Microsoft Defender for Office 365: Updated recipient inclusion logic for threat protection policies

[What and why]

Microsoft Defender for Office 365 is updating how recipient inclusion conditions are evaluated when targeting threat protection policies. When a policy includes multiple recipient condition types, such as users, groups, and domains, policies will use Match any (OR) logic instead of Match all (AND) logic. This change simplifies policy targeting and reduces the risk that intended recipients are excluded because they do not satisfy every configured recipient condition.

[Rollout schedule]

• General Availability (Worldwide): We will begin rolling out in early December 2026 and expect to complete by early December 2026.

[Impact on your organization]

Who is affected

• Administrators who create or modify Microsoft Defender for Office 365 threat protection policies that use recipient inclusion conditions

Platforms and services

• Microsoft Defender for Office 365, including policy changes made through the Microsoft Defender portal or Exchange Online PowerShell

What will happen

• New policies created after rollout will use Match any (OR) logic by default.
• Existing policies will not be automatically converted during rollout.
• When an administrator modifies an existing policy, that policy will transition to the new recipient inclusion logic.
• The transition from Match all (AND) to Match any (OR) can expand the population to which the policy applies.
• The Microsoft Defender portal will provide warning and confirmation messaging during the transition.
• For changes made through Exchange Online PowerShell, administrators will receive a warning when importing the PowerShell module.
• Existing policies remain unchanged until they are modified, allowing organizations to transition progressively rather than through an automatic tenant-wide conversion.

[Action required and recommendations]

Before modifying an existing policy that uses recipient inclusion conditions:

• Review the configured users, groups, and domains.
• Review the resulting policy scope because transitioning from Match all (AND) to Match any (OR) can expand the population to which the policy applies.
• Review the warning and confirmation messaging provided in the Microsoft Defender portal or Exchange Online PowerShell before completing the change.

No action is required for existing policies that you do not modify.

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.