Upcoming behavior change to the “DoNotRewrite” List

In the world of security operations, there are several mechanisms utilized to ensure tenant security. The deployment of Tenant Allow/Block List serves as the primary source of truth for managing tenant allows, rendering other methods redundant. As such, the "DoNotRewrite" list used for URL detonations and verdicts in mail flow or Time of Click will be modified in late April. The intention of the "DoNotRewrite" list is to give tenants the ability to skip the wrapping of URLs.

With the deployment of the Tenant Allow/Block List, it is strongly advised for SecOps teams to manage all tenant allows in one location. Starting in late April, entries on the "DoNotRewrite" list will only skip Safe Links wrapping. Detonations and verdicts will no longer be skipped. This change in behavior is intended to streamline the tenant allow management process, giving security administrators greater regulatory control.

If you are an organizational leader, you need to review your "DoNotRewrite" URLs lists and confirm that entries are added exclusively for their intended purpose of skipping the wrapping of URLs. Proper preparation is crucial to ensure a seamless transition with no adverse effects on operations. For additional information, please follow the Learn More link posted in the article.

The post Upcoming behavior change to the "DoNotRewrite" List originally appeared on M365 Admin.