Block internet inbound mails via EOP in Exchange hybrid-mode with centralized mail transport

HaileSelassie 21 Reputation points
2020-07-31T12:17:23.373+00:00

I have setup Exchange hybrid mode with option centralized mail transport, so all internet inbound and outbound mail is routed via the on-premises 3rd party Antispam/SMTP appliances.

In order to ensure no mail from the Internet can bypass the on-premises 3rd party Antispam/SMTP appliances, I would like to configure a restriction, so that no e-mail from internet can be delivered via the EOP/Exchange online infrastructure.

I am thinking of the following approach: Create a new inbound connector with the following configuration:

From: Partner Organization
To: Office365
Identify Partner Organisation: Use the sender's IP address
SenderIPAddresses : {Exchange On-premises external IPs, other company IPs required}
SenderDomains : {smtp:wildcard;1}
RestrictDomainsToIPAddresses : True

Now the question i have is: Is this the correct approach or does this new inbound connector with "ConnectorType : Partner" interfere with the inbound connector created by the hybrid configuration ("ConnectorType : OnPremises") and used to receive mails from on-premises Exchange?

Thanks for your feedback in advance. Cheers
HaileSelassie

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,222 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,373 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,905 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 142.6K Reputation points MVP
    2020-08-02T11:51:00.15+00:00

    You can do that and it won't affect the other inbound connector because its Connector Type is "OnPremises"

    See:
    https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud

    If you already have an OnPremises inbound connector for the same certificate or sender IP addresses, you still need to create the Partner inbound connector (the RestrictDomainsToCertificate and RestrictDomainsToIPAddresses parameters are only applied to Partner connectors). The two connectors can coexist without problems.

    0 comments
  2. Lydia Zhou - MSFT 2,371 Reputation points Microsoft Employee
    2020-08-03T07:42:46.52+00:00

    In general, since centralized mail transport is enabled, EOP routes inbound messages to on-premises Exchange server. It's no need to create additional connectors in Exchange Online.

    If you want to lock down your Exchange Online organization to only accept mail from on-premises, you only have to set on-premises or the application IPs for SenderIPAddresses. Why you want to add other company IPs?