M365 Changelog: Retirement of Get/Set-PhishFilterPolicy PowerShell (legacy) to manage spoofed senders using new Tenant Allow Block list

MC335609 – Microsoft will be retiring the “Get-/Set-PhishFilterPolicy” PowerShell cmdlets. Instead, Microsoft recommends the utilization of the updated feature called “Spoof intelligence insight” in order to view spoofing activity and the new feature called “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively, which is where Microsoft will continue to invest our development resources.

Key points:

• Timing:
  • Standard: late March through end of September
  • GCC, GCC-High and DoD: late April through end of September
• Action: review and assess impact on your organization

How this will affect your organization:

Once this change is implemented Security Administrators will no longer be able to invoke these cmdlets (Get-PhishFilterPolicy / Set-PhishFilterPolicy).

What you need to do to prepare:

Instead of using “Get-PhishFilterPolicy” or “Set-PhishFilterPolicy” PowerShell cmdlets, Microsoft recommends using “Spoof intelligence insight” in order to view and “Tenant allow block lists-Spoofing” in order to manage spoofing activity respectively. Note that the new functionality has been fully available and functional in your tenant organization since it was launched in 2021(Refer to MC248392 and Roadmap: 70590) and will continue to the serve the purpose for Anti-Spoofing management within the tenant. Details are listed as below:

• The rule called “Tenant Allow/Block Lists” in the list of Threat policies page, which will provide a page for “Spoofing” from where a Security Administrator can manage spoofed domains/users (i.e. email addresses) and allow or block them for the tenant.
• As a Security Administrator, you can view, add, update, delete spoofed domain pairs using this policy or optionally using the below PowerShell cmdlets (Entries here will never expire, unless deleted by the Security Administrator):
  • Get-TenantAllowBlockListSpoofItems
  • New-TenantAllowBlockListSpoofItems
  • Set-TenantAllowBlockListSpoofItems
  • Remove-TenantAllowBlockListSpoofItems
• Spoof intelligence insight will continue to provide the Spoofing activity automatically detected and marked as “Allowed” / “Blocked” by Spoof intelligence system. This can be viewed by clicking on the link “View spoofing activity” from Tenant Allow/Block Lists page-Spoofing tab. Optionally, ‘Get-SpoofIntelligenceInsight’ PowerShell cmdlet can be used to view this activity. Security Administrator can also override the Action (i.e. Allow/Block) using Spoof intelligence insight available on the Security Center. Once Action is changed (e.g. Block to Allow), the selected Spoof domain pair will appear on the “Tenant Allow/Block lists-Spoofing” page as this is now considered tenant specific spoof domain pair.
• Spoof detections report (i.e. Spoof Mail report) and PowerShell cmdlet ‘Get-SpoofMailReport’ will continue to provide the detailed mail flow information about the spoofing activity along with the authentication results such as SPF, DKIM, DMARC (up to last 90 days).

Please review to learn more.

• Learn more about the functionality being retired here: Manage spoofed senders using the spoof intelligence policy and spoof intelligence insight in EOP
• To learn more about the new functionality already available in your tenant, please refer to the following articles:
  • Spoof intelligence insight in EOP
  • Manage the Tenant Allow/Block List: View spoofed sender entries