> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Blacklist Email

> Blocks an email address or a whole domain for everyone in your client's Microsoft 365, by adding it to the Tenant Allow/Block List.

Blacklist Email blocks one sender, an email address or a whole domain, for everyone in the client's organisation. Use it when a client keeps getting phishing, spam or other unwanted email from the same sender. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365), with [Exchange access](/core/reference/microsoft-faq#exchange-online) for the client.

<Frame caption="Blacklist Email in 48 seconds: what it asks, what it does and what you get.">
  <video controls preload="none" playsInline className="w-full aspect-video rounded-xl" poster="/images/videos/wf-blacklist-email-overview.jpg" src="https://mintcdn.com/triggr/rFRD51HB_88hTzdJ/images/videos/wf-blacklist-email-overview.mp4?fit=max&auto=format&n=rFRD51HB_88hTzdJ&q=85&s=2beb229c72b259d8d8f9dfae04de8bbd" data-path="images/videos/wf-blacklist-email-overview.mp4" />
</Frame>

## What the form asks

| Field | |
| - | - |
| Email address or domain | Required by default. One sender to block, for example `name@example.com` or `example.com` |
| Reason / ticket reference | Optional by default. For your records and the approver; not sent to Microsoft |

## What it does

1. Creates a ticket in your PSA, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
3. Block Sender: adds the address or domain as a block entry to the Tenant Allow/Block List in the client's Exchange Online. The entry never expires.

Each run blocks one address or domain. Microsoft treats email from a blocked sender as high confidence phishing and quarantines it, and the client's users can't send email to that sender either (see [Microsoft's Tenant Allow/Block List guide](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)).

Blacklist Email only adds blocks. To remove one, delete its entry under **Tenant Allow/Block Lists > Domains & addresses** in the client's Microsoft Defender portal.

With Log actions to the ticket on, the ticket also gets a note when the run starts, after Block Sender and when the run completes.

## Configure it

Go to **Config**, choose Mailboxes and click Blacklist Email.

<Frame caption="Configure Blacklist Email: every option, step by step (1:22).">
  <video controls preload="none" playsInline className="w-full aspect-video rounded-xl" poster="/images/videos/wf-blacklist-email-configure.jpg" src="https://mintcdn.com/triggr/rFRD51HB_88hTzdJ/images/videos/wf-blacklist-email-configure.mp4?fit=max&auto=format&n=rFRD51HB_88hTzdJ&q=85&s=39424894af4b82d1e29f73792152b628" data-path="images/videos/wf-blacklist-email-configure.mp4" />
</Frame>

| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| Email address or domain | Form config | Required by default. Keep it Required: it's the sender the run blocks |
| Reason / ticket reference | Form config | Hidden, Optional or Required. Can differ per client |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates, but aren't sent to Microsoft. Add client section asks one client only |
| Approval | Execution config | None runs on submit. Internal waits for a teammate or group. External waits for the client's approver, whose name and email you enter at that client's scope. Conditional overrides use a different approval when the answers match |
| Ticketing | Execution config | Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |

Approval and Ticketing are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).

## Troubleshooting

<AccordionGroup>
  <Accordion title="The run ended Failed at Block Sender">
    Exchange refused the entry. Open the step in [Executions](/core/use/executions) to see Exchange's message. Microsoft limits how many block entries a tenant can hold; see [Microsoft's guide](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure).
  </Accordion>

  <Accordion title="Email from a subdomain still arrives">
    A block for a domain doesn't cover its subdomains. Run it again with `*.` before the domain, for example `*.example.com`.
  </Accordion>

  <Accordion title="“Microsoft Exchange integration is not configured for tenant …”">
    The client has no Exchange connection in Triggr yet. See [Exchange Online](/core/reference/microsoft-faq#exchange-online).
  </Accordion>
</AccordionGroup>

## Related

* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [Executions](/core/use/executions)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.