1) Log into Microsoft Defender directly using administrator (“3”) account or navigate to Defender from Microsoft 365 admin center by clicking “Security” on the left panel.
2) In Defender, click "Policies & rules" on the left panel.
3) Under "Policies & rules," click "Threat policies".
4) Under "Rules", click "Tenant Allow/Block Lists".
5) Click "+ Block" to add an email address or domain to be blocked.
6) Enter the email addresses and/or domains at the top. "Remove block entry after” defaults to 30 days. Select “Never expire”. Click the “Add” button to save.
