MC1546447 Medium
Microsoft Defender for Office 365: Updated recipient inclusion logic for threat protection policies
Summary AI-generated
Defender for Office 365 threat policy targeting now uses Match any (OR) logic for recipient inclusion conditions, simplifying targeting and reducing exclusion risks.
Suggested actions AI-generated
- Review users, groups, and domains before modifying existing policies
- Review policy scope due to expanded population
- Check portal or PowerShell warnings before changes
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1171845 (Updated) Microsoft Defender for Office 365: Enhancing the quarantine experience for administrators
- MC1536045 Microsoft Defender: Expanded URBAC permission support for email content access
- MC1402307 Microsoft Defender for Cloud Apps: Improvements to threat protection capabilities
- MC1476237 Microsoft Defender for Office 365: Remediation actions from the Teams message entity flyout
- MC1422060 (Updated) Microsoft Defender for Office 365: Prompt injection protection for email
- MC1166867 (Updated) Microsoft Defender for Office 365: Enhancing the quarantine email preview experience
Original post from Microsoft
[What and why]
Microsoft Defender for Office 365 is updating how recipient inclusion conditions are evaluated when targeting threat protection policies. When a policy includes multiple recipient condition types, such as users, groups, and domains, policies will use Match any (OR) logic instead of Match all (AND) logic. This change simplifies policy targeting and reduces the risk that intended recipients are excluded because they do not satisfy every configured recipient condition.
[Rollout schedule]
- General Availability (Worldwide): We will begin rolling out in early December 2026 and expect to complete by early December 2026.
[Impact on your organization]
Who is affected
- Administrators who create or modify Microsoft Defender for Office 365 threat protection policies that use recipient inclusion conditions
Platforms and services
- Microsoft Defender for Office 365, including policy changes made through the Microsoft Defender portal or Exchange Online PowerShell
What will happen
- New policies created after rollout will use Match any (OR) logic by default.
- Existing policies will not be automatically converted during rollout.
- When an administrator modifies an existing policy, that policy will transition to the new recipient inclusion logic.
- The transition from Match all (AND) to Match any (OR) can expand the population to which the policy applies.
- The Microsoft Defender portal will provide warning and confirmation messaging during the transition.
- For changes made through Exchange Online PowerShell, administrators will receive a warning when importing the PowerShell module.
- Existing policies remain unchanged until they are modified, allowing organizations to transition progressively rather than through an automatic tenant-wide conversion.
[Action required and recommendations]
Before modifying an existing policy that uses recipient inclusion conditions:
- Review the configured users, groups, and domains.
- Review the resulting policy scope because transitioning from Match all (AND) to Match any (OR) can expand the population to which the policy applies.
- Review the warning and confirmation messaging provided in the Microsoft Defender portal or Exchange Online PowerShell before completing the change.
No action is required for existing policies that you do not modify.
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Defender for Office 365 will change recipient inclusion logic in threat protection policies from Match all (AND) to Match any (OR) when multiple recipient types are specified. This update, rolling out in December 2026, expands policy scope upon modification but does not auto-convert existing policies.