tenantAllowBlockListItems

Tenant Allow/Block Lists. Allow or block specific senders, URLs, files, and IP addresses. The tenantAllowBlockListItems entity set lives under /exchange/v1.0/tenantAllowBlockListItems in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/tenantAllowBlockListItems`
Category	Threat protection
Tier	Tier 4, Threat protection
Read role	`ThreatPolicy.Read.All` (Community)
Write role	`ThreatPolicy.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-TenantAllowBlockListItems, New-TenantAllowBlockListItems, Set-TenantAllowBlockListItems, Remove-TenantAllowBlockListItems

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/tenantAllowBlockListItems`	List tenantAllowBlockListItems entries.	`ThreatPolicy.Read`	Community
POST	`/exchange/v1.0/tenantAllowBlockListItems`	POST /tenantAllowBlockListItems - body: { listType, entries, allow\|block, expirationDate?\|noExpiration?, notes?, listSubType? }.	`ThreatPolicy.ReadWrite`	Enterprise
PATCH	`/exchange/v1.0/tenantAllowBlockListItems/{key}`	PATCH /tenantAllowBlockListItems/{key}?listType=… - modify an existing entry. URL {key} maps to -Ids; listType is required because the cmdlet keys both fields together.	`ThreatPolicy.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/tenantAllowBlockListItems/{key}`	DELETE /tenantAllowBlockListItems/{key}?listType=… - remove an entry by Id. listType is required (cmdlet keys on both).	`ThreatPolicy.ReadWrite`	Enterprise

GET /exchange/v1.0/tenantAllowBlockListItems

List tenantAllowBlockListItems entries.

Backing cmdlet: Get-TenantAllowBlockListItems. Role: ThreatPolicy.Read (Community).

Parameter	In	Type
`listType`	query	string
`entry`	query	string
`allow`	query	bool (switch)
`block`	query	bool (switch)
`noExpiration`	query	bool (switch)
`listSubType`	query	String[]
`expirationDate`	query	datetime

List tenantAllowBlockListItems

Stub auto-generated example for the tenantAllowBlockListItems collection. Backing cmdlet: Get-TenantAllowBlockListItems. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/tenantAllowBlockListItems?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#tenantAllowBlockListItems",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

POST /exchange/v1.0/tenantAllowBlockListItems

POST /tenantAllowBlockListItems - body: { listType, entries, allow|block, expirationDate?|noExpiration?, notes?, listSubType? }.

Backing cmdlet: New-TenantAllowBlockListItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type	Required
`entries`	body		yes
`listType`	body		yes
`allow`	body	boolean (switch)
`block`	body	boolean (switch)
`expirationDate`	body
`listSubType`	body
`noExpiration`	body	boolean (switch)
`notes`	body
`removeAfter`	body
`dryRun`	query	bool (switch)

Create fails when required entries field is missing

New-TenantAllowBlockListItems requires both entries and listType. Omitting entries returns a 400 BadRequest from the body binder before the cmdlet is invoked.

POST /exchange/v1.0/tenantAllowBlockListItems HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "listType": "Sender",
  "block": true,
  "noExpiration": true
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'entries' is missing from the request body.",
    "target": "entries"
  },
  "correlationId": "0HN7K3A1B2C3D"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create a tenant allow/block list entry

Creates a Defender tenant-wide allow/block list entry (Sender / URL / FileHash / IP) via New-TenantAllowBlockListItems. The body must include exactly one of allow/block and exactly one of expirationDate/noExpiration.

POST /exchange/v1.0/tenantAllowBlockListItems HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "listType": "Sender",
  "entries": [
    "[email protected]"
  ],
  "block": true,
  "noExpiration": true,
  "notes": "exonaut-sample-tenantAllowBlockListItems"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/tenantAllowBlockListItems/exonaut-sample-tenantAllowBlockListItems

{
  "Id": "exonaut-sample-tenantAllowBlockListItems",
  "Identity": "exonaut-sample-tenantAllowBlockListItems",
  "Value": "[email protected]",
  "ListType": "Sender",
  "Action": "Block",
  "Notes": "exonaut-sample-tenantAllowBlockListItems"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

PATCH /exchange/v1.0/tenantAllowBlockListItems/{key}

PATCH /tenantAllowBlockListItems/{key}?listType=… - modify an existing entry. URL {key} maps to -Ids; listType is required because the cmdlet keys both fields together.

Backing cmdlet: Set-TenantAllowBlockListItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`allow`	body	boolean (switch)
`block`	body	boolean (switch)
`expirationDate`	body
`listSubType`	body
`noExpiration`	body	boolean (switch)
`notes`	body
`removeAfter`	body
`listType`	query	string
`dryRun`	query	bool (switch)

Update a tenant allow/block list entry

Sub-resource of the tenant allow/block list at GET /tenantAllowBlockListItems/{key} - modifies an existing entry via Set-TenantAllowBlockListItems. The required listType query param keys the entry alongside the URL {key} (which maps to -Ids).

PATCH /exchange/v1.0/tenantAllowBlockListItems/{key}?listType=Sender HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "allow": true,
  "noExpiration": true,
  "notes": "exonaut-sample-tenantAllowBlockListItems-updated"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-tenantAllowBlockListItems",
  "Identity": "exonaut-sample-tenantAllowBlockListItems",
  "Value": "[email protected]",
  "ListType": "Sender",
  "Action": "Allow",
  "Notes": "exonaut-sample-tenantAllowBlockListItems-updated"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/tenantAllowBlockListItems/{key}

DELETE /tenantAllowBlockListItems/{key}?listType=… - remove an entry by Id. listType is required (cmdlet keys on both).

Backing cmdlet: Remove-TenantAllowBlockListItems. Role: ThreatPolicy.ReadWrite (Enterprise).

Parameter	In	Type
`listType`	query	string
`listSubType`	query	String[]
`dryRun`	query	bool (switch)

Delete a tenant allow/block list entry

Sub-resource of the tenant allow/block list at GET /tenantAllowBlockListItems/{key} - removes an entry by Id via Remove-TenantAllowBlockListItems. The required listType query param keys the entry alongside the URL {key} (which maps to -Ids). Returns 204 with no body.

DELETE /exchange/v1.0/tenantAllowBlockListItems/{key}?listType=Sender HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.