Views:

Learn about how approved and blocked lists affect email and file scanning in Cloud Email and Collaboration Protection.

Cloud Email and Collaboration Protection lets you configure approved and blocked lists at different levels, giving you flexibility to manage trusted and suspicious objects. However, understanding how these lists interact is key to avoiding misconfigurations.
The following table outlines how each list works and how it impacts scanning behavior.
List
Where to configure
Scanning behavior
Approved lists
Global level:
Approved/Blocked Lists under Policies → Global Settings
Approved list under Email and Collaboration Security → Configuration and Operations → Policy Resources
Cloud Email and Collaboration Protection skips scanning matching emails, files, and other supported items across all policies and delivers them to recipients.
Policy level:
Approved lists in supported security filters in Advanced Threat Protection policy and Data Loss Prevention policy
Cloud Email and Collaboration Protection skips scanning matching emails, files, and other supported items by the specific security filter in that policy, but still sends them to other filters for further checks. The final action is based on the highest-priority result.
Note
Note
For trusted senders added by end users via the add-in for Outlook, spam checks are skipped for that user only, but other filters still apply.
Blocked lists
Global level:
Approved/Blocked Lists under Policies → Global Settings
Cloud Email and Collaboration Protection quarantines matching emails, files, and other supported items and stops delivering them to recipients.
Global level:
Suspicious Object Settings under Policies → Global Settings
Cloud Email and Collaboration Protection takes the action synchronized from Trend Vision One or Apex Central / Control Manager on matching emails, files, and other supported items.
Policy level:
Blocked lists in supported security filters in Advanced Threat Protection policy and Data Loss Prevention policy
Cloud Email and Collaboration Protection applies the action defined in the corresponding filter, then sends the item to other filters for additional checks. The final action is based on the highest-priority result.
If an object matches both an approved list and a blocked list, the approved list takes precedence.