MC1546447 - Microsoft Defender for Office 365: Updated recipient inclusion logic for threat protection policies
Microsoft 365 Message Center announcement MC1546447.
MS Message Center's Summary
Microsoft is updating recipient inclusion logic in threat protection policies from match all to match any when multiple recipient types are configured. This rollout begins in early December 2026. New policies and modified existing policies will use the updated logic, which can expand policy scope. Administrators should review recipient conditions before editing any policies.
- Administrator impact
- Review existing threat protection policies and understand that modifying them will apply the new match any recipient logic.
- End user impact
- Users may be included in expanded threat protection policies when administrators modify existing rules.
- Importance
- 4/10: Changes to policy targeting logic require administrative awareness to prevent unintended security policy expansion.
Microsoft Summary
Microsoft Defender for Office 365 will change recipient inclusion logic in threat protection policies from Match all (AND) to Match any (OR) when multiple recipient types are specified. This update, rolling out in December 2026, expands policy scope upon modification but does not auto-convert existing policies.
- Message Center ID
- MC1546447
- Category
- stay Informed
- Severity
- normal
- Services
- Microsoft Defender XDR
- Tags
- Feature update, User impact, Admin impact
- Published
- 2026-11-10
- Last updated
- 2026-11-10
- Expires
- 2027-01-04
[What and why] Microsoft Defender for Office 365 is updating how recipient inclusion conditions are evaluated when targeting threat protection policies. When a policy includes multiple recipient condition types, such as users, groups, and domains, policies will use Match any (OR) logic instead of Match all (AND) logic. This change simplifies policy targeting and reduces the risk that intended recipients are excluded because they do not satisfy every configured recipient condition. [Rollout schedule] General Availability (Worldwide) : We will begin rolling out in early December 2026 and expect to complete by early December 2026 . [Impact on your organization] Who is affected Administrators who create or modify Microsoft Defender for Office 365 threat protection policies that use recipient inclusion conditions Platforms and services Microsoft Defender for Office 365, including policy changes made through the Microsoft Defender portal or Exchange Online PowerShell What will happen New policies created after rollout will use Match any (OR) logic by default. Existing policies will not be automatically converted during rollout. When an administrator modifies an existing policy, that policy will transition to the new recipient inclusion logic. The transition from Match all (AND) to Match any (OR) can expand the population to which the policy applies. The Microsoft Defender portal will provide warning and confirmation messaging during the transition. For changes made through Exchange Online PowerShell, administrators will receive a warning when importing the PowerShell module. Existing policies remain unchanged until they are modified, allowing organizations to transition progressively rather than through an automatic tenant-wide conversion. [Action required and recommendations] Before modifying an existing policy that uses recipient inclusion conditions: Review the configured users, groups, and domains. Review the resulting policy scope because transitioning from Match all (AND) to Match any (OR) can expand the population to which the policy applies. Review the warning and confirmation messaging provided in the Microsoft Defender portal or Exchange Online PowerShell before completing the change. No action is required for existing policies that you do not modify. [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.