After enabling the Allow or block file setting in the Microsoft Defender portal, the next step to block potentially malicious files is to create file indicators for the specific file hashes you want to block.
You can add these indicators by following these steps in the Microsoft Defender portal:
Navigate to Indicators: Go to Settings > Endpoints > Indicators (under the Rules section).
Add File Hashes: Select the File hashes tab and click Add item.
Define the Indicator: Enter the file's hash (MD5, SHA1, or SHA256) and set the Action to Block execution or Block and remediate.
Set the Scope: Choose the organizational scope. Since you have a single device group including all devices, you can apply the indicator to that specific group or the entire organization.
Requirements for Blocking to Work:
Active Mode: Microsoft Defender Antivirus must be running in Active mode on the devices.
Cloud Protection: Cloud-delivered protection must be enabled to allow the endpoint to communicate with the service for real-time blocking.
Reference:
https://learn.microsoft.com/en-us/defender-endpoint/indicator-file