Microsoft Entra External ID

Allow Deny List

14 August 2026Updated+1 / −1 lines

In brief

The guidance now includes an approximate domain-count example and reiterates that capacity depends on domain length within the 25 KB (25,000-character) policy limit.

What Entra admins need to know

Administrators can use the example to estimate list capacity when configuring domains; no product change or required action is indicated.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

You can create either an allow list or a block list. You can't set up both types of lists. By default, whatever domains aren't in the allow list are on the block list, and vice versa.
You can create only one policy per organization. You can update the policy to include more domains, or you can delete the policy to create a new one.
The number of domains you can add to an allow list or block list is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allow list or block list and any other parameters configured for other features. For example, if your domain entries average 15 characters each, you can add approximately 1,600 domains to the policy.
This list works independently from OneDrive and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or block list for OneDrive and SharePoint Online. For more information, see Restrict sharing of SharePoint and OneDrive content by domain.
The list doesn't apply to external users who already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation fails.
Both allow/block list and cross-tenant access settings are checked at the time of invitation.

@@ -23,7 +23,7 @@ This article explains how to configure an allow list or block list for B2B colla  - You can create either an allow list or a block list. You can't set up both types of lists. By default, whatever domains aren't in the allow list are on the block list, and vice versa. - You can create only one policy per organization. You can update the policy to include more domains, or you can delete the policy to create a new one.-- The number of domains you can add to an allow list or block list is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allow list or block list and any other parameters configured for other features.+- The number of domains you can add to an allow list or block list is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allow list or block list and any other parameters configured for other features. For example, if your domain entries average 15 characters each, you can add approximately 1,600 domains to the policy. - This list works independently from OneDrive and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or block list for OneDrive and SharePoint Online. For more information, see [Restrict sharing of SharePoint and OneDrive content by domain](https://support.office.com/article/restricted-domains-sharing-in-sharepoint-online-and-onedrive-for-business-5d7589cd-0997-4a00-a2ba-2320ec49c4e9). - The list doesn't apply to external users who already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation fails. - Both allow/block list and cross-tenant access settings are checked at the time of invitation.