Skip to main content
Blacklist Email blocks one sender, an email address or a whole domain, for everyone in the client’s organisation. Use it when a client keeps getting phishing, spam or other unwanted email from the same sender. It needs Microsoft 365 connected, with Exchange access for the client.

Blacklist Email in 48 seconds: what it asks, what it does and what you get.

​
What the form asks

​
What it does

  1. Creates a ticket in your PSA, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
  3. Block Sender: adds the address or domain as a block entry to the Tenant Allow/Block List in the client’s Exchange Online. The entry never expires.
Each run blocks one address or domain. Microsoft treats email from a blocked sender as high confidence phishing and quarantines it, and the client’s users can’t send email to that sender either (see Microsoft’s Tenant Allow/Block List guide). Blacklist Email only adds blocks. To remove one, delete its entry under Tenant Allow/Block Lists > Domains & addresses in the client’s Microsoft Defender portal. With Log actions to the ticket on, the ticket also gets a note when the run starts, after Block Sender and when the run completes.

​
Configure it

Go to Config, choose Mailboxes and click Blacklist Email.

Configure Blacklist Email: every option, step by step (1:22).

Approval and Ticketing are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

​
Troubleshooting

Exchange refused the entry. Open the step in Executions to see Exchange’s message. Microsoft limits how many block entries a tenant can hold; see Microsoft’s guide.
A block for a domain doesn’t cover its subdomains. Run it again with *. before the domain, for example *.example.com.
The client has no Exchange connection in Triggr yet. See Exchange Online.