Enhanced Filtering for Connectors in Exchange Online

Properly configured inbound connectors are a trusted source of incoming mail to Microsoft 365 or Office 365. But in complex routing scenarios where email for your Microsoft 365 or Office 365 domain is routed somewhere else first, the source of the inbound connector is typically not the true indicator of where the message came from. Complex routing scenarios include:

• Third-party cloud filtering services
• Managed filtering appliances
• Hybrid environments (for example, on-premises Exchange)

Mail routing in complex scenarios looks like this:

As you can see, the message adopts the source IP of the service, appliance, or on-premises Exchange organization that sits in front of Microsoft 365. The message arrives in Microsoft 365 with a different source IP address. This behavior isn't a limitation of Microsoft 365; it's simply how SMTP works.

In these scenarios, you can still get the most out of Exchange Online Protection (EOP) and Microsoft Defender for Office 365 by using Enhanced Filtering for Connectors (also known as skip listing).

After you enable Enhanced Filtering for Connectors, mail routing in complex routing scenarios looks like this:

As you can see, Enhanced Filtering for connectors allows IP address and sender information to be preserved.

In these routing scenarios, an ARC seal is typically used to maintain the source information and message integrity using DKIM. However, DKIM frequently fails because many services that modify the message don't support ARC. To help in these situations, Enhanced Filtering for Connectors not only preserve the IP address from the previous hop but also intelligently recovers from DKIM signature failures. This behavior helps the messages pass authentication through the spoof intelligence filters.

Enabling Enhance Filtering for Connectors has the following benefits:

• Improved accuracy for the Microsoft filtering stack and machine learning models, which include:
  • Reduced false positives in DMARC from content modification and lack of an ARC seal.
  • Heuristic clustering
  • Anti-spoofing
  • Anti-phishing
• Better post-breach capabilities in Automated investigation and response (AIR)
• Able to use explicit email authentication (SPF, DKIM, and DMARC) to verify the reputation of the sending domain for impersonation and spoof detection. For more information about explicit and implicit email authentication, see Email authentication in EOP.

For more information, see the What happens when you enable Enhanced Filtering for Connectors? section later in this article.

Use the procedures in this article to enable Enhanced Filtering for Connectors on individual connectors. For more information about connectors in Exchange Online, see Configure mail flow using connectors.

Configure Enhanced Filtering for Connectors

What do you need to know before you begin?

• Include all of the trusted IP addresses that are associated with the on-premises hosts or the third-party filters that send email into your Microsoft 365 or Office 365 organization, including any intermediate hops with public IP addresses. To get these IP addresses, consult the documentation or support that's provided with the service.

• If you have mail flow rules (also known as transport rules) that set the SCL to -1 for messages that flow through this connector, you must disable those mail flow rules after you enable Enhanced Filtering for Connectors.

• To open the Microsoft Defender portal, go to https://security.microsoft.com. To go directly to the Enhanced Filtering for Connectors page, use https://security.microsoft.com/skiplisting.

• To connect to Exchange Online PowerShell, see Connect to Exchange Online PowerShell. To connect to Exchange Online Protection PowerShell, see Connect to Exchange Online Protection PowerShell.

• To configure Enhanced Filtering for Connectors, you need to be a member of one of the following role groups:

  • Organization Management or Security Administrator in the Microsoft Defender portal.
  • Organization Management in Exchange Online.

• Enhanced Filtering for Connectors isn't supported in hybrid environments that use Centralized Mail Transport.

Use the Microsoft Defender portal to configure Enhanced Filtering for Connectors on an inbound connector

1. In the Microsoft Defender portal, go to Email & Collaboration > Policies & Rules > Threat policies page > Rules section > Enhanced filtering.

2. On the Enhanced Filtering for Connectors page, select the inbound connector that you want to configure by clicking on the name.

3. In the connector details flyout that appears, configure the following settings:

   • IP addresses to skip: Choose one of the following values:

     • Disable Enhanced Filtering for Connectors: Turn off Enhanced Filtering for Connectors on the connector.

     • Automatically detect and skip the last IP address: We recommend this value if you have to skip only the last message source.

     • Skip these IP addresses that are associated with the connector: Select this value to configure a list of IP addresses to skip.

       Important

       • Entering the IP addresses of Microsoft 365 or Office 365 is not supported. Do not use this feature to compensate for issues introduced by unsupported email routing paths. Use caution and limit the IP ranges to only the email systems that will handle your own organization's messages prior to Microsoft 365 or Office 365.
       • Entering any loopback address (127.0.0.0/8) or private IP address defined by RFC 1918 (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) is not supported. Enhanced Filtering automatically detects and skips loopback addresses and private IP addresses. If the previous hop is an email server that's behind a network address translation (NAT) device that assigns private IP addresses, we recommend that you configure NAT to assign a public IP address to the email server.
       • Currently, IPv6 addresses are supported only in PowerShell.

   • If you selected Automatically detect and skip the last IP address or Skip these IP addresses that are associated with the connector, the Apply to these users section appears:

     • Apply to entire organization: We recommend this value after you test the feature on a few recipients first.

     • Apply to a small set of users: Select this value to configure a list of recipient email addresses that Enhanced Filtering for Connectors applies to. We recommend this value as an initial test of the feature.

       Note

       • This value is only effective on the actual email addresses that you specify. For example, if a user has five email addresses associated with their mailbox (also known as proxy addresses), you need to specify all five of their email addresses here. Otherwise, messages that are sent to the four other email addresses will go through normal filtering.
       • In hybrid environments where inbound mail flows through on-premises Exchange, you must specify the targetAddress of the MailUser object. For example, [email protected].
       • This value is only effective on messages where all recipients are specified here. If a message contains any recipients that aren't specified here, normal filtering is applied to all recipients of the message.

     • Apply to entire organization: We recommend this value after you test the feature on a few recipients first.

4. When you're finished, select Save.

Use Exchange Online PowerShell or Exchange Online Protection PowerShell to configure Enhanced Filtering for Connectors on an inbound connector

To configure Enhanced Filtering for Connectors on an inbound connector, use the following syntax:

Set-InboundConnector -Identity <ConnectorIdentity> [-EFSkipLastIP <$true | $false>] [-EFSkipIPs <IPAddresses>] [-EFUsers "emailaddress1","emailaddress2",..."emailaddressN"]

• EFSkipLastIP: Valid values are:

  • $true: Only the last message source is skipped.
  • $false: Skip the IP addresses specified by the EFSkipIPs parameter. If no IP addresses are specified there, Enhanced Filtering for Connectors is disabled on the inbound connector. The default value is $false.

• EFSkipIPs: The specific IPv4 or IPv6 addresses to skip when the EFSkipLastIP parameter value is $false. Valid values are:

  • A single IP address: For example, 192.168.1.1.
  • An IP address range: For example, 192.168.1.0-192.168.1.31.
  • Classless Inter-Domain Routing (CIDR) IP: For example, 192.168.1.0/25.

  See the Skip these IP addresses that are associated with the connector description in the previous section for limitations on IP addresses.

• EFUsers: The comma-separated email address of recipient email addresses that you want to apply Enhanced Filtering for Connectors to. See the Apply to a small set of users description in the previous section for limitations on individual recipients. The default value is blank ($null), which means Enhanced Filtering for Connectors is applied to all recipients.

This example configures the inbound connector named From Anti-Spam Service with the following settings:

• Enhanced Filtering for Connectors is enabled on the connector, and the IP address of the last message source is skipped.
• Enhanced Filtering for Connectors only applies to the recipient email addresses [email protected], [email protected], and [email protected].

Set-InboundConnector -Identity "From Anti-Spam Service" -EFSkipLastIP $true -EFUsers "[email protected]","[email protected]","[email protected]"

To disable Enhanced Filtering for Connectors, use the value $false for the EFSkipLastIP parameter.

For detailed syntax and parameter information, see Set-InboundConnector.

What happens when you enable Enhanced Filtering for Connectors?

The following table describes what connections look like before and after you enable Enhanced Filtering for Connectors:

You can view the improvements in filtering and reporting by using the Threat protection status report in the Microsoft Defender portal. For more information, see Threat protection status report.

See also

Mail flow best practices for Exchange Online, Microsoft 365, and Office 365 (overview)

Configure mail flow using connectors