1. How to Implement Exchange Online Protection (EOP)
Microsoft Ignite 2016
4/19/2018 7:17 AM
BRK3222
How to Implement Exchange Online Protection (EOP)
Jennifer Gagnon
Senior Program Manager
Wendy Wilkes
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Architecture TechReady 17 4/19/2018
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Inbound Filtering Spam Analysts Customer Feedback False +ve / -ve
is routed to EOP DC based on
MX record resolution
(Contoso-com.mail.protection.outlook.com)
Perimeter Protection
Virus Scanning
Policy Enforcement
Spam Protection
Advanced Threat Protection (ATP)
Corporate Network
or Exchange Online
Safe Sender/Recipient
IP-based edge blocks
Safe attachments policy
AV Engine 1
Content scanning and heuristics
Custom transport rules
AV Engine 2
Safe links policy
Directory based edge blocks
SPF & Sender ID filter
AV Engine 3
Bulk mail filtering
Envelope blocks
Quarantine
International spam
Advanced Spam management

4. Outbound Filtering Corporate Network or Exchange Online Virus Scanning
TechReady 23
Outbound Filtering
4/19/2018 7:17 AM
Corporate Network
or Exchange Online
Customer Delivery Pool
Connector-Based
Virus Scanning
Policy Enforcement
Spam Protection
Outbound Pool
Outlook Safe Sender
AV Engine 1
Low Score
Custom transport rules
AV Engine 2
Content scanning and Heuristics
AV Engine 3
Advanced Spam management
High Score
Higher Risk Delivery Pool
Spam Analysts
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Deployment & Configuration
TechReady 17
4/19/2018
Deployment & Configuration
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. EOP deployment scenarios
4/19/2018
EOP deployment scenarios
Standalone
Mail flow & hygiene can be hosted in Exchange Online Protection Datacenters or Exchange Online Datacenters
DNS update that is required is ONLY the MX record. No AutoDiscover!
Max message size is ~150 MB
Hybrid
Some mailboxes are hosted in Exchange Online, and some mailboxes on-premises.
Exchange Online
All mailboxes in the cloud AKA “Fully Hosted”.
There are different endpoints for connecting via Remote PowerShell
Exchange Online:
EOP Standalone:
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Overview of the deployment process
TechReady 17
4/19/2018
Overview of the deployment process
Step 1: Verify prerequisites
Step 2: Configure mail flow (connectors)
Step 3: Add and validate domains
Step 4: Customize spam and policy settings
Step 5: Enable mail flow
Step 6: Monitor and fine tune
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Prerequisites Applicable to all scenarios
TechReady 17
4/19/2018
Prerequisites
Applicable to all scenarios
Office 365 Tenant – name.onmicrosoft.com
EOP licenses (ExO or EOP Standalone)
Domain to migrate
Modern web browser to access the Office 365 portal
Applicable to Standalone or Hybrid scenarios
Inbound and outbound public IP addresses
Open port 25 to Exchange Online Protection IP Addresses
TLS policy, attachment handling, junk folder use, etc.
DirSync may require additional hardware
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Configure mail flow Standalone Hybrid Optional for all scenarios
TechReady 17
4/19/2018
Configure mail flow
Standalone
Create EOP outbound connector to deliver mail on-premises
Create EOP inbound connector to accept mail from on-premises
Create on-premises send connector to send outgoing mail to EOP
Hybrid
Hybrid mail flow is best configured using the Hybrid Configuration Wizard
Optional for all scenarios
Create connectors for forced TLS to third party
Create connectors for customized mail routing
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Configure mail flow (Connectors)
TechReady 17
4/19/2018
Configure mail flow (Connectors)
Outbound TLS Connector
Inbound TLS Connector
Outbound Connector
Partner Environment
Exchange Online Protection
On-Prem Mail Environment
Inbound Connector
For EOP Standalone, connectors between on-premises and EOP need to be created manually
*Additional connectors can be created between EOP and partners to force TLS
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. Configure mail flow (criteria based routing)
TechReady 17
4/19/2018
Configure mail flow (criteria based routing)
Exchange Online Protection
Outbound Connector 1
Outbound Connector 3
Outbound Connector 2
Inbound Connector 1
On-Prem Mail APAC
On-Prem Mail AMER
On-Prem Mail EMEA
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Connector Wizard TechReady 23 4/19/2018 7:17 AM
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Hybrid Architecture FAQs
TechReady 17
4/19/2018
Hybrid Architecture FAQs
Routing between Exchange on-premises & Exchange Online must not pass through any 3rd party (except Edge) – use condition based routing connectors or centralized mail transport as needed.
Recognizing that it may be required to keep inbound MX record pointed to on-premises, know that:
EOP scanning will have limited effectiveness.
On-premises IP reputation & ability to keep the bad stuff out is critical to maintaining mail flow.
Most of the spoof protection built into the service is dependent on signals collected at the network ingress from the sender, and these are lost when mail is not coming directly to EOP.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. FAQ: Inbound Attribution
TechReady 23
4/19/2018 7:17 AM
FAQ: Inbound Attribution
Connector type on-premises only use when the IP or certificate will NOT be used with another tenant
Connectors type partner used in situations where you are routing via a 3rd party (e.g. Gmail, MIMESweeper, etc.)
Failure to configure inbound connectors (and accepted domains) correctly can result in “Safe Tenant” scenario
“Safe Tenant” frequently hits queue quota throttling
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Domain validation Purpose Validation steps Confirms domain ownership
TechReady 17
4/19/2018
Domain validation
Purpose
Confirms domain ownership
You are provided with required DNS changes
*Process is the same across all scenarios
Validation steps
STEP 1: Specify a domain name and confirm ownership.
STEP 2: Add users and assign licences.
STEP 3: Set the domain purpose and configure DNS.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Anti-Malware Malware is defined to comprise of viruses and spyware.
TechReady 23
4/19/2018 7:17 AM
Anti-Malware
Malware is defined to comprise of viruses and spyware.
Multiple anti-malware scan engines
3 action options for messages with malware
Ability to do common attachment blocking
Advanced Threat Protection for safe attachments and safe links
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Anti-spam Settings TechReady 17 4/19/2018
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Best Practices TechReady 17 4/19/2018
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Migrating from third party to EOP
TechReady 17
4/19/2018
Migrating from third party to EOP
Set expectations
You will see a change in patterns
Every product needs to be tuned to your environment
Features may function differently
Porting configuration
Good opportunity to trim old safe/block lists
Old spam filtering rules may not be needed
Review filtering policies (transport rules)
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Enable Directory Synchronization
TechReady 17
4/19/2018
Enable Directory Synchronization
On-premises
Office 365
Automated user/group management
Ease of administration for CBRs or other rules based on user address or groups
Synchronize Outlook safe/block sender lists
Office 365 Directory Sync
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. FAQ: What impact does the Resolver have on this?
TechReady 23
4/19/2018 7:17 AM
FAQ: What impact does the Resolver have on this?
The recipient resolver can result in some unexpected delivery behavior
Since secondary proxies are resolved to primaries, most rules will operate against primary addresses or mail objects only
Forwarding happens before rules get a chance to operate
In CMC scenario & EOP standalone, all objects are resolved before going on-premises
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Spam, phishing & spoofing
TechReady 17
4/19/2018
Spam, phishing & spoofing
Publish an SPF record (Sender Policy Framework)
Include EOP IPs and on-premises public IPs
Use the Microsoft Configuration Wizard
Turn on the SPF check Content Filter Advanced Options
Avoid safe-listing own domains - this by-passes the SPF check and negates the check’s effectiveness
Publish an DKIM record
DKIM (DomainKeys Identified Mail) is an authentication process that can help protect both senders and recipients from forged and phishing . Add DKIM signatures to your domains so recipients know that messages actually came from users in your organization and weren't modified after they were sent.
Recommend reporting Spam to Microsoft
Get the Junk reporting tool
Attach to a new and send to or
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. How do I know if a user is compromised?
4/19/2018
How do I know if a user is compromised?
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Demo Security & Compliance Center TechReady 23 4/19/2018 7:17 AM
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Security & Compliance Center Demo
4/19/2018
Security & Compliance Center Demo
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. 4/19/2018
Troubleshooting
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. FAQ: Why doesn’t my anti-spam rule work?
TechReady 23
4/19/2018 7:17 AM
FAQ: Why doesn’t my anti-spam rule work?
Transport rules evaluate before anti-spam filtering
Content filtering will override any SCL you set manually (except -1 which means bypass spam scanning)
IP filter sets the SCL to -1 which overrides spam filter, but an ETR can still ensure the message never even reaches the spam filter
© 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. What happened to my message? It was there and now it is gone.
ZAP! It has been moved to the Junk Mail Folder
Zero-hour Auto Purge (ZAP)
If the message is still in the Inbox and marked as “Unread” then ZAP will move the message soon after the service has been updated to recognize that new attack as malicious
ZAP can only work against hosted mailboxes (we need direct access to the Inbox in order to move the messages)

29. Message Trace Two features
“Basic” Message Trace
“Extended” Message Trace
(Historical Search)
Data Set
Between approx. 15 minutes & 7 days
Between approx. 8 hours & 90 days
View Results
In UI
Download
Results
In seconds
In minutes/hours (can configure notification address)
Routing Details
Basic detail only
Full detail optional
Maximum Size
500
5,000 (3,000 for detail)
Max Queries / Day
Reasonable limits
50 per tenant
New!

30. Two features share the same UI for simplicity
Using the UI
Two features share the same UI for simplicity

31. PowerShell Basic: Get-MessageTrace, Get-MessageTraceDetail
Extended: Start-HistoricalSearch, Stop-HistoricalSearch, Get-HistoricalSearch
Pull results inside of (and shorter than) 7 days (but still >8 hours)
Search on advanced criteria, like find all messages that hit a particular DLP rule
Start-HistoricalSearch [[-Organization] <OrganizationIdParameter>] -ReportType <HistoricalSearchReportType>
{MessageTrace | MessageTraceDetail | DLP | TransportRule | SPAM | Malware} -ReportTitle <string> -StartDate
<datetime> -EndDate <datetime> [-NotifyAddress <MultiValuedProperty[string]>] [-DeliveryStatus <string>]
[-SenderAddress <MultiValuedProperty[string]>] [-RecipientAddress <MultiValuedProperty[string]>]
[-OriginalClientIP <string>] [-MessageID <MultiValuedProperty[string]>] [-DLPPolicy <MultiValuedProperty[guid]>]
[-TransportRule <MultiValuedProperty[guid]>] [-Locale <cultureinfo>] [-Direction <MessageDirection> {All | Sent |
Received}]

32. TechReady 17
4/19/2018
Resources
Links
EOP TechNet content
EOP best practices
EOP FAQ
False positive/negative submissions
EOP Datacenter IP addresses
Hybrid deployment
Videos for getting started with protecting your
Exchange Online Limits:
Azure AD Connect (DirSync):
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. Deploy, ramp-up on new services and onboard new users with Microsoft FastTrack:

34. Join the Microsoft Tech Community to collaborate, share, and learn from the experts:

35. Please evaluate this session
4/19/2018 7:17 AM
Please evaluate this session
Your feedback is important to us!
From your PC or Tablet visit MyIgnite at
From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

36. 4/19/2018 7:17 AM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.