https://community.splunk.com/t5/Splunk-SOAR/O365-Defender-blocking/m-p/572768#M717 <P>I am trying to create a playbook where the first step is a manual block an email address &nbsp;in the restricted users portal in Microsoft O365&nbsp;then automatically unblock after 90 days. I have no idea where to start especially when the first block is a manual step! Please help.</P> Thu, 28 Oct 2021 03:38:36 GMT brandylee19931 2021-10-28T03:38:36Z https://community.splunk.com/t5/Splunk-SOAR/O365-Defender-blocking/m-p/572768#M717 <P>I am trying to create a playbook where the first step is a manual block an email address &nbsp;in the restricted users portal in Microsoft O365&nbsp;then automatically unblock after 90 days. I have no idea where to start especially when the first block is a manual step! Please help.</P> Thu, 28 Oct 2021 03:38:36 GMT https://community.splunk.com/t5/Splunk-SOAR/O365-Defender-blocking/m-p/572768#M717 brandylee19931 2021-10-28T03:38:36Z