45 days after last used date

The value Remove allow entry after > 45 days after last used date is now the default on new allow entries from submissions. The existing allow entries in the Tenant Allow/Block List can also be modified to include the value Remove allow entry after > 45 days after last used date. The allow entry is triggered and the LastUsedDate property is updated when the entity is encountered and identified as malicious during mail flow or at time of click. After the filtering system determines that the entity is clean, the allow entry is automatically removed after 45 days. By default, allow entries for spoofed senders never expire.