{"id":6164,"date":"2026-04-27T16:36:48","date_gmt":"2026-04-27T14:36:48","guid":{"rendered":"https:\/\/www.msb365.blog\/?p=6164"},"modified":"2026-04-27T16:36:48","modified_gmt":"2026-04-27T14:36:48","slug":"how-to-lock-down-exchange-online-so-eop-refuses-direct-external-mail","status":"publish","type":"post","link":"https:\/\/www.msb365.blog\/?p=6164","title":{"rendered":"How to lock down Exchange Online so EOP refuses direct external mail"},"content":{"rendered":"<link rel=\"preconnect\" href=\"https:\/\/fonts.googleapis.com\">\n<link rel=\"preconnect\" href=\"https:\/\/fonts.gstatic.com\" crossorigin>\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=JetBrains+Mono:wght@400;500;700&#038;family=Fraunces:opsz,wght@9..144,400;9..144,600;9..144,800&#038;family=Inter+Tight:wght@400;500;600;700&#038;display=swap\" rel=\"stylesheet\">\n<style>\n.eop-lockdown-post{\n  --bg:#fbfaf7;\n  --bg-soft:#f3f1ec;\n  --bg-elev:#ffffff;\n  --line:#d8d4c8;\n  --line-soft:#e7e3d8;\n  --text:#1a1d23;\n  --text-soft:#52596a;\n  --text-dim:#8a8f9c;\n  --accent:#c2410c;\n  --accent-deep:#9a3412;\n  --ok:#15803d;\n  --warn:#a16207;\n  --danger:#b91c1c;\n  --info:#1d4ed8;\n  --code-bg:#f6f3ec;<\/p>\n<p>  background:var(--bg);\n  color:var(--text);\n  font-family:'Inter Tight', system-ui, -apple-system, sans-serif;\n  line-height:1.65;\n  font-size:16px;\n  -webkit-font-smoothing:antialiased;\n  padding:48px 40px;\n  border-radius:12px;\n  border:1px solid var(--line-soft);\n  max-width:920px;\n  margin:0 auto;\n  counter-reset:sec;\n}<\/p>\n<p>\/* Reset only inside the post wrapper *\/\n.eop-lockdown-post *{box-sizing:border-box}\n.eop-lockdown-post p,\n.eop-lockdown-post h1,\n.eop-lockdown-post h2,\n.eop-lockdown-post h3,\n.eop-lockdown-post h4,\n.eop-lockdown-post ul,\n.eop-lockdown-post ol{margin:0;padding:0}<\/p>\n<p>\/* \u2500\u2500\u2500 Hero \/ Intro \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .hero{\n  margin-bottom:48px;padding-bottom:32px;\n  border-bottom:1px solid var(--line);\n}\n.eop-lockdown-post .eyebrow{\n  font-family:'JetBrains Mono', monospace;\n  font-size:12px;color:var(--accent);\n  letter-spacing:2px;text-transform:uppercase;\n  margin-bottom:18px;\n  display:inline-flex;align-items:center;gap:10px;\n}\n.eop-lockdown-post .eyebrow::before{\n  content:\"\";width:24px;height:1px;background:var(--accent);\n  display:inline-block;\n}\n.eop-lockdown-post h1.title{\n  font-family:'Fraunces', Georgia, serif;\n  font-size:clamp(32px, 4.6vw, 48px);\n  line-height:1.08;\n  font-weight:600;\n  letter-spacing:-0.02em;\n  margin-bottom:20px;\n  color:var(--text);\n}\n.eop-lockdown-post h1.title em{\n  font-style:italic;color:var(--accent);font-weight:400;\n}\n.eop-lockdown-post .lead{\n  font-size:18px;color:var(--text-soft);\n  max-width:680px;line-height:1.6;\n  margin-bottom:24px;\n}\n.eop-lockdown-post .stamps{\n  display:flex;gap:10px;flex-wrap:wrap;\n  font-family:'JetBrains Mono', monospace;font-size:11px;\n}\n.eop-lockdown-post .stamp{\n  padding:5px 11px;border:1px solid var(--line);\n  border-radius:4px;color:var(--text-soft);\n  text-transform:uppercase;letter-spacing:1px;\n  background:var(--bg-elev);\n}\n.eop-lockdown-post .stamp.crit{border-color:var(--danger);color:var(--danger)}\n.eop-lockdown-post .stamp.ok{border-color:var(--ok);color:var(--ok)}<\/p>\n<p>\/* \u2500\u2500\u2500 Sections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post section{\n  margin-bottom:64px;scroll-margin-top:80px;\n}\n.eop-lockdown-post section h2{\n  font-family:'Fraunces', Georgia, serif;\n  font-size:30px;font-weight:600;\n  letter-spacing:-0.01em;\n  margin-bottom:22px;\n  display:flex;align-items:baseline;gap:14px;\n  color:var(--text);\n}\n.eop-lockdown-post section h2::before{\n  content:counter(sec, decimal-leading-zero);\n  counter-increment:sec;\n  font-family:'JetBrains Mono', monospace;\n  font-size:14px;color:var(--accent);font-weight:400;\n}\n.eop-lockdown-post section h3{\n  font-size:20px;font-weight:600;\n  margin:32px 0 12px;\n  color:var(--text);\n}\n.eop-lockdown-post section h4{\n  font-size:14px;font-weight:600;\n  margin:22px 0 10px;color:var(--text);\n  text-transform:uppercase;letter-spacing:0.5px;\n  font-family:'JetBrains Mono', monospace;\n}\n.eop-lockdown-post section p{\n  margin-bottom:14px;color:var(--text-soft);\n}\n.eop-lockdown-post section p strong{color:var(--text);font-weight:600}\n.eop-lockdown-post section ul,\n.eop-lockdown-post section ol{\n  margin:10px 0 18px 22px;color:var(--text-soft);\n}\n.eop-lockdown-post section li{margin-bottom:7px}\n.eop-lockdown-post section li strong{color:var(--text)}\n.eop-lockdown-post section a{\n  color:var(--info);text-decoration:underline;\n  text-decoration-thickness:1px;\n  text-underline-offset:2px;\n}\n.eop-lockdown-post section a:hover{color:var(--accent-deep)}<\/p>\n<p>\/* \u2500\u2500\u2500 Code blocks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post pre{\n  background:var(--code-bg);\n  border:1px solid var(--line);\n  border-radius:8px;\n  padding:18px 22px;\n  overflow-x:auto;\n  margin:14px 0 22px;\n  font-family:'JetBrains Mono', monospace;\n  font-size:13px;line-height:1.65;\n  position:relative;\n}\n.eop-lockdown-post pre[data-label]::before{\n  content:attr(data-label);\n  position:absolute;top:-1px;right:-1px;\n  background:var(--bg-elev);\n  color:var(--text-dim);\n  padding:4px 12px;\n  font-size:10px;\n  text-transform:uppercase;\n  letter-spacing:1.5px;\n  border-radius:0 8px 0 8px;\n  border-left:1px solid var(--line);\n  border-bottom:1px solid var(--line);\n}\n.eop-lockdown-post code{\n  font-family:'JetBrains Mono', monospace;\n  background:var(--bg-soft);\n  padding:2px 6px;\n  border-radius:3px;\n  font-size:0.88em;\n  color:var(--accent);\n  border:1px solid var(--line-soft);\n}\n.eop-lockdown-post pre code{\n  background:none;padding:0;border:none;color:var(--text);\n}\n.eop-lockdown-post .ps-cmd{color:#0550ae}\n.eop-lockdown-post .ps-param{color:#953800}\n.eop-lockdown-post .ps-string{color:#0a3069}\n.eop-lockdown-post .ps-comment{color:#6e7781;font-style:italic}\n.eop-lockdown-post .ps-var{color:#6f42c1}<\/p>\n<p>\/* \u2500\u2500\u2500 Callouts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .callout{\n  border:1px solid var(--line);\n  border-left:3px solid var(--info);\n  background:linear-gradient(to right, rgba(29,78,216,0.05), transparent 40%);\n  padding:16px 20px;border-radius:6px;\n  margin:22px 0;\n}\n.eop-lockdown-post .callout.warn{\n  border-left-color:var(--warn);\n  background:linear-gradient(to right, rgba(161,98,7,0.06), transparent 40%);\n}\n.eop-lockdown-post .callout.crit{\n  border-left-color:var(--danger);\n  background:linear-gradient(to right, rgba(185,28,28,0.06), transparent 40%);\n}\n.eop-lockdown-post .callout.ok{\n  border-left-color:var(--ok);\n  background:linear-gradient(to right, rgba(21,128,61,0.05), transparent 40%);\n}\n.eop-lockdown-post .callout .lbl{\n  font-family:'JetBrains Mono', monospace;\n  font-size:11px;text-transform:uppercase;\n  letter-spacing:1.5px;font-weight:700;\n  margin-bottom:7px;display:block;\n  color:var(--info);\n}\n.eop-lockdown-post .callout.warn .lbl{color:var(--warn)}\n.eop-lockdown-post .callout.crit .lbl{color:var(--danger)}\n.eop-lockdown-post .callout.ok .lbl{color:var(--ok)}\n.eop-lockdown-post .callout p{margin:0;color:var(--text)}\n.eop-lockdown-post .callout p + p{margin-top:8px}<\/p>\n<p>\/* \u2500\u2500\u2500 Flow diagram \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .flow-diagram{\n  background:var(--bg-soft);\n  border:1px solid var(--line);\n  border-radius:10px;\n  padding:28px;\n  margin:22px 0;\n}\n.eop-lockdown-post .flow-diagram h4{\n  margin-top:0;margin-bottom:18px;color:var(--text-soft);\n}\n.eop-lockdown-post .flow-row{\n  display:flex;align-items:center;gap:12px;flex-wrap:wrap;\n  font-family:'JetBrains Mono', monospace;font-size:12px;\n  margin-bottom:12px;\n}\n.eop-lockdown-post .flow-row:last-child{margin-bottom:0}\n.eop-lockdown-post .flow-node{\n  padding:10px 16px;border:1px solid var(--line);\n  border-radius:6px;background:var(--bg-elev);\n  min-width:120px;text-align:center;\n  color:var(--text);\n}\n.eop-lockdown-post .flow-node.bad{\n  border-color:var(--danger);color:var(--danger);\n  background:rgba(185,28,28,0.06);\n}\n.eop-lockdown-post .flow-node.good{\n  border-color:var(--ok);color:var(--ok);\n  background:rgba(21,128,61,0.06);\n}\n.eop-lockdown-post .flow-node.gateway{\n  border-color:var(--info);color:var(--info);\n  background:rgba(29,78,216,0.06);\n}\n.eop-lockdown-post .flow-arrow{color:var(--text-dim);font-size:18px}\n.eop-lockdown-post .flow-arrow.bad{color:var(--danger)}\n.eop-lockdown-post .flow-arrow.good{color:var(--ok)}\n.eop-lockdown-post .flow-label{\n  font-size:10px;color:var(--text-dim);\n  text-transform:uppercase;letter-spacing:1px;\n  margin-top:-6px;margin-bottom:14px;padding-left:8px;\n}<\/p>\n<p>\/* \u2500\u2500\u2500 Tables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post table{\n  width:100%;border-collapse:collapse;\n  margin:22px 0;font-size:14px;\n  border:1px solid var(--line);border-radius:8px;\n  overflow:hidden;\n}\n.eop-lockdown-post th{\n  background:var(--bg-soft);\n  text-align:left;padding:11px 16px;\n  font-family:'JetBrains Mono', monospace;\n  font-size:11px;text-transform:uppercase;\n  letter-spacing:1px;color:var(--text-soft);\n  font-weight:600;\n  border-bottom:1px solid var(--line);\n}\n.eop-lockdown-post td{\n  padding:13px 16px;\n  border-bottom:1px solid var(--line-soft);\n  color:var(--text-soft);vertical-align:top;\n}\n.eop-lockdown-post tr:last-child td{border-bottom:none}\n.eop-lockdown-post td code{font-size:12px}<\/p>\n<p>\/* \u2500\u2500\u2500 Step list \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .steps{\n  counter-reset:step;list-style:none;margin-left:0;\n}\n.eop-lockdown-post .steps > li{\n  counter-increment:step;\n  padding-left:54px;position:relative;\n  margin-bottom:24px;padding-bottom:6px;\n  min-height:40px;\n}\n.eop-lockdown-post .steps > li::before{\n  content:counter(step, decimal-leading-zero);\n  position:absolute;left:0;top:-2px;\n  font-family:'JetBrains Mono', monospace;\n  font-size:14px;font-weight:700;\n  color:var(--accent);\n  width:40px;height:40px;\n  display:flex;align-items:center;justify-content:center;\n  border:1.5px solid var(--accent);border-radius:50%;\n  background:rgba(194,65,12,0.05);\n}<\/p>\n<p>\/* \u2500\u2500\u2500 Checklist \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .checklist{\n  list-style:none;margin-left:0;padding-left:0;\n}\n.eop-lockdown-post .checklist li{\n  padding:13px 16px;border:1px solid var(--line-soft);\n  border-radius:6px;margin-bottom:8px;\n  display:flex;align-items:flex-start;gap:14px;\n  background:var(--bg-elev);\n}\n.eop-lockdown-post .checklist li::before{\n  content:\"\u2610\";font-family:'JetBrains Mono', monospace;\n  font-size:18px;color:var(--accent);\n  line-height:1.2;flex-shrink:0;\n}\n.eop-lockdown-post .checklist li strong{\n  display:block;margin-bottom:3px;color:var(--text);\n}\n.eop-lockdown-post .checklist li span{\n  color:var(--text-soft);font-size:14px;line-height:1.5;\n}<\/p>\n<p>\/* \u2500\u2500\u2500 Footer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n.eop-lockdown-post .post-footer{\n  margin-top:64px;padding-top:28px;\n  border-top:1px solid var(--line);\n  font-family:'JetBrains Mono', monospace;\n  font-size:12px;color:var(--text-dim);\n  display:flex;justify-content:space-between;\n  flex-wrap:wrap;gap:14px;\n}<\/p>\n<p>\/* \u2500\u2500\u2500 Responsive \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 *\/\n@media (max-width:700px){\n  .eop-lockdown-post{padding:32px 22px}\n  .eop-lockdown-post h1.title{font-size:30px}\n  .eop-lockdown-post section h2{font-size:24px}\n  .eop-lockdown-post pre{font-size:11px;padding:14px 16px}\n  .eop-lockdown-post .flow-row{font-size:11px}\n}\n<\/style>\n<article class=\"eop-lockdown-post\">\n<div class=\"hero\">\n    <span class=\"eyebrow\">Microsoft 365 \u00b7 Email Security<\/span><\/p>\n<p class=\"lead\">\n      A practical, step-by-step guide for tenants running a centralized mail flow with a third-party<br \/>\n      Secure Email Gateway (SEG) \u2014 and discovering that mail and spoofing attempts still slip in<br \/>\n      directly through Exchange Online Protection.\n    <\/p>\n<div class=\"stamps\">\n      <span class=\"stamp crit\">Security-relevant<\/span><br \/>\n      <span class=\"stamp\">Exchange Online<\/span><br \/>\n      <span class=\"stamp\">EOP \/ Defender<\/span><br \/>\n      <span class=\"stamp ok\">Production-ready<\/span>\n    <\/div>\n<\/p><\/div>\n<p>  <!-- \u2500\u2500\u2500 Section 1 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>The problem in a nutshell<\/h2>\n<p>\n      In a centralized mail flow setup, every inbound message is supposed to travel a single,<br \/>\n      well-defined path: the public MX record points at a third-party Secure Email Gateway<br \/>\n      (Mimecast, Proofpoint, Cisco IronPort, Barracuda, an on-premises Exchange edge \u2014 pick your<br \/>\n      flavor), the gateway scans and filters the message, and only then is it handed off to<br \/>\n      Exchange Online Protection through an authenticated connector.\n    <\/p>\n<p>\n      In the real world, things are messier. Many organizations notice \u2014 sometimes only after<br \/>\n      a successful phishing attempt \u2014 that mail is reaching mailboxes <strong>directly through<br \/>\n      EOP<\/strong>, completely bypassing the gateway that was supposed to be the first line of<br \/>\n      defense. Often these messages are spoofed, claiming to come from internal addresses such<br \/>\n      as <code>ceo@yourcompany.com<\/code>.\n    <\/p>\n<h3>The desired state<\/h3>\n<div class=\"flow-diagram\">\n<h4>Allowed mail flow<\/h4>\n<div class=\"flow-row\">\n<div class=\"flow-node\">Internet<\/div>\n<p>        <span class=\"flow-arrow good\">\u2192<\/span><\/p>\n<div class=\"flow-node gateway\">SEG \/ Gateway<\/div>\n<p>        <span class=\"flow-arrow good\">\u2192<\/span><\/p>\n<div class=\"flow-node\">EOP (via connector)<\/div>\n<p>        <span class=\"flow-arrow good\">\u2192<\/span><\/p>\n<div class=\"flow-node good\">Mailbox \u2713<\/div>\n<\/p><\/div>\n<h4 style=\"margin-top:24px\">Mail flow to be blocked<\/h4>\n<div class=\"flow-row\">\n<div class=\"flow-node\">Attacker<\/div>\n<p>        <span class=\"flow-arrow bad\">\u2a2f<\/span><\/p>\n<div class=\"flow-node bad\">tenant.mail.protection.outlook.com<\/div>\n<p>        <span class=\"flow-arrow bad\">\u2a2f<\/span><\/p>\n<div class=\"flow-node bad\">EOP direct<\/div>\n<\/p><\/div>\n<p class=\"flow-label\">Gateway bypass via direct SMTP connect to the EOP MX endpoint<\/p>\n<\/p><\/div>\n<p>What we want to achieve:<\/p>\n<ul>\n<li><strong>Block Direct Send<\/strong> \u2014 anonymous mail using your own domains, sent straight to EOP, must be rejected.<\/li>\n<li><strong>Restrict the inbound connector<\/strong> \u2014 only the SEG\u2019s IPs or TLS certificate may deliver mail.<\/li>\n<li><strong>Stop spoofing<\/strong> \u2014 strict SPF, DKIM and DMARC, plus EOP anti-spoofing in enforcement mode.<\/li>\n<li><strong>Stay auditable<\/strong> \u2014 message trace and Defender reports must show every bypass attempt.<\/li>\n<\/ul>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 2 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Why does EOP accept mail directly in the first place?<\/h2>\n<p>\n      Every Microsoft 365 tenant has a publicly resolvable MX endpoint of the form<br \/>\n      <code>&lt;tenant&gt;.mail.protection.outlook.com<\/code>. Regardless of where your MX record<br \/>\n      actually points, that endpoint is reachable from the internet and \u2014 by default \u2014<br \/>\n      <strong>accepts anonymous SMTP connections<\/strong> for any of your accepted domains.<br \/>\n      Microsoft calls this mechanism <em>Direct Send<\/em>.\n    <\/p>\n<p>\n      Direct Send is officially intended for printers, scanners, and legacy line-of-business<br \/>\n      apps that need to drop mail into internal mailboxes without authenticating. Convenient \u2014<br \/>\n      but it\u2019s also exactly the mechanism attackers exploit to bypass your gateway and impersonate<br \/>\n      internal senders.\n    <\/p>\n<div class=\"callout warn\">\n      <span class=\"lbl\">Important to understand<\/span><\/p>\n<p>\n        A centralized mail flow or an MX record pointing somewhere else does <strong>not<\/strong><br \/>\n        protect you against Direct Send. The MX record is just a DNS hint. Attackers can connect<br \/>\n        to the EOP endpoint directly at any time \u2014 unless you\u2019ve explicitly hardened the tenant.\n      <\/p>\n<\/p><\/div>\n<p>\n      The fix is multi-layered: the tenant-wide <code>RejectDirectSend<\/code> flag, a tightly<br \/>\n      restricted inbound connector, a transport rule as a safety net, and proper anti-spoofing<br \/>\n      configuration. We\u2019ll walk through each of them.\n    <\/p>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 3 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Prerequisites<\/h2>\n<h4>Permissions<\/h4>\n<ul>\n<li><strong>Organization Configuration<\/strong> (for <code>Set-OrganizationConfig<\/code>)<\/li>\n<li><strong>Exchange Administrator<\/strong> or <strong>Global Administrator<\/strong> (connectors and rules)<\/li>\n<li><strong>Security Administrator<\/strong> (Defender policies and anti-phishing)<\/li>\n<\/ul>\n<h4>Tooling<\/h4>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-comment\"># Install the Exchange Online module if you haven't already<\/span>\r\n<span class=\"ps-cmd\">Install-Module<\/span> <span class=\"ps-param\">-Name<\/span> ExchangeOnlineManagement <span class=\"ps-param\">-Scope<\/span> CurrentUser\r\n\r\n<span class=\"ps-comment\"># Connect<\/span>\r\n<span class=\"ps-cmd\">Connect-ExchangeOnline<\/span> <span class=\"ps-param\">-UserPrincipalName<\/span> <span class=\"ps-string\">admin@yourcompany.com<\/span><\/code><\/pre>\n<h4>Information to gather upfront<\/h4>\n<ul>\n<li>The full list of <strong>public IP addresses or ranges<\/strong> used by your SEG, including DR\/secondary regions.<\/li>\n<li>Optionally, the <strong>TLS certificate subject \/ SAN<\/strong> the SEG presents when delivering to EOP \u2014 preferred over IP binding.<\/li>\n<li>All accepted domains of the tenant: <code>Get-AcceptedDomain<\/code>.<\/li>\n<li>Document existing inbound connectors: <code>Get-InboundConnector | Format-List<\/code>.<\/li>\n<li>Current SPF, DKIM, and DMARC records for each sending domain.<\/li>\n<\/ul>\n<div class=\"callout\">\n      <span class=\"lbl\">Recommendation<\/span><\/p>\n<p>\n        Before changing anything, take a JSON or XML snapshot of the current state via<br \/>\n        <code>Get-OrganizationConfig<\/code>, <code>Get-InboundConnector<\/code>, and<br \/>\n        <code>Get-TransportRule<\/code>. It makes rollback trivial if something breaks.\n      <\/p>\n<\/p><\/div>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 4 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Step 1 \u2014 Enable Reject Direct Send<\/h2>\n<p>\n      The simplest and most powerful single switch is the tenant-wide<br \/>\n      <code>RejectDirectSend<\/code> flag. When it is enabled, EOP rejects <strong>any anonymous<br \/>\n      message whose P1 Mail-From address matches one of your accepted domains<\/strong>, unless<br \/>\n      it arrived authenticated through an inbound connector. The sender receives the NDR<br \/>\n      <code>550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization<br \/>\n      from unauthorized sources<\/code>.\n    <\/p>\n<ol class=\"steps\">\n<li>\n        <strong>Check the current state.<\/strong><\/p>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-cmd\">Get-OrganizationConfig<\/span> | <span class=\"ps-cmd\">Select-Object<\/span> Identity, RejectDirectSend<\/code><\/pre>\n<p>        On existing tenants the default is <code>False<\/code>. Microsoft has announced that new tenants will get <code>True<\/code> by default starting in 2026.\n      <\/li>\n<li>\n        <strong>Enable Reject Direct Send.<\/strong><\/p>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-cmd\">Set-OrganizationConfig<\/span> <span class=\"ps-param\">-RejectDirectSend<\/span> <span class=\"ps-var\">$true<\/span><\/code><\/pre>\n<p>        Propagation across all EOP servers takes up to 30 minutes.\n      <\/li>\n<li>\n        <strong>Verify.<\/strong><\/p>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-cmd\">Get-OrganizationConfig<\/span> | <span class=\"ps-cmd\">Format-List<\/span> RejectDirectSend\r\n<span class=\"ps-comment\"># Expected: True<\/span><\/code><\/pre>\n<\/li>\n<\/ol>\n<div class=\"callout warn\">\n      <span class=\"lbl\">Watch out \u2014 possible side effects<\/span><\/p>\n<p>\n        Before flipping the switch, identify any legitimate Direct Send sources in your environment:<br \/>\n        multifunction printers, ERP systems, monitoring tools, marketing platforms \u2014 anything that<br \/>\n        sends as one of your domains directly to EOP. Each of those needs a partner inbound connector<br \/>\n        beforehand, otherwise their delivery breaks the moment the flag is enabled.\n      <\/p>\n<p>\n        A useful starting point: review your domain\u2019s SPF record. Every entry there is a candidate<br \/>\n        for a dedicated connector.\n      <\/p>\n<\/p><\/div>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 5 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Step 2 \u2014 Restrict the inbound connector to SEG IPs or certificate<\/h2>\n<p>\n      <code>RejectDirectSend<\/code> only covers messages whose sender domain is one of your own<br \/>\n      accepted domains. Spoofed mail from <strong>foreign<\/strong> domains delivered straight to<br \/>\n      EOP would still be accepted. To close that gap, configure your <em>Partner<\/em> inbound<br \/>\n      connector so that EOP only accepts inbound mail from the SEG\u2019s IPs or matching TLS<br \/>\n      certificate.\n    <\/p>\n<h3>Option A \u2014 Configuration in the Exchange Admin Center<\/h3>\n<ol class=\"steps\">\n<li>\n        Open EAC at <code>https:\/\/admin.exchange.microsoft.com<\/code> \u2192<br \/>\n        <em>Mail flow<\/em> \u2192 <em>Connectors<\/em> \u2192 <em>Add a connector<\/em>.\n      <\/li>\n<li>\n        <strong>Define the connection:<\/strong><\/p>\n<ul>\n<li>Connection from: <em>Partner organization<\/em><\/li>\n<li>Connection to: <em>Office 365<\/em><\/li>\n<\/ul>\n<\/li>\n<li>\n        <strong>Authenticate the partner:<\/strong> prefer<br \/>\n        <em>\u201cBy verifying that the subject name on the certificate that the sending server uses to<br \/>\n        authenticate with Office 365 matches this domain name\u201d<\/em> and enter the certificate the<br \/>\n        SEG actually presents. As a fallback \u2014 when no TLS certificate is available \u2014<br \/>\n        <em>\u201cBy verifying that the IP address of the sending server matches one of the following<br \/>\n        IP addresses\u201d<\/em> with <strong>all<\/strong> of the SEG\u2019s outbound IPs.\n      <\/li>\n<li>\n        <strong>Enforce delivery rules:<\/strong><\/p>\n<ul>\n<li>&#x2705; <em>Reject email messages if they aren\u2019t sent over TLS<\/em><\/li>\n<li>&#x2705; <em>Reject email messages if they aren\u2019t sent from within this IP address range<\/em> (with the SEG IPs)<\/li>\n<\/ul>\n<\/li>\n<li>Save and enable the connector.<\/li>\n<\/ol>\n<h3>Option B \u2014 PowerShell (idempotent and auditable)<\/h3>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-comment\"># Example: SEG identifies itself via certificate (recommended)<\/span>\r\n<span class=\"ps-cmd\">New-InboundConnector<\/span> <span class=\"ps-param\">-Name<\/span> <span class=\"ps-string\">\"From Secure Email Gateway\"<\/span> `\r\n    <span class=\"ps-param\">-ConnectorType<\/span> Partner `\r\n    <span class=\"ps-param\">-SenderDomains<\/span> <span class=\"ps-string\">\"*\"<\/span> `\r\n    <span class=\"ps-param\">-RestrictDomainsToCertificate<\/span> <span class=\"ps-var\">$true<\/span> `\r\n    <span class=\"ps-param\">-TlsSenderCertificateName<\/span> <span class=\"ps-string\">\"*.mail-gateway.example.com\"<\/span> `\r\n    <span class=\"ps-param\">-RequireTls<\/span> <span class=\"ps-var\">$true<\/span> `\r\n    <span class=\"ps-param\">-Enabled<\/span> <span class=\"ps-var\">$true<\/span>\r\n\r\n<span class=\"ps-comment\"># Alternative: SEG identifies itself by IP range<\/span>\r\n<span class=\"ps-cmd\">New-InboundConnector<\/span> <span class=\"ps-param\">-Name<\/span> <span class=\"ps-string\">\"From SEG (IP-bound)\"<\/span> `\r\n    <span class=\"ps-param\">-ConnectorType<\/span> Partner `\r\n    <span class=\"ps-param\">-SenderDomains<\/span> <span class=\"ps-string\">\"*\"<\/span> `\r\n    <span class=\"ps-param\">-RestrictDomainsToIPAddresses<\/span> <span class=\"ps-var\">$true<\/span> `\r\n    <span class=\"ps-param\">-SenderIPAddresses<\/span> <span class=\"ps-string\">\"203.0.113.10\",\"203.0.113.11\",\"198.51.100.0\/28\"<\/span> `\r\n    <span class=\"ps-param\">-RequireTls<\/span> <span class=\"ps-var\">$true<\/span> `\r\n    <span class=\"ps-param\">-Enabled<\/span> <span class=\"ps-var\">$true<\/span><\/code><\/pre>\n<div class=\"callout\">\n      <span class=\"lbl\">What <code>RestrictDomainsTo*<\/code> actually does<\/span><\/p>\n<p>\n        With these flags set to <code>$true<\/code> EOP effectively tells the world:<br \/>\n        <em>\u201cMail addressed to my domains is only accepted when it arrives via IP X or certificate Y.\u201d<\/em><br \/>\n        Any other source receives <code>550 5.7.51 TenantInboundAttribution; There is a partner<br \/>\n        connector configured that matched the message\u2019s recipient domain<\/code> and is rejected.\n      <\/p>\n<\/p><\/div>\n<table>\n<thead>\n<tr>\n<th>Method<\/th>\n<th>Pros<\/th>\n<th>Cons<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>TLS certificate<\/strong><\/td>\n<td>Robust against IP changes, cryptographically verifiable<\/td>\n<td>Requires a valid third-party certificate at the SEG<\/td>\n<\/tr>\n<tr>\n<td><strong>IP range<\/strong><\/td>\n<td>Simple to set up<\/td>\n<td>Maintenance burden when IPs change, slightly weaker<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 6 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Step 3 \u2014 Add a transport rule as a safety net<\/h2>\n<p>\n      Beyond the connector, it\u2019s smart to add a transport rule as a second layer that rejects<br \/>\n      <strong>any<\/strong> external mail not arriving from your allowed IP range. It protects you<br \/>\n      against connector misconfiguration and produces a very clean audit trail in message trace.\n    <\/p>\n<h3>Configuration in the EAC<\/h3>\n<ol class=\"steps\">\n<li>EAC \u2192 <em>Mail flow<\/em> \u2192 <em>Rules<\/em> \u2192 <em>Add a rule<\/em> \u2192 <em>Create a new rule<\/em>.<\/li>\n<li><strong>Name:<\/strong> <code>BLOCK \u2013 Direct internet ingress without SEG<\/code><\/li>\n<li>\n        <strong>Apply this rule if\u2026<\/strong><\/p>\n<ul>\n<li>The sender \u2192 is external\/internal \u2192 <em>Outside the organization<\/em><\/li>\n<\/ul>\n<\/li>\n<li>\n        <strong>Do the following:<\/strong> <em>Block the message<\/em> \u2192<br \/>\n        <em>Reject the message and include an explanation<\/em> \u2192<br \/>\n        Reason: <em>\u201cMail to this organization must be delivered via the official Secure Email Gateway.<br \/>\n        Direct delivery to EOP is not permitted.\u201d<\/em>\n      <\/li>\n<li>\n        <strong>Except if:<\/strong><\/p>\n<ul>\n<li>The sender \u2192 IP address is in any of these ranges \u2192 <strong>your SEG IPs<\/strong><\/li>\n<li><em>or<\/em> The message headers \u2192 includes any of these words \u2192 header<br \/>\n            <code>X-MS-Exchange-Organization-AuthAs<\/code> with value <code>Internal<\/code><br \/>\n            (prevents breaking internal hybrid mail flow)<\/li>\n<\/ul>\n<\/li>\n<li><strong>Rule mode:<\/strong> start in <em>Test with policy tips<\/em>, then switch to <em>Enforce<\/em> after validation.<\/li>\n<\/ol>\n<h3>PowerShell variant<\/h3>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-cmd\">New-TransportRule<\/span> <span class=\"ps-param\">-Name<\/span> <span class=\"ps-string\">\"BLOCK - Direct EOP Ingress (Bypass SEG)\"<\/span> `\r\n    <span class=\"ps-param\">-FromScope<\/span> NotInOrganization `\r\n    <span class=\"ps-param\">-ExceptIfSenderIPRanges<\/span> <span class=\"ps-string\">\"203.0.113.10\",\"203.0.113.11\",\"198.51.100.0\/28\"<\/span> `\r\n    <span class=\"ps-param\">-ExceptIfHeaderMatchesMessageHeader<\/span> <span class=\"ps-string\">\"X-MS-Exchange-Organization-AuthAs\"<\/span> `\r\n    <span class=\"ps-param\">-ExceptIfHeaderMatchesPatterns<\/span> <span class=\"ps-string\">\"Internal\"<\/span> `\r\n    <span class=\"ps-param\">-RejectMessageEnhancedStatusCode<\/span> <span class=\"ps-string\">\"5.7.1\"<\/span> `\r\n    <span class=\"ps-param\">-RejectMessageReasonText<\/span> <span class=\"ps-string\">\"Mail not delivered via SEG.\"<\/span> `\r\n    <span class=\"ps-param\">-Mode<\/span> AuditAndNotify `\r\n    <span class=\"ps-param\">-Enabled<\/span> <span class=\"ps-var\">$true<\/span><\/code><\/pre>\n<div class=\"callout warn\">\n      <span class=\"lbl\">Mind the rule order<\/span><\/p>\n<p>\n        Place this rule <strong>before<\/strong> any bypass or allow-list rules (lower priority value).<br \/>\n        Otherwise an upstream rule may silently override your block. Starting in<br \/>\n        <code>AuditAndNotify<\/code> mode gives you a safe pilot phase before flipping to<br \/>\n        <code>Enforce<\/code>.\n      <\/p>\n<\/p><\/div>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 7 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Step 4 \u2014 Anti-spoofing and DMARC<\/h2>\n<p>\n      The previous steps lock down the transport path. Spoofing attempts that travel correctly<br \/>\n      through the SEG (because an attacker hijacked some other domain or abused an open relay)<br \/>\n      still need to be caught by authentication checks.\n    <\/p>\n<h3>4.1 SPF, DKIM and DMARC for your domains<\/h3>\n<ul>\n<li><strong>SPF:<\/strong> hard fail (<code>-all<\/code>), only your SEG egress IPs and legitimate cloud senders (e.g. <code>spf.protection.outlook.com<\/code>).<\/li>\n<li><strong>DKIM:<\/strong> enable signing for every sending domain in the Defender portal under<br \/>\n        <em>Email &amp; collaboration<\/em> \u2192 <em>Policies<\/em> \u2192 <em>Email authentication settings<\/em> \u2192 <em>DKIM<\/em>.<\/li>\n<li><strong>DMARC:<\/strong> at minimum <code>p=quarantine<\/code>, target <code>p=reject<\/code> with<br \/>\n        <code>rua=mailto:dmarc-reports@yourcompany.com<\/code>. Use a DMARC reporting service<br \/>\n        (dmarcian, Valimail, Postmark, etc.) to make the RUA\/RUF data actionable.<\/li>\n<\/ul>\n<pre data-label=\"DNS (example)\"><code><span class=\"ps-comment\"># SPF record<\/span>\r\nyourcompany.com.   IN TXT \"v=spf1 ip4:203.0.113.10 ip4:203.0.113.11 include:spf.protection.outlook.com -all\"\r\n\r\n<span class=\"ps-comment\"># DMARC record<\/span>\r\n_dmarc.yourcompany.com.  IN TXT \"v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com; ruf=mailto:dmarc@yourcompany.com; fo=1; adkim=s; aspf=s\"<\/code><\/pre>\n<h3>4.2 Anti-phishing policy (Defender for Office 365)<\/h3>\n<p>\n      In the Defender portal under <em>Email &amp; collaboration<\/em> \u2192 <em>Policies &amp; rules<\/em><br \/>\n      \u2192 <em>Threat policies<\/em> \u2192 <em>Anti-phishing<\/em>, harden the default policy or create a<br \/>\n      dedicated one for high-value recipients:\n    <\/p>\n<ul>\n<li><strong>Spoof intelligence:<\/strong> Enabled<\/li>\n<li><strong>Honor DMARC policy:<\/strong> Enabled (so messages with <code>p=reject<\/code> are actually rejected)<\/li>\n<li><strong>Action for unauthenticated senders:<\/strong> <em>Quarantine<\/em><\/li>\n<li><strong>Impersonation protection:<\/strong> explicitly cover sensitive mailboxes (CEO, finance, HR)<\/li>\n<li><strong>Mailbox intelligence:<\/strong> Enabled<\/li>\n<\/ul>\n<h3>4.3 Anti-spam policy<\/h3>\n<ul>\n<li><strong>Bulk Complaint Level (BCL) threshold:<\/strong> 6 or lower<\/li>\n<li><strong>Spam action:<\/strong> <em>Quarantine<\/em><\/li>\n<li><strong>High-confidence phish action:<\/strong> <em>Quarantine<\/em><\/li>\n<li>Avoid allow lists \u2014 they\u2019re a frequent root cause of spoofing slip-throughs.<\/li>\n<\/ul>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 8 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Step 5 \u2014 Enhanced Filtering for Connectors<\/h2>\n<p>\n      Because the SEG overwrites the original sender IP, EOP would normally evaluate SPF against<br \/>\n      the SEG\u2019s IP rather than the actual sender \u2014 meaning every phishing attempt passes SPF<br \/>\n      effortlessly. <strong>Enhanced Filtering for Connectors<\/strong> (also known as skip listing)<br \/>\n      fixes this by telling EOP to look further back in the Received header chain to find the real<br \/>\n      sender IP.\n    <\/p>\n<ol class=\"steps\">\n<li>Open the Defender portal at <code>https:\/\/security.microsoft.com\/skiplisting<\/code><br \/>\n        (or <em>Email &amp; collaboration<\/em> \u2192 <em>Policies &amp; rules<\/em> \u2192 <em>Enhanced filtering<\/em>).<\/li>\n<li>Select the inbound connector you created in Step 2.<\/li>\n<li>Choose <strong>Skip these IP addresses that are associated with the connector<\/strong><br \/>\n        and add <strong>all<\/strong> public IPs of the SEG (including any intermediate hops).<\/li>\n<li><strong>Apply to entire organization<\/strong> after a small pilot phase with a few mailboxes.<\/li>\n<\/ol>\n<div class=\"callout crit\">\n      <span class=\"lbl\">Don\u2019t do this<\/span><\/p>\n<p>\n        Do not add on-premises hybrid server IPs to the skip list when your MX points to EOP.<br \/>\n        Microsoft does not support this in a centralized mail flow scenario; it can lead to<br \/>\n        false positives in spam scoring.\n      <\/p>\n<\/p><\/div>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Verification &amp; testing<\/h2>\n<h3>Test 1 \u2014 Direct Send from an external host<\/h3>\n<p>From an external system, attempt a direct SMTP delivery to the EOP endpoint:<\/p>\n<pre data-label=\"PowerShell (external)\"><code><span class=\"ps-cmd\">Send-MailMessage<\/span> `\r\n    <span class=\"ps-param\">-From<\/span> <span class=\"ps-string\">\"ceo@yourcompany.com\"<\/span> `\r\n    <span class=\"ps-param\">-To<\/span> <span class=\"ps-string\">\"recipient@yourcompany.com\"<\/span> `\r\n    <span class=\"ps-param\">-Subject<\/span> <span class=\"ps-string\">\"Direct Send Test\"<\/span> `\r\n    <span class=\"ps-param\">-Body<\/span> <span class=\"ps-string\">\"Testing the Reject Direct Send flag\"<\/span> `\r\n    <span class=\"ps-param\">-SmtpServer<\/span> <span class=\"ps-string\">\"yourcompany-com.mail.protection.outlook.com\"<\/span> `\r\n    <span class=\"ps-param\">-Port<\/span> 25<\/code><\/pre>\n<p><strong>Expected result:<\/strong><\/p>\n<pre data-label=\"SMTP response\"><code>550 5.7.68 TenantInboundAttribution;\r\nDirect Send not allowed for this organization from unauthorized sources<\/code><\/pre>\n<h3>Test 2 \u2014 Spoof from a foreign domain bypassing the SEG<\/h3>\n<p>External test using a foreign sender domain (e.g. <code>fake@gmail.com<\/code>) directly to the EOP endpoint:<\/p>\n<p><strong>Expected result:<\/strong><\/p>\n<pre data-label=\"SMTP response\"><code>550 5.7.51 TenantInboundAttribution;\r\nThere is a partner connector configured that matched the message's recipient domain<\/code><\/pre>\n<h3>Test 3 \u2014 Legitimate mail through the SEG<\/h3>\n<p>\n      Send an external test message from Gmail or Outlook.com to an internal recipient. In message<br \/>\n      trace, verify that the mail arrived from the SEG IP, was accepted by the inbound connector,<br \/>\n      and delivered correctly.\n    <\/p>\n<pre data-label=\"PowerShell\"><code><span class=\"ps-cmd\">Get-MessageTrace<\/span> <span class=\"ps-param\">-RecipientAddress<\/span> <span class=\"ps-string\">\"recipient@yourcompany.com\"<\/span> <span class=\"ps-param\">-StartDate<\/span> (<span class=\"ps-cmd\">Get-Date<\/span>).AddHours(-1) <span class=\"ps-param\">-EndDate<\/span> (<span class=\"ps-cmd\">Get-Date<\/span>) |\r\n    <span class=\"ps-cmd\">Select-Object<\/span> Received, SenderAddress, FromIP, Status, Subject<\/code><\/pre>\n<h3>Test 4 \u2014 Header analysis<\/h3>\n<p>\n      Inspect a delivered message via <em>File \u2192 Properties<\/em> in Outlook or paste the headers<br \/>\n      into the <a href=\"https:\/\/mha.azurewebsites.net\" target=\"_blank\" rel=\"noopener\">Message Header Analyzer<\/a>.<br \/>\n      The following headers confirm a healthy configuration:\n    <\/p>\n<ul>\n<li><code>Authentication-Results-Original<\/code> shows SPF pass against the <strong>real<\/strong> sender IP \u2014 not the SEG IP.<\/li>\n<li>The <code>Received<\/code> chain shows the SEG as the last hop before EOP.<\/li>\n<li><code>X-MS-Exchange-SkipListedInternetSender<\/code> is set, indicating Enhanced Filtering is working.<\/li>\n<\/ul>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 10 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Monitoring &amp; reporting<\/h2>\n<h3>Daily \/ weekly<\/h3>\n<ul>\n<li><strong>Message trace:<\/strong> filter on status <em>Failed<\/em> with reason <code>5.7.68<\/code> or <code>5.7.51<\/code> \u2014 every hit is a blocked bypass attempt.<\/li>\n<li><strong>Defender \u2192 Reports \u2192 Mailflow:<\/strong> <em>Threat protection status<\/em> and <em>Spoof detections<\/em>.<\/li>\n<li><strong>Transport rule reports:<\/strong> <em>Mail flow<\/em> \u2192 <em>Reports<\/em> \u2192 <em>Mail flow rule matches<\/em> \u2014 your safety-net rule from Step 3.<\/li>\n<li><strong>DMARC aggregate reports:<\/strong> review RUA reports \u2014 every unknown source is a signal worth investigating.<\/li>\n<\/ul>\n<h3>Useful KQL queries (Defender for Office 365 hunting)<\/h3>\n<pre data-label=\"KQL\"><code><span class=\"ps-comment\">\/\/ Direct Send attempts in the last 7 days<\/span>\r\nEmailEvents\r\n| where Timestamp &gt; ago(7d)\r\n| where DeliveryAction == \"Blocked\"\r\n| where DeliveryLocation == \"Failed\"\r\n| where AdditionalFields has \"5.7.68\"\r\n| project Timestamp, SenderFromAddress, RecipientEmailAddress, SenderIPv4, Subject\r\n\r\n<span class=\"ps-comment\">\/\/ Mail that did NOT arrive from your SEG IPs<\/span>\r\nEmailEvents\r\n| where Timestamp &gt; ago(1d)\r\n| where SenderIPv4 !in (\"203.0.113.10\",\"203.0.113.11\")\r\n| where EmailDirection == \"Inbound\"\r\n| summarize count() by SenderIPv4, SenderFromDomain<\/code><\/pre>\n<h3>Alerting<\/h3>\n<ul>\n<li>Defender alert policy on <em>Mail flow rule match<\/em> for the safety-net rule.<\/li>\n<li>SIEM forwarding (Sentinel, Splunk, etc.) of the EmailEvents table.<\/li>\n<li>A weekly review report sent to the security team.<\/li>\n<\/ul>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 11 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Rollback plan<\/h2>\n<p>\n      If business-critical mail flows break after activation, the commands below let you revert<br \/>\n      quickly. The rollback order is the reverse of the activation order.\n    <\/p>\n<pre data-label=\"PowerShell \u2014 rollback\"><code><span class=\"ps-comment\"># 1. Disable the transport rule<\/span>\r\n<span class=\"ps-cmd\">Disable-TransportRule<\/span> <span class=\"ps-param\">-Identity<\/span> <span class=\"ps-string\">\"BLOCK - Direct EOP Ingress (Bypass SEG)\"<\/span>\r\n\r\n<span class=\"ps-comment\"># 2. Loosen the inbound connector (drop IP binding)<\/span>\r\n<span class=\"ps-cmd\">Set-InboundConnector<\/span> <span class=\"ps-param\">-Identity<\/span> <span class=\"ps-string\">\"From Secure Email Gateway\"<\/span> `\r\n    <span class=\"ps-param\">-RestrictDomainsToIPAddresses<\/span> <span class=\"ps-var\">$false<\/span>\r\n\r\n<span class=\"ps-comment\"># 3. Disable Reject Direct Send<\/span>\r\n<span class=\"ps-cmd\">Set-OrganizationConfig<\/span> <span class=\"ps-param\">-RejectDirectSend<\/span> <span class=\"ps-var\">$false<\/span>\r\n\r\n<span class=\"ps-comment\"># Confirm<\/span>\r\n<span class=\"ps-cmd\">Get-OrganizationConfig<\/span> | <span class=\"ps-cmd\">Format-List<\/span> RejectDirectSend<\/code><\/pre>\n<div class=\"callout ok\">\n      <span class=\"lbl\">Recommended rollout phases<\/span><\/p>\n<p>\n        1) Enable the transport rule in <em>audit mode<\/em> (one week of observation) \u2192<br \/>\n        2) Harden the inbound connector (one to two days of observation) \u2192<br \/>\n        3) Enable <code>RejectDirectSend<\/code> \u2192<br \/>\n        4) Switch the transport rule to <em>Enforce<\/em>. Each step is small and quickly reversible.\n      <\/p>\n<\/p><\/div>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 12 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>Final checklist<\/h2>\n<ul class=\"checklist\">\n<li>\n<div><strong>Direct Send sources inventoried<\/strong><span>SPF analyzed, every printer \/ app \/ cloud service sending as your domain documented<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Configuration backup taken<\/strong><span>Get-OrganizationConfig, Get-InboundConnector, Get-TransportRule exported<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Inbound connector with IP\/cert binding active<\/strong><span>RestrictDomainsToIPAddresses or RestrictDomainsToCertificate set to $true<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Reject Direct Send enabled<\/strong><span>Set-OrganizationConfig -RejectDirectSend $true applied and propagated<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Transport rule (safety net) active<\/strong><span>Reject rule for non-SEG IPs in enforce mode, correctly prioritized<\/span><\/div>\n<\/li>\n<li>\n<div><strong>SPF \/ DKIM \/ DMARC enforced<\/strong><span>SPF -all, DKIM signing for all sending domains, DMARC at least p=quarantine<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Anti-phishing policy hardened<\/strong><span>Spoof intelligence + Honor DMARC + quarantine for unauthenticated senders<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Enhanced filtering configured<\/strong><span>Skip listing of SEG IPs at the inbound connector enabled<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Tests performed<\/strong><span>Direct Send blocked (550 5.7.68), legitimate mail via SEG delivered, headers correct<\/span><\/div>\n<\/li>\n<li>\n<div><strong>Monitoring in place<\/strong><span>Message trace reviews, KQL hunting, DMARC reporting, alerting<\/span><\/div>\n<\/li>\n<\/ul>\n<\/section>\n<p>  <!-- \u2500\u2500\u2500 Section 13 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 --><\/p>\n<section>\n<h2>References &amp; further reading<\/h2>\n<ul>\n<li>Microsoft Learn \u2014 <a href=\"https:\/\/learn.microsoft.com\/en-us\/exchange\/transport-routing\" target=\"_blank\" rel=\"noopener\">Email routing in Exchange hybrid deployments<\/a><\/li>\n<li>Microsoft Learn \u2014 <a href=\"https:\/\/learn.microsoft.com\/en-us\/exchange\/mail-flow-best-practices\/use-connectors-to-configure-mail-flow\/enhanced-filtering-for-connectors\" target=\"_blank\" rel=\"noopener\">Enhanced Filtering for Connectors<\/a><\/li>\n<li>Microsoft Learn \u2014 <a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-office-365\/connection-filter-policies-configure\" target=\"_blank\" rel=\"noopener\">Configure the default connection filter policy<\/a><\/li>\n<li>Microsoft Tech Community \u2014 <a href=\"https:\/\/techcommunity.microsoft.com\/blog\/exchange\/introducing-more-control-over-direct-send-in-exchange-online\/4408790\" target=\"_blank\" rel=\"noopener\">Introducing more control over Direct Send<\/a><\/li>\n<li>Microsoft Learn \u2014 <a href=\"https:\/\/learn.microsoft.com\/en-us\/exchange\/security-and-compliance\/mail-flow-rules\/mail-flow-rules\" target=\"_blank\" rel=\"noopener\">Mail flow rules in Exchange Online<\/a><\/li>\n<li>Defender portal \u2014 <code>https:\/\/security.microsoft.com\/skiplisting<\/code><\/li>\n<li>Exchange Admin Center \u2014 <code>https:\/\/admin.exchange.microsoft.com<\/code><\/li>\n<\/ul>\n<\/section>\n<div class=\"post-footer\">\n<div>EOP Lockdown Guide \u00b7 Centralized Mail Flow Hardening<\/div>\n<div>Rev. 1.0 \u00b7 2026<\/div>\n<\/p><\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft 365 \u00b7 Email Security A practical, step-by-step guide for tenants running a centralized mail flow with a third-party Secure Email Gateway (SEG) \u2014 and discovering that mail and spoofing attempts still slip in directly through Exchange Online Protection. Security-relevant Exchange Online EOP \/ Defender Production-ready The problem in a nutshell In a centralized mail [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6166,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1923,2],"tags":[],"class_list":["post-6164","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-365","category-exchange"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6164"}],"version-history":[{"count":1,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6164\/revisions"}],"predecessor-version":[{"id":6165,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/6164\/revisions\/6165"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/media\/6166"}],"wp:attachment":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}