EveryCloud Technologies

Office 365 inbound mail configuration:

When using the EveryCloud email filtering service with Office 365, you will need to ensure that you only accept protocol connections from EveryCloud's service ranges or spammers will still be able to send email directly to your Office 365 mail environment, bypassing your MX records. Here's how to lock down Office 365 Exchange Online.

You cannot define an inbound receive connector (connection filter) that will allow only connections from EveryCloud’s IP ranges, as EveryCloud has a /20 range within its delivery ranges and Office 365 receive connectors have a limitation, in that they will only allow connections from /24 ranges to /32 ranges. You must therefore create a Transport rule instead. 

Rule 1 Overview:

**Please wait at least 48 hours after changing your MX-records before enabling this rule.**

1. Deny all email
2. Create an exception to allow from EveryCloud Technologies IP ranges
3. Create an exception to allow mail sent from your Office 365 mailboxes (Inside the organization)
4. Create an exception for Calendaring Message types

Method:

Login to Office 365 with admin permissions, click the app launcher icon in the upper-left and then click Admin.  Choose ... Show All and select Exchange under Admin centers.

1. Click on ‘Mail Flow’  
2. Click on ‘Rules’  
3. Click on ‘+’ to create a new rule
4. Give your Rule a Name for example. “EveryCloud Filter rule”
5. Click on 'More options  
   
   
   
6. Apply this rule if... = [Apply to all messages]
7. Do the following...  = 'Block the message... and 'reject the message and include an explanation' (then define an explanation, For example  'Email bypassed MX records'
8. Except If… Add exception> The sender… select  'is external/internal' select 'inside the organization'
   1. This will cover all internal communications.
9. Add exception>  The Message properties...  select 'include the message type' select 'Calendaring' 
   1. This will cover all Calendar activities(acceptance/ tentative etc) from mobile and external sources.
10. Add exception>  The sender… select 'IP address is in any of these ranges or exactly matches' (then input the IP ranges corresponding to your chosen datacentre from here)
    1. This will allow mail from Our IP addresses.

Confirm “Choose a mode for this rule:” is set to “Enforce”

Click 'Save'

The completed rule should look like this: 

Note:  the IP addresses listed here may be different depending on your geographic location.

Rule 2 Overview:

1. If mail is from any of our IP address only.
2. Bypass inbuilt spam filtering.

Method:

Login to Office 365 with admin permissions, click the app launcher icon in the upper-left and then click Admin.  Choose ... Show All and select Exchange under Admin centers.

1. Click on ‘Mail Flow’
2. Click on ‘Rules’
3. Click on ‘+’ to create a new rule
4. Give your Rule a Name for example. “Bypass Office365 Filtering”
5. Click on ‘More options’
6. Apply this rule if... = 'IP address is in any of these ranges or exactly matches' (then input the IP ranges corresponding to your chosen datacentre from here)
7. Do the following... = 'Modify the message properties...' then 'set the spam confidence level (SCL)' and set it to ' Bypass spam filtering'.

Confirm “Choose a mode for this rule:” is set to “Enforce”

Click 'Save'

The completed rule should look like this: 

Note:  the IP addresses listed here may be different depending on your geographic location.