Microsoft Defender for Office 365: Updated recipient inclusion logic for threat protection policies

Microsoft Defender for Office 365 will change recipient inclusion logic in threat protection policies from Match all (AND) to Match any (OR) when multiple recipient types are specified. This update, rolling out in December 2026, expands policy scope upon modification but does not auto-convert existing policies. Microsoft Defender for Office 365 is updating how recipient inclusion conditions are evaluated when targeting threat protection policies. When a policy includes multiple recipient condition types, such as users, groups, and domains, policies will use Match any (OR) logic instead of Match all (AND) logic. This change simplifies policy targeting and reduces the risk that intended recipients are excluded because they do not satisfy every configured recipient condition. Rollout schedule General Availability (Worldwide): We will begin rolling out in early December 2026 and expect to complete by early December 2026. Impact on your organization Who is affected Administrators who create or modify Microsoft Defender for Office 365 threat protection policies that use recipient inclusion conditions Platforms and services Microsoft Defender for Office 365, including policy changes made through the Microsoft Defender portal or Exchange Online PowerShell What will happen New policies created after rollout will use Match any (OR) logic by default. Existing policies will not be automatically converted during rollout. When an administrator modifies an existing policy, that policy will transition to the new recipient inclusion logic. The transition from Match all (AND) to Match any (OR) can expand the population to which the policy applies. The Microsoft Defender portal will provide warning and confirmation messaging during the transition. For changes made through Exchange Online PowerShell, administrators will receive a warning when importing the PowerShell module. Existing policies remain unchanged until they are modified, allowing organizations to transition progressively rather than through an automatic tenant-wide conversion. Action required and recommendations Before modifying an existing policy that uses recipient inclusion conditions: Review the configured users, groups, and domains. Review the resulting policy scope because transitioning from Match all (AND) to Match any (OR) can expand the population to which the policy applies. Review the warning and confirmation messaging provided in the Microsoft Defender portal […]

The post Microsoft Defender for Office 365: Updated recipient inclusion logic for threat protection policies appeared first on M365 Admin.