How To Break The Intra Company Filters

Skip to principal content

Enhanced Filtering for Connectors in Substitution Online

Article
03/18/2022
8 minutes to read

Properly configured entering connectors are a trusted source of incoming mail to Microsoft 365 or Office 365. But in circuitous routing scenarios where email for your Microsoft 365 or Part 365 domain is routed somewhere else first, the source of the inbound connector is typically not the true indicator of where the message came from. Circuitous routing scenarios include:

Third-party cloud filtering services
Managed filtering appliances
Hybrid environments (for example, on-bounds Substitution)

Mail routing in complex scenarios looks like this:

Mail flow diagram for complex routing scenarios.

Every bit y'all can see, the message adopts the source IP of the service, appliance, or on-bounds Substitution organization that sits in front of Microsoft 365. The bulletin arrives in Microsoft 365 with a dissimilar source IP address. This behavior isn't a limitation of Microsoft 365; information technology'southward simply how SMTP works.

In these scenarios, you can yet get the most out of Exchange Online Protection (EOP) and Microsoft Defender for Office 365 by using Enhanced Filtering for Connectors (also known as skip list).

After you enable Enhanced Filtering for Connectors, mail routing in complex routing scenarios looks like this:

Mail flow diagram for complex routing scenarios after Enhance Filtering for Connectors is enabled.

As you can meet, Enhanced Filtering for connectors allows IP address and sender information to be preserved, which has the post-obit benefits:

Improved accuracy for the Microsoft filtering stack and machine learning models, which include:
- Heuristic clustering
- Anti-spoofing
- Anti-phishing
Better post-breach capabilities in Automated investigation and response (AIR)
Able to employ explicit email authentication (SPF, DKIM, and DMARC) to verify the reputation of the sending domain for impersonation and spoof detection. For more than data about explicit and implicit email authentication, encounter Email authentication in EOP.

For more information, see the What happens when you enable Enhanced Filtering for Connectors? section later in this commodity.

Utilise the procedures in this commodity to enable Enhanced Filtering for Connectors on private connectors. For more than data about connectors in Exchange Online, see Configure mail service flow using connectors.

Note

We ever recommend that you betoken your MX record to Microsoft 365 or Office 365 in order to reduce complexity. For example, some hosts might invalidate DKIM signatures, causing false positives. When two systems are responsible for email protection, determining which one acted on the message is more complicated.
The most mutual scenarios that Enhanced Filtering is designed for are Hybrid environments; however, the post destined for on-premises mailboxes (outbound mail) will still not be filtered by EOP. The just style to become total EOP scanning on all mailboxes is to move your MX tape to Microsoft 365 or Office 365.
Adding your on-prem hybrid server IPs to the enhanced filter skip list is not supported in a centralized post menstruation scenario. Doing this can cause EOP to scan your on-premise hybrid server emails, calculation a compauth header value, and may consequence in EOP flagging the bulletin as spam. In a configured hybrid environs, there is no need to add them to skip listing. The skip list is primarily intended to address scenarios where there is a third party device/filter before your Microsoft 365 tenant. For more information, encounter MX tape points to third-party spam filtering.
Do non put another scanning service or host subsequently EOP. Once EOP scans a message, be careful not to break the chain of trust by routing mail through whatever non-Exchange server that is not office of your deject or on-premises organization. When the message eventually arrives at the destination mailbox, the headers from the first scanning verdict might no longer be accurate. Centralized Mail Transport should not be used to introduce non-Exchange servers into the mail service flow path.

Configure Enhanced Filtering for Connectors

What do you lot need to know before you begin?

Include all of the trusted IP addresses that are associated with the on-premises hosts or the third-political party filters that transport email into your Microsoft 365 or Part 365 organization, including whatever intermediate hops with public IP addresses. To go these IP addresses, consult the documentation or support that's provided with the service.
If you lot have mail flow rules (also known every bit transport rules) that fix the SCL to -i for messages that flow through this connector, you must disable those mail flow rules later on yous enable Enhanced Filtering for Connectors.
To open the Microsoft 365 Defender portal, get to https://security.microsoft.com. To get directly to the Enhanced Filtering for Connectors page, apply https://security.microsoft.com/skiplisting.
To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell. To connect to Substitution Online Protection PowerShell, run into Connect to Commutation Online Protection PowerShell.
To configure Enhanced Filtering for Connectors, you need to exist a member of one of the following role groups:
- Organization Direction or Security Ambassador in the Microsoft 365 Defender portal.
- Organisation Management in Exchange Online.
Enhanced Filtering for Connectors is non supported in hybrid environments that utilise Centralized Mail service Transport.

Utilise the Microsoft 365 Defender portal to configure Enhanced Filtering for Connectors on an inbound connector

In the Microsoft 365 Defender portal, get to Email & Collaboration > Policies & Rules > Threat policies folio > Rules section > Enhanced filtering.
On the Enhanced Filtering for Connectors page, select the entering connector that y'all want to configure by clicking on the proper name.
In the connector details flyout that appears, configure the following settings:
- IP addresses to skip: Choose one of the following values:
  - Disable Enhanced Filtering for Connectors: Turn off Enhanced Filtering for Connectors on the connector.
  - Automatically find and skip the last IP address: We recommend this value if you have to skip merely the last bulletin source.
  - Skip these IP addresses that are associated with the connector: Select this value to configure a list of IP addresses to skip.
    Important
    - Entering the IP addresses of Microsoft 365 or Part 365 is not supported. Do not use this feature to compensate for issues introduced by unsupported e-mail routing paths. Use caution and limit the IP ranges to simply the email systems that will handle your ain organisation's messages prior to Microsoft 365 or Office 365.
    - Entering any private IP address divers by RFC 1918 (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) is non supported. Enhanced Filtering automatically detects and skips private IP addresses. If the previous hop is an e-mail server that's backside a network accost translation (NAT) device that assigns private IP addresses, we recommend that y'all configure NAT to assign a public IP address to the email server.
- If you lot selected Automatically detect and skip the last IP address or Skip these IP addresses that are associated with the connector, the Utilise to these users section appears:
  - Apply to entire organization: We recommend this value subsequently you've tested the feature on a small number of recipients starting time.
  - Apply to a small set of users: Select this value to configure a list of recipient email addresses that Enhanced Filtering for Connectors applies to. Nosotros recommend this value as an initial test of the feature.
    Note
    - This value is merely melancholia on the actual email addresses that yous specify. For example, if a user has five email addresses associated with their mailbox (also known as proxy addresses), you'll need to specify all five of their email addresses hither. Otherwise, messages that are sent to the iv other email addresses will go through normal filtering.
    - In hybrid environments where entering mail flows through on-premises Exchange, y'all must specify the targetAddress of the MailUser object. For instance, michelle@contoso.mail.onmicrosoft.com.
    - This value is but affective on messages where all recipients are specified here. If a message contains whatever recipients that aren't specified hither, normal filtering is applied to all recipients of the message.
  - Apply to entire organization: We recommend this value after you lot've tested the feature on a few recipients beginning.
When you're finished, click Save.

Use Exchange Online PowerShell or Exchange Online Protection PowerShell to configure Enhanced Filtering for Connectors on an inbound connector

To configure Enhanced Filtering for Connectors on an entering connector, utilise the following syntax:

              Ready-InboundConnector -Identity <ConnectorIdentity> [-EFSkipLastIP <$true | $simulated>] [-EFSkipIPs <IPAddresses>] [-EFUsers "emailaddress1","emailaddress2",..."emailaddressN"]

EFSkipLastIP: Valid values are:
- $true: Only the last message source is skipped.
- $false: Skip the IP addresses specified by the EFSkipIPs parameter. If no IP addresses are specified in that location, Enhanced Filtering for Connectors is disabled on the inbound connector. The default value is $false.
EFSkipIPs: The specific IP addresses to skip when the EFSkipLastIP parameter value is $simulated. Valid values are:
- A single IP accost: For example, 192.168.one.1.
- An IP accost range: For example, 192.168.1.0-192.168.i.31.
- Classless Inter-Domain Routing (CIDR) IP: For example, 192.168.1.0/25.
See the Skip these IP addresses that are associated with the connector description in the previous section for limitations on IP addresses.
EFUsers: The comma-separated e-mail address of recipient electronic mail addresses that you lot desire to apply Enhanced Filtering for Connectors to. See the Apply to a small set of users description in the previous section for limitations on individual recipients. The default value is blank ($null), which means Enhanced Filtering for Connectors is applied to all recipients.

This example configures the inbound connector named From Anti-Spam Service with the post-obit settings:

Enhanced Filtering for Connectors is enabled on the connector, and the IP address of the last message source is skipped.
Enhanced Filtering for Connectors only applies to the recipient email addresses michelle@contoso.com, laura@contoso.com, and julia@contoso.com.

              Gear up-InboundConnector -Identity "From Anti-Spam Service" -EFSkipLastIP $true -EFUsers "michelle@contoso.com","laura@contoso.com","julia@contoso.com"

Note: To disable Enhanced Filtering for Connectors, use the value $false for the EFSkipLastIP parameter.

For detailed syntax and parameter information, come across Set-InboundConnector.

What happens when you lot enable Enhanced Filtering for Connectors?

The following tabular array describes what connections expect similar before and after you enable Enhanced Filtering for Connectors:

Feature	Earlier Enhanced Filtering is enabled	After Enhanced Filtering is enabled
E-mail domain authentication	Implicit using anti-spoof protection technology.	Explicit, based on the source domain's SPF, DKIM, and DMARC records in DNS.
X-MS-Commutation-ExternalOriginalInternetSender	Not bachelor	This header is stamped if skip listing was successful, enabled on the connector, and recipient match happens. The value of this field contains information near the true source address.
X-MS-Exchange-SkipListedInternetSender	Not available	This header is stamped if skip listing was successful and enabled on the connector. The value of this field contains information nearly the true source address. This header is used primarily for reporting purposes and to help understand WhatIf scenarios.

You tin can view the improvements in filtering and reporting past using the Threat protection condition report in the Microsoft 365 Defender portal. For more than information, encounter Threat protection status study.

Feedback

Submit and view feedback for