Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used

Description

Enhanced email filtering can be set up if you have a connector in 365 (3rd party email filtering service or hybrid configuration) and your MX record does not point to Microsoft 365 or Office 365. This new feature allows you to filter email based on the actual source of messages that arrive over the connector. This is also known as skip listing and this feature will allow you to overlook, or skip, any IP addresses that are considered internal to you in order to get the last known external IP address, which should be the actual source IP address.

If you are using Defender for Office 365, this will enhance its machine learning capabilities and security around safe links/safe attachments/anti-spoofing from Microsoft’s known malicious list based off IP. In a way, you are getting a secondary layer of protection by allowing Microsoft to view the IPs of the original email and check against their database.

Policy

Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used

Licensing Considerations

Exchange Online Protection

Set Up Instructions

Enhanced filtering for connectors in Exchange Online | Microsoft Learn

Follow these steps to configure Enhanced Filtering for Connectors on an inbound connector.

End-User Impact

Level: Low

There is no end-user impact for this setting. Depending on the providers, there may be some false positives that restrict legitimate mail to end-users.

Tips

None Currently

PowerShell Scripts

Enhanced filtering for connectors in Exchange Online | Microsoft Learn

Videos

None Currently