Microsoft Defender online

Lon Green 0 Reputation points
2026-06-11T12:24:27.1533333+00:00

We are having a major issue with MS Outlook (New and Old) not being able to connect to the Online Exchange. It started yesterday with a few machines, today it is growing. It is not the domain name or a firewall change.

I believe it is from Microsoft Defender online. A few days ago I was adding a domain to the Tenant Allow/Block List and the site made me turn on Defender.

I do not know how to reverse it. Any suggestions?

Microsoft 365 and Office | Microsoft 365 Defender | Other | Other
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-06-11T12:25:22.69+00:00

    Outlook connectivity to Exchange Online is not controlled by the Tenant Allow/Block List in Microsoft Defender for Office 365. The Tenant Allow/Block List only affects email and URL filtering, not whether Outlook can connect to Exchange Online.

    For widespread Outlook connection issues, use the documented Exchange Online connectivity troubleshooting steps instead of changing Defender settings:

    1. Verify network access to Exchange Online
      • Ensure port 443 is open from affected machines to Microsoft 365 endpoints. Outlook Autodiscover and Outlook Anywhere both require port 443 to be open to Exchange Online.
      • If port 443 is blocked or restricted, Outlook cannot connect.
    2. Check network proxy and DNS behavior
      • Ensure the network proxy or firewall is not redirecting or pinning clients to a single Microsoft 365 IP range or URL. Proxies and LDNS resolvers must not prune DNS results or enforce IP affinity.
      • Microsoft 365 uses multiple IPs for high availability. Clients must receive the full DNS result set so Outlook can retry different endpoints.
    3. Check for security or protection software blocking Exchange Online
      • If a third‑party malware or Internet protection suite is in use, verify it is not blocking access to Exchange Online endpoints such as outlook.office365.com.
      • If event ID 1014 appears repeatedly in the System log, work with the security vendor to add exclusions for outlook.office365.com.
    4. Use the Tenant Allow/Block List only for mail/URL overrides
      • The Tenant Allow/Block List is designed to override filtering verdicts for:
        • Domains and email addresses (applies to the From address and can block sending to those domains/addresses).
        • Spoofed senders.
        • URLs (time‑of‑click protection).
      • It does not control Outlook’s ability to connect to Exchange Online. If a domain or address was added there, it affects mail flow and URL blocking/allowing, not client connectivity.
    5. If a mistaken allow/block entry was added
      • To adjust or remove a domain/email entry:
        • Go to the Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Tenant Allow/Block Lists → Domains & addresses.
        • Edit an entry to change its expiration or note, or delete it if it is not needed.
      • To adjust or remove a URL entry:
        • Go to the same Tenant Allow/Block List page → URLs tab and delete the unwanted entry.
      • PowerShell can also be used:
        • For domains/email addresses: Remove-TenantAllowBlockListItems -ListType Sender -Entries "domain.com"
        • For URLs: Remove-TenantAllowBlockListItems -ListType Url -Entries "*example.com"

    If Outlook cannot connect on multiple machines and there were no domain or firewall changes, focus on:

    • Verifying port 443 and Microsoft 365 URLs/IP ranges are reachable.
    • Ensuring DNS and proxy configurations are not pruning or pinning Microsoft 365 IPs.
    • Checking any security products for blocks on Exchange Online endpoints.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.