Microsoft Technical Bulletins

The latest updates for all the Microsoft Products you use every day.

Written by QuixTec LLC

My goal is to help your business by integrating processes that automate mundane tasks and simplify complex ones without breaking budgets.

Categories: Exchange Online | PowerShell

February 24, 2022

Blog Home

Retirement of Get/Set-PhishFilterPolicy PowerShell (legacy) to manage spoofed senders using new Tenant Allow Block list

Exchange Online, PowerShell, Microsoft 365 Experts

From Microsoft Corporation
Technical bulletin MC335609 · Published Feb 23, 2022

Message Summary

We will be retiring the “Get-/Set-PhishFilterPolicy” PowerShell cmdlets. Instead, we recommend the utilization of the updated feature called “Spoof intelligence insight” in order to view spoofing activity and the new feature called “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively, which is where we will continue to invest our development resources.

Key points:

  • Timing:
    • Standard: late March through end of September
    • GCC, GCC-High and DoD: late April through end of September
  • Action: review and assess impact on your organization

How this will affect your organization:

Once this change is implemented Security Administrators will no longer be able to invoke these cmdlets (Get-PhishFilterPolicy / Set-PhishFilterPolicy).

What you need to do to prepare:

Instead of using “Get-PhishFilterPolicy” or “Set-PhishFilterPolicy” PowerShell cmdlets, we recommend using “Spoof intelligence insight” in order to view and “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:

  • The rule called “Tenant Allow/Block Lists” in the list of Threat policies page, which will provide a page for “Spoofing” from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
  • As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
    • Get-TenantAllowBlockListSpoofItems
    • New-TenantAllowBlockListSpoofItems
    • Set-TenantAllowBlockListSpoofItems
    • Remove-TenantAllowBlockListSpoofItems
  • Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as “Allowed” / “Blocked” by Spoof intelligence system. This can be viewed by clicking on the link “View spoofing activity” from Tenant Allow/Block Lists page-Spoofing tab. Optionally, ‘Get-SpoofIntelligenceInsight’ PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the “Tenant Allow/Block lists-Spoofing” page as this is now considered tenant specific spoof domain pair.
  • Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet ‘Get-SpoofMailReport’ will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).

Please review to learn more.

TECHNICAL BULLETIN END

QuixTec provides this and other technical bulletins unaltered from Microsoft. As an authorized Microsoft Partner, we ensure that all our solutions we deliver to you include the latest Microsoft updates.

ABOUT US: QuixTec, LLC is a U.S. certified Veteran Owned, modern DevOps organization and Microsoft Partner that specializes in Microsoft SharePoint, Microsoft365 expertise & HTML5 technologies for small to enterprise-sized organizations. The founder, Richard, has 30 years of experience working with several notable companies that include World Vision, Expedia, Microsoft, Levi Strauss, NASA, Boeing Aerospace, Los Alamos National Laboratory, and the U.S. Air Force, to name a few.  QuixTec is in the Seattle area. Phone today for a free consultation and project estimate:

(425) 367-9025

LEARN MORE

SharePoint Development ServicesSharePoint DevelopmentCustom Software DevelopmentMicrosoft 365 ExpertsMicrosoft 365IT Staffing ServicesIT StaffingWordPress Development ServicesSEO Services

You May Also Like…

Upcoming behavior change to the “DoNotRewrite” List

Upcoming behavior change to the “DoNotRewrite” List

Exchange Online, Microsoft 365 Experts, SharePoint Development Services From Microsoft CorporationTechnical Bulletin MC373889 · Published May 4, 2022 Message Summary With the deployment of the Tenant Allow/Block List, as being the single...

Migrating the Safe Links Block List to Tenant Allow Block List

Migrating the Safe Links Block List to Tenant Allow Block List

Exchange Online, SharePoint Development Services, Microsoft 365 Experts From Microsoft CorporationTechnical Bulletin MC373880 · Published May 4, 2022 Message Summary Beginning in June organizations will no longer have the ability to add...

Configuration Change in Name parameter for Exchange Online

Configuration Change in Name parameter for Exchange Online

Exchange Online, SharePoint Development Services From Microsoft CorporationTechnical Bulletin MC365786 · Published Apr 30, 2022 Action Required by May 31, 2022 Message Summary We're making some changes to the way Name parameter is being...