Connect Application - Securing Inbound Email on M365

Customers currently using the Connect Application are advised to complete their onboarding setup as soon as possible, as the Connect Application is scheduled to be discontinued on the 31st of January, 2024.

This article explains how to configure the Connect application with Microsoft 365. This applies to new clients connecting with Mimecast using the Connect Application with Microsoft 365 Exchange Online.

• • • If you are using an On-Premise Exchange Server or an Exchange Server in a Hybrid configuration, see the Securing Your Inbound Email (On-Premise / Hybrid Exchanges) page.
    • If you are not using the Connect Application, click here.

This guide describes the correct navigation through the Classic Exchange Admin Center (Classic EAC). Administrators can choose to use either the Classic EAC or the new Exchange Admin Center (new EAC) however, features and routing will differ from that described in this guide when using the new EAC. For more information, please see the relevant Microsoft documentation here.

Setting Us as Your Trusted Email Source

Once you have completed all the Connect Application tasks, we recommend locking down your inbound email flow in Microsoft 365 to only allow mail from Mimecast IP addresses.
This ensures your emails are scanned by the Mimecast security systems to prevent viruses and spam from reaching your internal environment.

For further assistance, see the following pages in the Microsoft documentation:

• • • Manage mail flow using third party cloud service with Exchange Online
    • Enhanced Filtering for Connectors in Exchange Online

To secure your inbound email:

1. Log in to the Microsoft 365 Exchange Admin Console.
2. Click on the Mail flow menu item on the left-hand side.
3. Click on the Connectors link at the top. Your connectors are displayed.
4. Click on the + icon.
5. Complete the Select Your Mail Flow Scenario dialog as follows: 

   Field / Option	Description
   From	Partner organization
   To	Microsoft 365

   The text at the bottom of the wizard changes to, "Creating a connector is optional for this mail flow scenario. Create a connector only if you want to enhance security for the email messages sent between your partner organization or service provider and Microsoft 365. You can create multiple connectors for this scenario, each applying to different partner organizations or service providers.

6. Click the Next button.
7. Change the connector's name to "Mimecast to Microsoft 365".
8. Click the Next button.
9. Select “By verifying that the IP address of the sending server matches one of the following IP addresses that belongs to your partner organization”. Add the IP ranges from the Mimecast Grid the organization is hosted on Mimecast Data Centers and URLs.
10. Click the Next button.
11. Click on the + icon to add the * as the domain.
12. Click on the OK button.
13. Click the Next button.
14. Leave the Reject Email Messages if They Aren't Sent Over TLS option with the default value on the "What security restrictions do you want to apply?" dialog. Mimecast will send the message on to Microsoft 365 with Opportunistic TLS.
15. Select Reject Email Messages if they aren't sent from within this IP address range.
16. Click on the + icon to add the Mimecast IP address ranges depending on your region.
17. Click the Next button. A summary page is displayed. Check this to ensure it has all the correct information.
18. Click the Save button.

Testing Your Microsoft 365 Inbound Security

Once you have locked down your firewall, you can run the firewall test from the Connect Application to determine if the lockdown was successful.

To test your firewall and complete the task:

1. Click on the Gateway | Secure Your Inbound Email menu item.
2. Click on the Start button. Our Inbound IP Ranges are displayed.
3. Ensure you have set up Mimecast as your only trusted email source. See the "Securing Your Inbound Email" section above.
4. Click on the Next button.
5. Click the Test Host link to test your Microsoft 365 connection. A popup dialog is displayed.

   The test attempts to establish a connection to your Microsoft 365 host name from a Mimecast IP address that isn't part of the data centers you've set up. This uses the SMTP protocol up to the "RCPT" command.

6. Enter a valid internal email address and click Test. Your firewall's status is displayed as one of the following:

• Secured: The host has rejected the recipient. This is the desired outcome.
• Not Secured: The host has accepted the recipient.
  

7.  Click the More or Less link to toggle the view of your domain's route information.
8. When you're ready, click the Confirm button. A summary of your secure inbound email connection is displayed.

See Also...

• • • Mimecast Data Centers and URLs
    • Delivery Routing Policies