Defender for Office 365 policies will match any recipient rule from December

Defender for Office 365 policies will match any recipient rule from December

10 November 2026: Microsoft is changing how Defender for Office 365 threat protection policies pick their recipients, from Match all (AND) to Match any (OR) when a policy names more than one type of condition, starting in early December. Existing policies keep the old behaviour only until the next time someone edits them.

Not yet independently verified. We read this notice through a public archive of Microsoft 365 Message Center posts, because the original sits inside the tenant admin console. Microsoft gives only "early December 2026" for the rollout and no exact day. We will update this when it can be confirmed, and remove this note.

How a harmless edit can change who a policy covers

A policy can target users, groups and domains together. Under today's AND logic, a recipient has to satisfy every one of those conditions, so a policy naming the Finance group and the domain contoso.example applies only to Finance members at that domain. Under OR, it applies to everyone in Finance and to everyone at contoso.example.

Microsoft's stated reason is that AND logic risks leaving out intended recipients who do not meet every condition. The opposite risk is what an administrator needs to plan for, since the notice says plainly that the switch "can expand the population to which the policy applies".

The trigger is what makes this awkward. New policies use OR from the start of the rollout. Existing ones stay as they are until an administrator modifies them, at which point the policy moves to the new logic. An analyst changing a quarantine action or adding a single address could, in the same save, extend a strict policy to thousands of mailboxes.

Warnings in the portal and in PowerShell

The Defender portal will show a warning and ask for confirmation during the transition. Those working through Exchange Online PowerShell get a warning when they import the module, which is a weaker prompt than a confirmation on the individual change, so scripted policy updates deserve particular attention.

Before modifying any policy that uses recipient inclusion conditions, Microsoft asks administrators to review the configured users, groups and domains, and the scope that will result. For policies that nobody touches, no action is required, and the company presents that as a way of moving progressively rather than through a tenant-wide conversion.

Three checks worth running in November

A short audit before the rollout pays off:

• list the policies that combine more than one recipient type, since single-type policies are not affected
• work out for each what the OR population would be, and note where it differs sharply from today's
• if a policy depends on the intersection, split the intent before the first edit, for example by using a dedicated group that contains exactly the intended people

Change-control records should also note the date, so that a later spike in quarantined mail or a sudden difference in phishing verdicts can be traced to this rather than to a threat.

Microsoft lists no compliance considerations for the change. Our email security software category holds eleven listings.

Sources

• Microsoft 365 Message Center MC1546447 (public archive copy), 10 November 2026