Microsoft 365 Inline configuration

This article addresses configuring Microsoft 365 with LibraCyber ESG as your inbound with inline mode. There's no need to change your public DNS MX record in this specific scenario. The limitations of this configuration as described below, make sure you're aware of them before proceeding with this configuration.

With Inline mode LibraCyber ESG is positioned between the email transport engine and the back-end cloud mail store, allowing the email to be thoroughly (yet instantly) examined before it reaches a recipient’s inbox.

In this deployment, all reputation checks will be performed directly by Microsoft 365 transport services.

This deployment scenario affects to whole LibraCyber ESG appliance thus, in a multi-tenant environment, mixed (inline/not inline) domain setups are not allowed.

Pros and cons of the inline configuration

With inline mode, you don't need to change the MX record on your DNS because all the configuration is performed through transport rules.

On the other side, there are some disadvantages you should consider before choosing to use ESG in inline mode:

• Microsoft applies some security checks before transport rules are applied. This means that some traffic might be quarantined before being analyzed by ESG. This email traffic will not appear in the ESG mail log and you won't be able to analyze or release it through the ESG UI. There will be two quarantines instead of one and they will have two completely different interfaces.
• Transport checks will be delegated to Microsoft, you will not be able to customize transport layer configurations like, for example, exceptions to the SPF checks.
• Greylisting and the ESG local RBL will not be able to operate in inline mode.
• The inline configuration is global in ESG. All the domains hosted on an ESG configured for inline operation must be configured for inline operation.

Requirements

You need to have a LibraCyber for Microsoft 365 valid license or an ISP license.

Preliminary Steps

First of all you need to enable the Microsoft 365 (inline) trust by reaching the Relay Configuration page, moving to the Trusted Networks tab. 

The below warning appears. Read the message and click the Enable green button to proceed.

Configure the domain

Login to the web UI of your LibraCyber ESG appliance and reach the Relay Configuration page and add the a new record in the table, clicking on the Add button in the table toolbar. 

A dialog appears. 

Here you have to enter the Domain and the Mail Server (Retrieve Microsoft 365 destination FQDN). 

The Mail Server address indicates where the LibraCyber ESG should redirect all mail traffic sent to your organization (to your Microsoft 365 server).

Choose a Recipient Verification method and setup it as explained in the Recipient Verification how to.

Leave the last four settings as they are, if there are no particular needs.

Microsoft APIs permissions

LibraCyber ESG offers native integration with Microsoft Office 365. To retrieve information such as users, groups, and email addresses from an Office 365 tenant you have to assign some permissions from your Office 365 tenant.

Microsoft 365 relies on Azure Active Directory as a directory service. Each Microsoft 365 tenant corresponds to an Azure AD tenant where its user information is being stored. It's needed to grant to your LibraCyber ESG the permissions to access your Microsoft 365 tenant. No changes are made to the Microsoft 365 tenant itself by LibraCyber ESG.

Follow the steps of this how-to: Microsoft 365 APIs configuration.

Configure the connector

To create the connector on the ESG, reach the Microsoft 365 integrations page and click on the Add button from the table toolbar. The below dialog appears. Here you have to fill in the gaps as follows:

• Microsoft 365 Tenant (if your admin account is admin@testcompany.onmicrosoft.com, your tenant will more likely just be testcompany.onmicrosoft.com)
• App Client ID (the application client ID you created in Microsoft 365)
• App Client Secret (the application client secret you created in Microsoft 365)

Once done, click the Save green button.

Disable Microsoft 365 Spam Checks

Disabling 365 spam checks is not mandatory. We advise disabling spam checks on emails delivered by LibraCyber ESG to avoid false positives. To disable the Microsoft 365 spam checks you can follow the Disable Microsoft 365 Spam Checks how to.

Configure the inbound connector 

In the Exchange Admin Center, to configure M365 to accept email from LibraCyber ESG and avoid Rate Limiting, create an Inbound Connector.

Note: this is the official Microsoft documentation about adding a new receive connector in Microsoft 365.

1.  On the left side client Mail Flow and select Connectors on the top right
2. Under Connectors, click the [+] button

3. From Partner Organization - To Office 365

   

4. Click Next.
5. Give it a name and click Next
6. Select Use the sender's IP address

7. Specify the IP address(es) of your LibraCyber ESG appliance(s)

   

8. Click Next
9. Select the option Reject email messages if they aren't sent over TLS if you want to force Microsoft 365 to accept email from LibraCyber ESG only with a TLS connection
10. Click Next
11. Review and Create a connector

Configure the outbound connector

To configure the inline mail flow from Microsoft 365 to LibraCyber ESG proceed as follows:

1. Log into the Microsoft 365 Portal (https://www.office.com)
2. Click on Admin and select Exchange from the drop-down in the left panel (by clicking on Show All)
3. Select mail flow from the left link navigation bar
4. Select the connectors link at the top
5. Create a new connector

6. In the From section, select Microsoft 365; in the To section, select Partner Organization. Click Next.

   

7. Give the new connector a Name (for example Microsoft 365 to LibraCyber ESG), and optional Description, and decide if the connector should be enabled once it has been saved using the Turn it on checkbox.
8. Click Next
9. Change selection on the first bullet Only when I have a transport rule.... and click on next

10. Select the Route email through these smart hosts options, and click the plus icon to add the IP address or FQDN of your LibraCyber ESG Appliance. Click Save, followed by Next. In a cluster environment be sure to add both node's IPs

    

11. Leave the default Always use Transport Layer Security (TLS) to secure the connection (recommended) and Any digital certificate, including self-signed certificates (unless you own a trusted one) set and click Next

    

12. Verify your settings and click Next
13. Validate the connector by adding an external mail address (not managed by you) and click Save

Create the connector transport rule

Now we need to create the transport rule that will be linked to the newly created connector:

1. Select the rules link at the top
2. Create a new rule giving the name "Route messages to LibraCyber ESG"
3. Remember to click on the More Options link once the pop-up rule opens
4. Apply the rule if > the recipient > is external/internal > inside the organization
5. Apply this rule if > the sender > is external/internal > outside the organization
6. Do the following -> Redirect the message to... -> the following connector -> Select the LibraCyber ESG Outbound created before
7. Click on add exception

8. or The Sender -> IP address in any of these ranges or exactly matches -> LibraCyber ESG IP Address (to avoid loop transport problems)

   

9. Check the "stop processing more rules" option
10. Save the transport rule