How do you push allow and block indicators to every Defender tenant from one list?

Reviewed by ContraForce team · Updated 2026-09-04

> Microsoft caps custom indicators at 15,000 per tenant and states that increases to this limit are not supported. Indicators cover file hashes, IP addresses, URLs and domains, and certificates combined. Network indicators accept single external IP addresses, with no CIDR blocks or address ranges, and a URL or IP policy can take up to 48 hours to take effect.

What are the hard numbers?

Three figures decide how an indicator strategy behaves at scale, and one of them is unusual in being explicitly immovable.

Why do IP indicators exhaust the budget faster than expected?

Because Defender for Endpoint supports only single external IP addresses as network indicators. There is no CIDR block and no address range.

A provider blocking a /24 spends 256 indicators rather than one. A carrier or government estate working with routed blocks can consume a meaningful share of a 15,000 budget on a single threat, and that budget cannot be raised by a support ticket.

Two operating consequences follow. Indicator lists need expiry discipline, because an indicator that is never removed is permanently spending budget. And threat intelligence that arrives as ranges has to be expanded to addresses before it can be applied, which changes both the volume and the review burden.

Is there a central list that targets tenants?

The per-tenant nature of the cap is also the shape of the problem. Each tenant has its own 15,000, and the Import Indicators API is scoped per tenant, so distributing one curated list to eighty customers means eighty authenticated calls with the same payload and eighty separate budgets to track.

At 500 indicators per call and 30 calls per minute, the write itself is fast. What does not scale is knowing which tenant currently holds which indicators, and reconciling that against the list you intended to distribute.

How do you keep one list consistent across an estate?

The write path is not the constraint; the reconciliation is. Something has to hold the intended state and compare it to the actual state per tenant.

ContraForce manages detection content as versioned repositories deployed to the workspaces you choose, with drift detection that reports where a workspace no longer matches its baseline. The same mechanism that keeps a detection rule consistent across an estate is what keeps a curated indicator list consistent, and it makes the difference between intended and actual state a report rather than an audit.

Sources

• Indicators overview
• Create indicators for IPs and URLs or domains
• Import indicators API