Connect Process - Microsoft 365 Mail Lockdown

This article provides guidance on enhancing security by configuring Microsoft 365 to accept inbound emails only from Mimecast IP addresses through the creation of a receive connector. This process entails setting up a connector in the Microsoft 365 Exchange Admin Console, designating Mimecast as the partner organization, and implementing security restrictions to ensure that emails are transmitted over TLS and originate from specified IP ranges.

For information on configuring Direct Send and Reject Send, please see Administration - Configuring Direct Send in Microsoft 365.

Customers with complex mail routing environments may need to configure additional connectors to trusted partners, if mail is required to be routed around Mimecast.

Configuring Microsoft 365 Mail Lockdown

You can lock down your firewall, by using the following steps:

1. Log in to the Microsoft 365 Exchange Admin Console.
2. Click on the Mail flow menu item.
3. Click on the Connectors tab. Your connectors are displayed.
4. Click on + Add a Connector.

5. Under Connection from, choose Partner Organization.  
6. Click the Next button.
7. Change the connector's name to Mimecast to Microsoft 365.

8. Click the Next button.
9. Choose By verifying that the sender domain matches one of the following domains and add a * to capture all the inbound domains.

Do not add any IP ranges to the Authenticating sent email screen, specifically under By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization.
This should instead be done in the next screen Security restrictions, as per the following steps.

10. Click the Next button.
11. On the Security Restrictions screen:

• • Check the check box for Reject email messages if they aren't sent over TLS.
  • Check the the check box for And require that the subject name on the certificate that the partner uses to authenticate with Office 365 matches this domain name. Enter *.mimecast.com into the field below the checkbox (for ZA customers, use *.mimecast.co.za).

12. Check the check box for Reject email messages if they aren't sent from within this IP address range, and provide the IP address range. See Email Security Cloud Gateway - Data Centers & URLs for IP addresses.

13. Click the Next button.
14. Review the settings you have configured, and click Create connector.

Monitoring

• Review the Bounced and Rejected Messages Queues in the Mimecast Administration Console to ensure any legitimate traffic like Digest Sets are not rejected by your Microsoft 365 environment.
  • Bounced Messages related to connector lock down will contain an SMTP Error like:
    

    5.7.51 TenantInboundAttribution; Rejecting. Recipient has a partner connector with RestrictDomainsToIPAddresses or RestrictDomainsToCertificate set.

• Validate that all Mimecast IP ranges for your grid have been added to your inbound lockdown connector in Exchange Online. See Administration - Data Centers & URLs.
• Review the Microsoft 365 Spoof Intelligence Insight Dashboard for legitimate messages spoofing your Microsoft 365 accepted domains (Requires M365 Admin Credentials).
  • Check to see if emails from your Microsoft 365 accepted domains are allowed to be spoofed by the Mimecast Sending Infrastructure.
     
• Microsoft 365 E5 and Defender P2 subscribers can review the Spoof detections report for additional information on spoofed messages delivered to the Microsoft 365 Tenant.
• Consider turning off Direct Send, if it is not needed in your organization.

Mimecast Notifications, e.g. Digest Sets and Device Enrollment emails, require a Postmaster Account to be set in the Mimecast Administration Console, under Account | Account Settings | System Notification Options | Notification Postmaster Address.