hostedConnectionFilterPolicies

Connection Filter Policy. IP allow and block lists plus safe-list connection filtering. The hostedConnectionFilterPolicies entity set lives under /exchange/v1.0/hostedConnectionFilterPolicies in the Threat protection category.

Fact	Value
Path	`/exchange/v1.0/hostedConnectionFilterPolicies`
Category	Threat protection
Tier	Tier 3, Mail flow
Read role	`MailFlow.Read.All` (Community)
Write role	`MailFlow.ReadWrite.All` (Pro)
Backing cmdlets	Get-HostedConnectionFilterPolicy, Set-HostedConnectionFilterPolicy

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/hostedConnectionFilterPolicies`	List hostedConnectionFilterPolicies entries.	`MailFlow.Read`	Community
GET	`/exchange/v1.0/hostedConnectionFilterPolicies/{key}`	Get a single hostedConnectionFilterPolicies entry by Identity.	`MailFlow.Read`	Community
PATCH	`/exchange/v1.0/hostedConnectionFilterPolicies/{key}`	PATCH /hostedConnectionFilterPolicies/{key} - Set-only (no New/Remove in EXO).	`MailFlow.ReadWrite`	Pro

GET /exchange/v1.0/hostedConnectionFilterPolicies

List hostedConnectionFilterPolicies entries.

Backing cmdlet: Get-HostedConnectionFilterPolicy. Role: MailFlow.Read (Community).

List hostedConnectionFilterPolicies

Stub auto-generated example for the hostedConnectionFilterPolicies collection. Backing cmdlet: Get-HostedConnectionFilterPolicy. Live-verify with ?$top=3&$select=Id,Name and replace the synthetic body before promoting to Tier 1.

GET /exchange/v1.0/hostedConnectionFilterPolicies?$top=3 HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#hostedConnectionFilterPolicies",
  "value": []
}

Notes: Illustrative example derived from the cmdlet documentation, not a live capture: field names are real, values are placeholders.

GET /exchange/v1.0/hostedConnectionFilterPolicies/{key}

Get a single hostedConnectionFilterPolicies entry by Identity.

Backing cmdlet: Get-HostedConnectionFilterPolicy. Role: MailFlow.Read (Community).

Get a hosted connection filter policy by key

Retrieve a single hosted connection filter policy by its identity. Exchange Online ships a singleton “Default” policy that holds the connection-level IP allow and block lists for inbound mail.

GET /exchange/v1.0/hostedConnectionFilterPolicies/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#hostedConnectionFilterPolicies/$entity",
  "Id": "Default",
  "Name": "Default",
  "Identity": "Default",
  "AdminDisplayName": "",
  "Guid": "7f4e4061-c628-420b-a596-543b4dbd9b2b",
  "IsDefault": true,
  "IPAllowList": [],
  "IPBlockList": [],
  "EnableSafeList": true,
  "DirectoryBasedEdgeBlockMode": "Default",
  "WhenCreated": "2026-03-30T17:41:56+03:00",
  "WhenChanged": "2026-03-30T17:42:08+03:00",
  "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "ExchangeObjectId": "5b6f3961-822a-4227-b676-bdb274f37004",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "WhenChangedUTC": "2026-03-30T14:42:08Z",
  "WhenCreatedUTC": "2026-03-30T14:41:56Z"
}

PATCH /exchange/v1.0/hostedConnectionFilterPolicies/{key}

PATCH /hostedConnectionFilterPolicies/{key} - Set-only (no New/Remove in EXO).

Backing cmdlet: Set-HostedConnectionFilterPolicy. Role: MailFlow.ReadWrite (Pro).

Parameter	In	Type
`adminDisplayName`	body
`configurationXmlRaw`	body
`enableSafeList`	body
`ipAllowList`	body
`ipBlockList`	body
`dryRun`	query	bool (switch)

Update a hosted connection filter policy

Update the connection-level IP allow and block lists on a hosted connection filter policy via Set-HostedConnectionFilterPolicy. Exchange Online ships a singleton “Default” policy (no New/Remove), so writes always target it.

PATCH /exchange/v1.0/hostedConnectionFilterPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "adminDisplayName": "Exonaut managed connection filter",
  "enableSafeList": true,
  "ipAllowList": [
    "198.51.100.0/24",
    "203.0.113.10"
  ],
  "ipBlockList": [
    "192.0.2.0/24"
  ]
}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#hostedConnectionFilterPolicies/$entity",
  "Id": "Default",
  "Name": "Default",
  "Identity": "Default",
  "AdminDisplayName": "Exonaut managed connection filter",
  "IsDefault": true,
  "IPAllowList": [
    "198.51.100.0/24",
    "203.0.113.10"
  ],
  "IPBlockList": [
    "192.0.2.0/24"
  ],
  "EnableSafeList": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.