values are available in the **Filter** flyout that appears:

- - **Action**: The values are **Allow** and **Block**.

- - **Never expire**:  or 

- - **Last updated**: Select **From** and **To** dates.

- - **Remove on**: Select **From** and **To** dates.

- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout.

-### Use PowerShell to view existing allow or block entries for files in the Tenant Allow/Block List

-## Use the Microsoft 365 Defender portal to modify existing allow or block entries for files in the Tenant Allow/Block List

-You can make the following modifications to entries for files in the Tenant Allow/Block list:

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-3. On the **Files** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears.

-4. The following settings are available in the **Edit file** flyout that appears:

- - **Remove block entry after**: You can extend block entries for a maximum of 90 days from the system date or set them to **Never expire**.

- - **Remove allow entry after**: You can extend allow entries for a maximum of 30 days from the system date.

- - **Optional note**

- When you're finished, click **Save**.

-> For entries added via submission, if you select the entry by clicking anywhere in the row other than the check box, you can select  **View submission** in the details flyout that opens, which takes you to the submission details that added the entry.

-Set-TenantAllowBlockListItems -ListType <FileHash> <-Ids <Identity value> | -Entries <Value value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]

-## Use the Microsoft 365 Defender portal to remove existing allow or block entries for files from the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

- - Select the check box of the entry that you want to remove, and then click the  **Delete** icon that appears.

- - Select the entry that you want to remove by clicking anywhere in the row other than the check box. In the details flyout that appears, click  **Delete**.

-4. In the warning dialog that appears, click **Delete**.

-### Use PowerShell to remove existing allow or block entries for files from the Tenant Allow/Block List

-Remove-TenantAllowBlockListItems -ListType FileHash <-Ids <Identity value> | -Entries <Value value>>

-description: Admins can learn how to allow or block URLs in the Tenant Allow/Block List in the Security portal.

-> [!IMPORTANT]

-> To allow phishing URLs that are part of third-party attack simulation training, use the [advanced delivery configuration](skip-filtering-phishing-simulations-sec-ops-mailboxes.md) to specify the URLs. Don't use the Tenant Allow/Block List.

-This article describes how to create and manage URL allow and block entries that are available in the Tenant Allow/Block List. For more information about the Tenant Allow/Block List, see [Manage allows and blocks in the Tenant Allow/Block List](tenant-allow-block-list-about.md).

-You manage allow and block entries for URLs in the Microsoft 365 Defender Portal or in Exchange Online PowerShell.

-## Create block entries for URLs

-Email messages that contain these blocked URLs are blocked as *high confidence phishing*. Messages containing the blocked URLs are quarantined.

-You have the following options to create block entries for URLs:

-### Use the Microsoft 365 Defender portal to create block entries for URLs on the Submissions page

-When you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit URLs as **Should have been blocked (False negative)**, you can select **Block this URL** to add a block entry on the **URLs** tab in the Tenant Allow/Block List.

-For instructions, see [Submit questionable URLs to Microsoft](submissions-admin.md#report-questionable-urls-to-microsoft).

-### Use the Microsoft 365 Defender portal to create block entries for URLs in the Tenant Allow/Block List

-You can create block entries for URLs directly in the Tenant Allow/Block List.

-3. On the **URLs** tab, click  **Block**.

-4. In the **Block URLs** flyout that appears, configure the following settings:

- - **Remove block entry after**: The default value is **30 days**, but you can select from the following values:

- - **30 days**

-5. When you're finished, click **Add**.

-New-TenantAllowBlockListItems -ListType Url -Block -Entries ~contoso.com

-## Use the Microsoft 365 Defender portal to create allow entries for URLs on the Submissions page

-You can't create URL allow entries directly in the Tenant Allow/Block List. Instead, you use the **Submissions** page at <https://security.microsoft.com/reportsubmission> to submit the URL as a false positive, which also adds an allow entry on the **URLs** tab in the Tenant Allow/Block List.

-For instructions, see [Submit good URLs to Microsoft](submissions-admin.md#report-good-urls-to-microsoft).

-> [!IMPORTANT]

-> Microsoft does not allow you to create allow entries directly. Unnecessary allow entries expose your organization to malicious email which could have been filtered by the system.

->

-> Microsoft manages the allow entry creation process for URLs from the **Submissions** page. We'll create allow entries for URLs that were determined to be malicious by our filters during mail flow or at time of click.

->

-> We allow subsequent messages that contain variations of the original URL. For example, you use the **Submissions** page to report the incorrectly blocked URL `www.contoso.com/abc`. If your organization later receives a message that contains the URL (for example but not limited to: `www.contoso.com/abc`, `www.contoso.com/abc?id=1`, `www.contoso.com/abc/def/gty/uyt?id=5`, or `*.contoso.com/abc`), the message won't be blocked based on the URL. In other words, you don't need to report multiple variations of the same URL as good to Microsoft.

->

-> When the URL is encountered again, all filters associated with the URL are overridden.

->

-> By default, allow entries for URLs exist for 30 days. During those 30 days, Microsoft will learn from the allow entries and [remove them or automatically extend them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those URLs will be delivered, unless something else in the message is detected as malicious.

->

-> During mail flow, if messages containing the allowed URL pass other checks in the filtering stack, the messages will be delivered. For example, if a message passes [email authentication checks](email-authentication-about.md) and file filtering, a message containing an allowed URL will be delivered.

->

-> During time of click, the URL allow entry overrides all filters associated with the URL entity, allowing the user to access the content in the URL.

->

-> Adding an allow entry for a URL does not prevent it from being wrapped by Safe Links. For more information, see [Do not rewrite list in SafeLinks](safe-links-about.md#do-not-rewrite-the-following-urls-lists-in-safe-links-policies).

-## Use the Microsoft 365 Defender portal to view existing allow or block entries for URLs in the Tenant Allow/Block List

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Tenant Allow/Block Lists** in the **Rules** section. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-2. Select the **URL** tab. The following columns are available:

- - **Action**: The values are **Allow** or **Block**.

- Click on a column heading to sort in ascending or descending order.

- Click  **Group** to group the results by **None** or **Action**.

- Click  **Search**, enter all or part of a value, and then press the ENTER key to find a specific value. When you're finished, click  to clear the search.

- Click  **Filter** to filter the results. The following values are available in the **Filter** flyout that appears:

- - **Action**: The values are **Allow** and **Block**.

- - **Never expire**:  or 

- - **Last updated**: Select **From** and **To** dates.

- - **Remove on**: Select **From** and **To** dates.

- When you're finished, click **Apply**. To clear existing filters, click  **Clear filters** in the **Filter** flyout.

-### Use PowerShell to view existing allow or block entries for URLs in the Tenant Allow/Block List

-## Use the Microsoft 365 Defender portal to modify existing allow or block entries for URLs in the Tenant Allow/Block List

-You can make the following modifications to entries for URLs in the Tenant Allow/Block list:

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block List** page, use <https://security.microsoft.com/tenantAllowBlockList>.

-3. On the **URLs** tab, select the check box of the entry that you want to modify, and then click the  **Edit** button that appears.

-4. The following values are available in the **Edit URL** flyout that appears:

- - **Remove block entry after**: You can extend block entries for a maximum of 90 days from the system date or set them to **Never expire**.

- - **Remove allow entry after**: You can extend allow entries for a maximum of 30 days from the system date.

- - **Optional note**

- When you're finished, click **Save**.

-> For entries added via submission, if you select the entry by clicking anywhere in the row other than the check box, you can select  **View submission** in the details flyout that opens up. It takes you to the submission details that added the entry.

-### Use PowerShell to modify existing allow or block entries for URLs in the Tenant Allow/Block List

-Set-TenantAllowBlockListItems -ListType Url <-Ids <Identity value> | -Entries <Value value>> [<-ExpirationDate Date | -NoExpiration>] [-Notes <String>]

-## Use the Microsoft 365 Defender portal to remove existing allow or block entries for URLs from the Tenant Allow/Block List

- - Select the check box of the entry that you want to remove, and then click the  **Delete** icon that appears.

- - Select the entry that you want to remove by clicking anywhere in the row other than the check box. In the details flyout that appears, click  **Delete**.

-4. In the warning dialog that appears, click **Delete**.

-### Use PowerShell to remove existing allow or block entries for URLs from the Tenant Allow/Block List

-Remove-TenantAllowBlockListItems -ListType Url <-Ids <Identity value> | -Entries <Value value>>

-Remove-TenantAllowBlockListItems -ListType Url -Entries "~cohovineyard.com

- For example, `t.co` is allowed; `.com` or `contoso.` are not allowed.

- For example, `contoso.com` does not include `contoso.com/a`.

- - A left wildcard must be followed by a period to specify a subdomain. (only applicable for blocks)

- For example, `*.contoso.com` is allowed; `*contoso.com` is not allowed.

- For example, `contoso.com/*` is allowed; `contoso.com*` or `contoso.com/ab*` are not allowed.

- - `*.com*` is invalid (not a resolvable domain and the right wildcard does not follow a forward slash).

- - Wildcards are not allowed in IP addresses.

- For example `~contoso.com` includes `contoso.com` and `*.contoso.com`.

-Valid URL entries and their results are described in the following sections.

- The default and recommended selection is to scope these Defender for Office 365 policies to all users in the organization. But during or after the setup of your trial, you can change the policy assignment to specific users, groups, or email domains in the Microsoft 365 Defender portal or in [Policy settings associated with Defender for Office 365 trials](try-microsoft-defender-for-office-365.md#policy-settings-associated-with-defender-for-office-365-trials)

-This article will help you answer those questions so you can try Defender for Office 365 Plan 2 in a way that best meets the needs of your organization.

-

- - Safe Links detonates URLs during mail flow. To prevent specific URLs from being detonated, use allow entries for URLs in the Tenant Allow/Block List. For more information, see [Manage the Tenant Allow/Block List](tenant-allow-block-list-about.md).

-Your eligibility for an evaluation or trial means you already have EOP. **No new or special EOP policies are created for your evaluation or trial of Defender for Office 365 Plan 2**. Existing EOP policies in your Microsoft 365 organization are able to act on messages (for example, send messages to the Junk Email folder or to quarantine):

-Do you want your Defender for Office 365 experience to be active or passive? These are the two modes that you can select from:

- Audit mode provides access to customized reports for threats detected by Defender for Office 365 on the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>.

- The default and recommended selection is to scope these Defender for Office 365 policies to all users in the organization. But during or after the setup of your trial, you can change the policy assignment to specific users, groups, or email domains in the Microsoft 365 Defender portal or in [Exchange Online PowerShell](#policy-settings-associated-with-defender-for-office-365-trials).

- Blocking mode does not provide customized reports for threats detected by Defender for Office 365. Instead, the information is available in the regular reports and investigation features of Defender for Office 365 Plan 2.

-A key factor in audit mode vs. blocking mode is how email is delivered to your Microsoft 365 organization:

- 

- In these environments, you can select **audit mode** or **blocking mode**.

- 

- In these environments, you can select **audit mode** only. You don't need to change your mail flow (MX records).

-What's the difference between an evaluation and a trial of Defender for Office 365 Plan 2? Aren't they the same thing? Well, yes and no. Here's what you need to know:

- Regardless of which location you use, we'll automatically provision the required Defender for Office 365 Plan 2 trial licenses for you when you enroll. Manual or outside steps for getting and assigning Plan 2 licenses in the Microsoft 365 admin center are no longer required. The trial licenses are good for 90 days:

- - For organizations without Defender for Office 365 (for example, standalone EOP or Microsoft 365 E3) the features (in particular, the policies) of Defender for Office 365 are available to you during the trial period.

- - Organizations with Defender for Office 365 Plan 1 (for example Microsoft 365 Business Premium or add-on subscriptions) have exactly the same policies as organizations with Defender for Office 365 Plan 2 (impersonation protection in anti-phishing policies, Safe Attachments policies, and Safe Links policies). The security policies from **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies) don't expire or stop working after 90 days. What ends after 90 days for these organizations are the [automation, investigation, remediation, and education capabilities](defender-for-office-365.md#whats-the-difference-between-microsoft-defender-for-office-365-plan-1-and-plan-2) of Plan 2 that aren't present in Plan 1.

- By definition, these organizations don't require trial licenses of Defender for Office 365 Plan 2, so their evaluations are unlimited in duration.

-|Organization|Available modes|Enroll from the<br/>Evaluation page?|Enroll from the<br/>Trials page?|Evaluation<br/>period|

-|||::|::||

-|Standalone EOP<br/>(no Exchange Online mailboxes) <br/><br/> Microsoft 365 E3|Audit mode <br/> Blocking mode|Yes|Yes|90 days|

-|Defender for Office 365 Plan 1 <br/><br/> Microsoft 365 Business Premium|Audit mode <br/> Blocking mode|Yes|Yes|Unlimited^\*|

-|Microsoft 365 E5|Audit mode <br/> Blocking mode|Yes|No|Unlimited|

-^\* The security policies from **allow mode** (Standard preset security policy) or **blocking mode** (evaluation policies) don't expire or stop working after 90 days. Only the [automation, investigation, remediation, and education capabilities](defender-for-office-365.md#whats-the-difference-between-microsoft-defender-for-office-365-plan-1-and-plan-2) that are exclusive to Defender for Office 365 Plan 2 stop working after 90 days.

-Remember, when you evaluate Defender for Office 365 in audit mode, special evaluation policies are created so Defender for Office 365 can detect threats. The settings of these evaluation policies are described in the [Policies in audit mode](#policies-in-audit-mode) section later in this article.

- - On the banner at the top of any Defender for Office 365 feature page, click **Start free trial**.

- - On the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>, click **Start evaluation**.

-2. In the **Turn on protection** dialog, select **No, I only want reporting**, and then click **Continue**.

- - **Select users**: If you select this option, you need to select the internal recipients that the evaluation applies to:

- - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups are not supported).

- Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, click remove  next to the value.

- When you're finished, click **Continue**.

- - **I'm using a third-party and/or on-premises service provider**: The MX record for your domain points somewhere other than Microsoft 365. This selection requires the following additional settings after you click **Next**:

- 1. In the **Third party or on-premises settings** dialog, configure the following settings:

- - **Select a third party service provider**: Select one of the following values:

- - **Other**

- - **The connector to apply this evaluation to**: Select the connector that's used for mail flow into Microsoft 365.

- [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as *skip listing*) is automatically configured on the connector that you specify.

- When a third-party service or device sits in front of email flowing into Microsoft 365, Enhanced Filtering for Connectors correctly identifies the source of internet messages and greatly improves the accuracy of the Microsoft filtering stack (especially [spoof intelligence](anti-phishing-protection-spoofing-about.md), as well as post-breach capabilities in [Threat Explorer](threat-explorer-about.md) and [Automated Investigation & Response (AIR)](air-about-office.md).

- - **List each gateway IP address your messages pass through**: This setting is available only if you selected **Other** for **Select a third party service provider**. Enter a comma-separated list of the IP addresses that are used by the third-party protection service or device to send mail into Microsoft 365.

- When you're finished, click **Next**.

- 2. In the **Exchange mail flow rules** dialog, decide if you need an Exchange Online mail flow rule (also known as a transport rule) that skips spam filtering for incoming messages from the third-party protection service or device.

- It's likely that you already have an SCL=-1 mail flow rule in Exchange Online that allows all inbound mail from the protection service to bypass (most) Microsoft 365 filtering. Many protection services encourage this spam confidence level (SCL) mail flow rule method for Microsoft 365 customers who use their services.

- As explained in the previous step, Enhanced Filtering for Connectors is automatically configured on the connector that you specify as the source of mail from the protection service.

- Turning on Enhanced Filtering for Connectors without an SCL=-1 rule for incoming mail from the protection service will vastly improve the detection capabilities of EOP protection features like [spoof intelligence](anti-phishing-protection-spoofing-about.md), and could impact the delivery of those newly detected messages (for example, move to the Junk Email folder or to quarantine). This impact is limited to EOP policies; as previously explained, Defender for Office 365 policies are created in audit mode.

- To create an SCL=-1 mail flow rule or to review your existing rules, click the **Go to Exchange admin center** button on the page. For more information, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl).

- When you're finished, click **Finish**.

- - **I'm only using Microsoft Exchange Online**: The MX records for your domain point to Microsoft 365. There's nothing left to configure, so click **Finish**.

-5. A progress dialog appears as your evaluation is set up. When set up is complete, click **Done**.

-Remember, when you try Defender for Office 365 in blocking mode, the Standard preset security is turned on and the specified users (some or everyone) are included in the Standard preset security policy. For more information about the Standard preset security policy, see [Preset security policies](preset-security-policies.md).

- - On the banner at the top of any Defender for Office 365 feature page, click **Start free trial**.

- - On the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation>, click **Start evaluation**.

-2. In the **Turn on protection** dialog, select **Yes, protect my organization by blocking threats**, and then click **Continue**.

- - Members of the specified distribution groups or mail-enabled security groups (dynamic distribution groups are not supported).

- Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, click remove  next to the value.

- When you're finished, click **Continue**.

-4. A progress dialog appears as your evaluation is set up. When setup is complete, click **Done**.

-After you set up your evaluation or trial in audit mode or blocking mode, the **Evaluation mode** page at <https://security.microsoft.com/atpEvaluation> is your central location for information about trying Defender for Office 365 Plan 2.

-1. In the Microsoft 365 Defender portal at <https://security.microsoft.com>, go to **Email & collaboration** \> **Policies & rules** \> **Threat policies** \> select **Evaluation mode** in the **Others** section. Or, to go directly to the **Microsoft Defender for Office 365 evaluation** page, use <https://security.microsoft.com/atpEvaluation>.

-2. On the **Microsoft Defender for Office 365 evaluation** page, you can do the following tasks:

- - Click **Buy a paid subscription** to buy Defender for Office 365 Plan 2.

- - Click **Manage**. In the **Microsoft Defender for Office 365 evaluation** flyout that appears, you can do the following tasks:

- - Change who the evaluation or trial applies to as described earlier in the [Set up an evaluation or trial in audit mode](#set-up-an-evaluation-or-trial-in-audit-mode) and [Set up an evaluation or trial in blocking mode](#set-up-an-evaluation-or-trial-in-blocking-mode).

- - To switch from **audit mode** (evaluation policies) to blocking mode (Standard preset security policy), click **Convert to standard protection**, and then click **Continue** in the dialog that appears to be taken to the **Apply standard protection** wizard on the **Preset security policies** page. The existing included and excluded recipients are copied over. For more information, see [Use the Microsoft 365 Defender portal to assign Standard and Strict preset security policies to users](preset-security-policies.md#use-the-microsoft-365-defender-portal-to-assign-standard-and-strict-preset-security-policies-to-users).

- **Notes**:

- - The policies in the Standard preset security policy have a higher priority than the evaluation policies, which means the policies in the Standard preset security are always applied *before* the evaluation policies, even if both are present and turned on. To turn off the evaluation policies, use the **Turn off** button.

- - There's no automatic way to go from **blocking mode** to **audit mode**. The manual steps are:

- 1. Turn off the Standard preset security policy on the **Preset security policies** page.

- 2. After clicking **Manage** on the **Microsoft Defender for Office 365 evaluation** page, verify the presence of the **Turn off** button, which indicates the evaluation policies are turned on. If you see the **Turn on** button, click it to turn on the evaluation policies.

- 3. Verify the users that the evaluation applies to.

- - To turn off the evaluation policies, click **Turn off**. To turn them back on, click **Turn on**.

- When you're finished in the flyout, click **Save**.

-This section describes the reports that are available in audit mode and blocking mode.

-In **blocking mode**, the following reports show detections by Defender for Office 365:

- - [View data by Overview](reports-email-security.md#view-data-by-overview):

- You can filter most views by the **Protected by** value **MDO** to see the effects of Defender for Office 365.

- - The [Top senders and recipients report](reports-email-security.md#top-senders-and-recipients-report)

- **Show data for Top malware recipients (MDO)** and **Show data for Top phish recipients (MDO)**.

- - The [URL protection report](reports-defender-for-office-365.md#url-protection-report)

-In **audit mode**, the following reports show detections by Defender for Office 365:

- - [View data by Email \> Phish and Chart breakdown by Detection Technology](reports-email-security.md#view-data-by-email--phish-and-chart-breakdown-by-detection-technology)

- - [View data by Email \> Malware and Chart breakdown by Detection Technology](reports-email-security.md#view-data-by-email--malware-and-chart-breakdown-by-detection-technology)

- - [View data by Email \> Spam and Chart breakdown by Detection Technology](reports-email-security.md#view-data-by-email--spam-and-chart-breakdown-by-detection-technology)

- 

-The **Microsoft Defender for Office 365 evaluation** page at <https://security.microsoft.com/atpEvaluation> consolidates the reporting for the policies in the evaluation:

-By default, the charts show data for the last 30 days, but you can filter the date range by clicking  **30 days** and selecting from following additional values that are less than 30 days:

-You can click  **Download** to download the chart data to a .csv file.

-The following permissions are required in **Azure AD** to set up an evaluation or trial of Defender for Microsoft 365:

-A: After your trial expires, you'll have access to your trial data (data from features in Defender for Office 365 that you didn't have previously) for 30 days. After this 30 day period, all policies and data that were associated with the Defender for Office 365 trial will be deleted.

-A: A maximum of 2 times. If your first trial expires, you need to wait at least 30 days after the expiration date before you can enroll in the Defender for Office 365 trial again. After your second trial, you can't enroll in another trial.

-### Q: In audit mode, are there scenarios where Defender for Office 365 will act on messages?

-A: Yes. No one in any program or SKU can turn off or bypass taking action on messages that are classified as malware or high confidence phishing by the service.

-In audit mode, [anti-spoofing protection in EOP](anti-phishing-policies-about.md#spoof-settings) also takes action on messages. To prevent anti-spoofing protection from acting on messages, create an Exchange mail flow rule (also known as a transport rule) where inbound email bypasses all types of filtering that can be bypassed (including anti-spoofing protection). For instructions, see [Use mail flow rules to set the spam confidence level (SCL) in messages in Exchange Online](/exchange/security-and-compliance/mail-flow-rules/use-rules-to-set-scl).

-## Reference

-### Policy settings associated with Defender for Office 365 trials

-#### Policies in audit mode

-##### Anti-phishing evaluation policy settings

-##### Safe Attachments evaluation policy settings

-##### Safe Links evaluation policy settings

-##### Use PowerShell to configure recipient conditions and exceptions to the evaluation in audit mode

-##### Use PowerShell to turn on or turn off the evaluation in audit mode

-#### Policies and rules in block mode

-[As previously described](#audit-mode-vs-blocking-mode-for-defender-for-office-365), when you choose blocking mode for your trial, policies are created using the Standard template for [preset security policies](preset-security-policies.md).

-To use Exchange Online PowerShell to view the individual security policies that are associated with the Standard preset security policy, and to use Exchange Online PowerShell to view and configure the recipient conditions and exceptions for the preset security policy, see [Preset security policies in Exchange Online PowerShell](preset-security-policies.md#preset-security-policies-in-exchange-online-powershell).

- Add-RoleGroupMember "<<Role Group Name>>" -Member "<<Azure Security Group>>"`

-> - [Use PowerShell to view existing allow or block entries for spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-powershell-to-view-existing-allow-or-block-entries-for-spoofed-senders-in-the-tenant-allowblock-list)

-> - [Use PowerShell to modify existing allow or block entries for spoofed senders in the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-powershell-to-modify-existing-allow-or-block-entries-for-spoofed-senders-in-the-tenant-allowblock-list)

-> - [Use PowerShell to remove existing allow or block entries for spoofed senders from the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md#use-powershell-to-remove-existing-allow-or-block-entries-for-spoofed-senders-from-the-tenant-allowblock-list)

-## See also

-[Create an extractor](create-an-extractor.md)

-[Create a classifier](create-a-classifier.md)

-

-

-

-## See also

-[Share an enterprise model](model-discovery.md)

-[Discover other trained models](discover-other-trained-models.md)

-[Choose the view in a document library](choose-library-view.md)

-## See also

-[Apply a sensitivity label to a model in Microsoft Syntex](create-a-classifier.md)

-## See also

-[Apply a retention label](apply-a-retention-label-to-a-model.md)

-# Create conditional sections for templates in Microsoft Syntex

-## See also

-[Overview of content processing](content-processing-overview.md)

-## See also

-[Overview of model types](model-types-overview.md)

-## See also

-[Training: Improve business performance with AI Builder](/training/paths/improve-business-performance-ai-builder/?source=learn)

-<!

-## Change the view in a document library

->

-## See also

-[Share an enterprise model](model-discovery.md)

-[Choose the view in a document library](choose-library-view.md)

-Use the unstructured document processing model ([teaching method](create-syntex-model.md#train-a-custom-model)) to automatically classify files and extract information. It works best for unstructured documents, such as letters or contracts.

-The unstructured document processing model (formerly known as *document understanding model*) uses artificial intelligence (AI) to process documents. These documents must have text that can be identified based on phrases or patterns. The identified text designates both the type of file it is (its classification) and what you'd like to extract (its extractors).

-## See also

-[Compare custom models](difference-between-document-understanding-and-form-processing-model.md)

-## See also

-[Rename a model](rename-a-model.md)

-[Syntex accessibility mode](accessibility-mode.md)

-## See also

-[Compare custom models](difference-between-document-understanding-and-form-processing-model.md)

-[Train a structured document processing model](create-a-form-processing-model.md)

-[Power Automate documentation](/power-automate/)

-[Training: Improve business performance with AI Builder](/training/paths/improve-business-performance-ai-builder/?source=learn)

-## See also

-[Compare custom models](difference-between-document-understanding-and-form-processing-model.md)

-[Train a freeform document processing model](train-freeform-document-processing-model.md)

-## See also

-[Overview of unstructured document processing](document-understanding-overview.md)

-[Create a classifier](create-a-classifier.md)

-[Create an extractor](create-an-extractor.md)

-## See also

-[Discover other trained models](discover-other-trained-models.md)

-## See also

-[Compare custom models in Microsoft Syntex](./difference-between-document-understanding-and-form-processing-model.md)

-[Training: Improve business performance with AI Builder](/learn/paths/improve-business-performance-ai-builder/?source=learn)

-## See also

-[Use a prebuilt model to extract information from contracts](prebuilt-model-contract.md)

-[Use a prebuilt model to extract information from invoices](prebuilt-model-invoice.md)

-[Use a prebuilt model to extract information from receipts](prebuilt-model-receipt.md)

-## See also

-[Delete a model](delete-a-model.md)

-## See also

-[Create an extractor](create-an-extractor.md)

-## See also

-[Overview of model types in Microsoft Syntex](model-types-overview.md)