Major update from Message center

Retirement of Get/Set-PhishFilterPolicy PowerShell (legacy) to manage spoofed senders using new Tenant Allow Block list
We will be retiring the “Get-/Set-PhishFilterPolicy” PowerShell cmdlets. Instead, we recommend the utilization of the updated feature called “Spoof intelligence insight” in order to view spoofing activity and the new feature called “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively, which is where we will continue to invest our development resources.

Key points:

  • Timing:
    • Standard: late March through end of September
    • GCC, GCC-High and DoD: late April through end of September
  • Action: review and assess impact on your organization

How this will affect your organization:

Once this change is implemented Security Administrators will no longer be able to invoke these cmdlets (Get-PhishFilterPolicy / Set-PhishFilterPolicy).

What you need to do to prepare:

Instead of using “Get-PhishFilterPolicy” or “Set-PhishFilterPolicy” PowerShell cmdlets, we recommend using “Spoof intelligence insight” in order to view and “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:

  • The rule called “Tenant Allow/Block Lists” in the list of Threat policies page, which will provide a page for “Spoofing” from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
  • As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
    • Get-TenantAllowBlockListSpoofItems
    • New-TenantAllowBlockListSpoofItems
    • Set-TenantAllowBlockListSpoofItems
    • Remove-TenantAllowBlockListSpoofItems
  • Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as “Allowed” / “Blocked” by Spoof intelligence system. This can be viewed by clicking on the link “View spoofing activity” from Tenant Allow/Block Lists page-Spoofing tab. Optionally, ‘Get-SpoofIntelligenceInsight’ PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the “Tenant Allow/Block lists-Spoofing” page as this is now considered tenant specific spoof domain pair.
  • Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet ‘Get-SpoofMailReport’ will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).

Please review to learn more.

View this message in the Microsoft 365 admin center

You’re subscribed to this email using . If you’re an IT admin, you’re subscribed by default, but you can unsubscribe at any time. If you’re not an IT admin, ask your admin to remove your email address from Microsoft 365 message center preferences.

How to view translated messages

Privacy statement Microsoft Corporation, One Microsoft Way, Redmond WA 98052 USA

Posted in Uncategorized.