Microsoft Technical Bulletins

The latest updates for all the Microsoft Products you use every day.

Microsoft Exchange Curtain Reveal Tech Bulletin Header

Written by Q

In a world where information technology has become complex and untenable we remove all your frustrations dealing with the overwhelming complications by simplifying technology decisions, budget management and implementation.

Categories: Exchange Online | PowerShell

February 24, 2022

Blog Home

Retirement of Get/Set-PhishFilterPolicy PowerShell (legacy) to manage spoofed senders using new Tenant Allow Block list

Exchange Online, PowerShell, Microsoft 365 Experts

From Microsoft Corporation
Technical bulletin MC335609 · Published Feb 23, 2022

Message Summary

We will be retiring the “Get-/Set-PhishFilterPolicy” PowerShell cmdlets. Instead, we recommend the utilization of the updated feature called “Spoof intelligence insight” in order to view spoofing activity and the new feature called “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively, which is where we will continue to invest our development resources.

Key points:

  • Timing:
    • Standard: late March through end of September
    • GCC, GCC-High and DoD: late April through end of September
  • Action: review and assess impact on your organization

How this will affect your organization:

Once this change is implemented Security Administrators will no longer be able to invoke these cmdlets (Get-PhishFilterPolicy / Set-PhishFilterPolicy).

What you need to do to prepare:

Instead of using “Get-PhishFilterPolicy” or “Set-PhishFilterPolicy” PowerShell cmdlets, we recommend using “Spoof intelligence insight” in order to view and “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:

  • The rule called “Tenant Allow/Block Lists” in the list of Threat policies page, which will provide a page for “Spoofing” from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
  • As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
    • Get-TenantAllowBlockListSpoofItems
    • New-TenantAllowBlockListSpoofItems
    • Set-TenantAllowBlockListSpoofItems
    • Remove-TenantAllowBlockListSpoofItems
  • Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as “Allowed” / “Blocked” by Spoof intelligence system. This can be viewed by clicking on the link “View spoofing activity” from Tenant Allow/Block Lists page-Spoofing tab. Optionally, ‘Get-SpoofIntelligenceInsight’ PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the “Tenant Allow/Block lists-Spoofing” page as this is now considered tenant specific spoof domain pair.
  • Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet ‘Get-SpoofMailReport’ will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).

Please review to learn more.


QuixTec provides this and other technical bulletins unaltered from Microsoft. As an authorized Microsoft Partner, we ensure that all our solutions we deliver to you include the latest Microsoft updates.

ABOUT US: QuixTec, LLC is a U.S. certified Veteran Owned, modern DevOps organization with experience in a plethora of IT Software Languages.  As a Microsoft Partner, we specialize in Discounted Microsoft Software Licensing, Microsoft SharePoint, Microsoft365 and HTML5 technologies for small to enterprise-sized organizations. Our dedication to IT excellence is evidenced through our PECB ISO Certification training center. The only PECB ISO authorized center in Washington State. QuixTec, implements and provides training for upcoming open-source digital marketing services that are taking the industry by storm. This solution, used by over 100,000 businesses, provides enterprise level marketing capabilities at startup rates. The founder, Richard, has 30 years of experience working with several notable companies that include World Vision, Expedia, Microsoft, Levi Strauss, NASA, Boeing Aerospace, Los Alamos National Laboratory, and the U.S. Air Force, to name a few.  QuixTec is in the Seattle area. Phone today for a free consultation and project estimate.

(425) 367-9025


SharePoint Development ServicesSharePoint Development - SharePoint Consultancy ServicesCustom Solution Development - Microsoft 365 Experts - Microsoft 365 - IT Staffing Services - WordPress Development Services - Form Email Validation - Microsoft Licensing - Mautic Open Source MarketingBest IT Staffing AgenciesIT Staffing Company  - PECB ISO Training and Certification

You May Also Like…

(Updated) Toggle to try the Preview of new Outlook for Windows

(Updated) Toggle to try the Preview of new Outlook for Windows

MC526128, Exchange Online, Microsoft 365 Apps, SharePoint Development Services From Microsoft CorporationTechnical Bulletin MC526128 · Published Mar 11, 2023 Message Summary Updated March 15, 2023: We have updated the content to show as...

Modern Authentication Settings Update

Modern Authentication Settings Update

MC527926, Exchange Online, SharePoint Development Services From Microsoft CorporationTechnical Bulletin MC527926 · Published Mar 15, 2023 Message Summary Over the past few months, we have turned off Basic Auth for specific protocols in...