Requirements

1. You need to have SuperAdmin access to LibraCyber.
2. You need a Graph API connector created in ESG. To create it, please follow the previous Microsoft 365 APIs configuration guide.

Configuration

The configuration process has some steps, please follow them in order they are written.

Inbound flow

Retrieve Microsoft 365 destination FQDN

• Log into the Microsoft 365 Portal with an admin account.
• On the left menu select the Show all option.
• Navigate then to Settings > Domains.
• Select your domain from the domain list and click on it.
• Move to DNS records and spot your MX record.
• Your MX record should be something like yourdomain-com.mail.protection.outlook.com, your destination mail server.

Disable Microsoft 365 Spam Checks

• Disabling 365 spam checks is not mandatory. We advise disabling spam checks on emails delivered by LibraCyber ESG to avoid false positives. To disable 365 spam checks please, follow the Disable Microsoft 365 Spam Checks guide.

MX records updating

• To direct your email traffic to LibraCyber ESG you need to update your domain(s) MX records. The MX records are stored at your domain host and will direct your email to your mail server(s). It’s like registering your new address with the post-Microsoft so that your mail gets delivered.
• Every domain registrar have slightly different MX configuration procedures, but use can use these general steps as a guidance.

Connector configuration

The Inbound Connector is essential to avoid Microsoft 365 Rate Limiting policies to emails coming from ESG.

• The inbound connector can be done in two ways: 
  • locking down the inbound flow, allowing it only from ESG (the right choice for the production system)
  • allowing inbound flow from any sources (suggested only when testing or POC)

Enhanced Filtering for Connectors

With this configuration you allow Microsoft 365 to correctly authenticate messages even if ESG is in front of it. This is necessary especially if messages must be forwarded from M365 after being received by ESG or if the sender has a BIMI record configured.

• To configure the Enhanced Filtering for Connector proceed as follows:

1.  
   • Go to https://security.microsoft.com/skiplisting and login as Administrator
   • Select the Inbound Connector created at the previous step for the ESG to M365 traffic
   • Select the option "Automatically detect and skip the last IP address" and "Apply to entire organization" then SAVE.

Outbound flow

Using LibraCyber ESG as outbound gateway is not mandatory, but it's essential if you want to enable outbound emails features (e.g. Account Takeover modules) on the appliance.

Enable Microsoft 365 Hosted Service

Enable Microsoft 365 relay integration from the Relay Configuration > Trusted Networks > Manage Hosted Services section. When this option is enabled, LibraCyber ESG will automatically manage the IP ranges from Microsoft 365.

SPF Record

Your organization should already have an SPF record for the domain(s) registered with Microsoft 365. 

• When implementing LibraCyber ESG with Microsoft 365, this record must be updated in the DNS zone for the relevant domain to include the following:
  • include:spf.esvacloud.com (LibraCyber ESG on-cloud installations)
  • include:<customer-spf-record> or a:<ESG-HOSTNAME> or ip4:<ESG-IP-Address> (LibraCyber ESG on-premise installations)

In both cases, include:spf.protection.outlook.com must be present in the SPF record. Example: v=spf1 mx include:spf.protection.outlook.com include:spf.esvacloud.com -all

Connector configuration

To configure the outbound mail flow from Microsoft 365 to LibraCyber ESG proceed as follows:

• Log into the Exchange Admin Center
• On the left side client Mail Flow and select Connectors on the top right
• Under Connectors, click the add, plus, button.

• Select Connection from > Office 365 and Connection to > Partner Organization. Once done, click Next

  

• Give it a name and click Next

• Change selection on the first bullet Only when I have a transport rule... and click on Next

  

• Select the Route email through these smart hosts options, and click the plus icon to add the IP address of your appliance(s). Once done click Next

  

• Leave the default Always use Transport Layer Security (TLS) to secure the connection (recommended) and Any digital certificate, including self-signed certificates (unless you own a trusted one) set and click Next

  

• Verify your settings and click Next

• Validate the connector by adding an external mail address (not managed by you) and click Save

  

Outbound Transport Rule

• Now you need to create the transport rule that will be linked to the newly created connector:

•  
  • Select the rules link at the top.
  • Create a new rule giving the name “Route messages to LibraCyber ESG”
  • Remember to click on the More options link once the pop-up rule opens.
  • Apply this rule if -> the sender -> is external/internal -> inside the organization.
  • Do the following -> Redirect the message to… -> the following connector -> Select the LibraCyber ESG Outbound created before.
  • Click on add exception.
  • Except if -> the recipient -> is External/Internal -> inside the organization (this will not allow internal messages to be routed through LibraCyber ESG)
  • or -> the message properties -> include the message type -> automatic reply
  • or The Sender -> IP address in any of these ranges or exactly matches -> LibraCyber ESG IP Address (to avoid loop transport problems)

  • finally click Next, leave the default settings in the next page and save the transport rule.

    

Outbound flow scenario

• The outbound mail flow can be done in two ways: 
  • Delivery from ESG IP address (emails will be sent from your IP, needed SPF & DKIM configuration on LibraCyber ESG)
  • Route back to Microsoft 365 (emails will be sent from Microsoft 365 tenant IPs, no SPF & DKIM configuration on LibraCyber ESG)

Internal flow

Is possible to configure a different routing to let the LibraCyber ESG scan also the internal mail flow. This option comes with some disadvantages that are inevitable due to the nature of the Microsoft 365 routing.

Advantages of scanning internal emails

• Additional spam and virus scanning other than the standard Microsoft 365 Security for internal messages
• Possible control of the mail flow with ATP policy quota, to assign different threshold to internal messages
• Possible DLP, Content Filtering and Dictionary restriction to be applied to internal messages

Disadvantages of scanning internal emails

• Microsoft 365 native recall function won't work anymore, only LibraCyber ESG will be able to recall with the Recall function (Threat remediation connector is needed)
• Quick Reactions to messages won't work anymore (Outlook emojis to answer messages from Desktop or Mobile)
• Messages sent to internal groups which cannot accept messages from external will not be deliverable and must be kept internal through a Transport Rule

In case is desired to continue with this configuration, is required to:

1. Create a new rule like shown below
   • Select the rules link at the top.
   • Create a new rule giving the name “Calendaring Exception - LibraCyber ESG”
   • Remember to click on the More options link once the pop-up rule opens.
   • Apply this rule if -> the message properties -> include the message type -> Calendaring
   • Do the following -> Modify the message properties -> remove a message header -> enter the header name "LibraCyber-NULL-HEADER"

   • Click Next

     

   • On the page of settings select "Stop Processing More Rules"

   • finally save the rule.

     

   • Make sure to set this rule with a priority BEFORE the transport rule previously created

2. Modify the previously created transport rule removing the "Except if" for  "The Recipient" is "Inside the Organization"

   

After this changes, your internal messages will be routed through LibraCyber ESG and scanned accordingly.