1. Exchange Online Protection & Mail Flow
Jayant Gupta
Premier Field Engineer
200 E, Randolph St
Aon center, Chicago -IL

2. Conditions and Terms of Use
Microsoft Confidential
This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content and/or software included in such packages is strictly prohibited.
The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind, whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
Training package content, including URLs and other Internet Web site references, is subject to change without notice. Because Microsoft must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies, organizations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred.
Copyright and Trademarks
© 2013 Microsoft Corporation. All rights reserved.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
For more information, see Use of Microsoft Copyrighted Content at
Microsoft®, Internet Explorer®, Outlook®, SkyDrive®, Windows Vista®, Zune®, Xbox 360®, DirectX®, Windows Server® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

3. Overview
This module explores the various capabilities of the Exchange Online Protection service, including:
Anti-Malware protection
Anti-Spam protection, including connection and content filtering
Quarantining messages
Reporting
Microsoft Exchange Online customers are automatically provided with anti-spam and anti-malware protection. The following topics (and their associated subtopics) provide overview information and configuration steps for customizing spam filtering and malware filtering settings so that they best meet the needs of your organization:
Anti-Spam Protection
Describes anti-spam protection which is comprised of connection filtering, content filtering, and outbound spam processing. Among the information included are explanations about how spam confidence levels (SCL) and outbound spam processing work, how to submit spam messages and false positive messages to Microsoft, and details about how to configure anti-spam settings using the Exchange Administration Center (EAC).
Anti-Malware Protection
Describes the multi-layered anti-malware protection provided by the service. Among the information included are an Anti-Malware FAQ and details about how to configure anti-malware settings using the EAC.
Quarantine
Describes how you can search for quarantined messages, view details about quarantined messages, release specific messages to a recipient you specify, and also quickly report a quarantined message as a false positive. (Messages that are identified as spam or that match an Exchange transport rule can be sent to the quarantine in the EAC.)

4. Exchange Online Protection
What is Exchange Online Protection (EOP)?
EOP is the new version of Forefront Online Protection for Exchange (FOPE), Microsoft’s hosted gateway
Provides comprehensive protection through multi-engine antivirus and continuously evolving anti-spam protection
Built on Exchange 2013 Transport architecture
Geographically load-balanced datacenters
Queuing capabilities to help ensure no mail is lost
Currently processes 1 billion messages per day
EOP is available:
As a stand-alone cloud service for on-premises customers
As part of Office 365 subscriptions

5. Simple to Deploy Add and verify domain ownership in Office 365
Change your MX record to point to <domain-com>.mail.protection.outlook.com
Create an SPF TXT record for your domain v=spf1 include:spf.protection.outlook.com -all
Fine tune anti-malware and anti-spam settings
Create rules to meet business needs
The required DNS records customised for your domain will be available in the Office Admin Center once you add and verify your custom domain.
The format for the MX record is always <domain-com>.mail.protection.outlook.com where <domain-com> is your custom domain.
E.g. Contoso.com would point their MX record to contoso-com.mail.protection.outlook.com

6. EOP Administration
Unlike FOPE, Exchange Online Protection administration is incorporated into the Exchange Admin Center

7. EOP inbound filtering

8. EOP outbound filtering

9. Anti-Malware

10. Definition of Malware What is Malware?
Malware is any kind of unwanted software that is installed without your adequate consent
What is Spyware?
Spyware is a general term used to describe software that performs certain behaviors, generally without appropriately obtaining your consent first; such as:
Advertising
Collecting personal information
Changing the configuration of your computer

11. Malware Filter Configuration
What you can do in the Exchange Administration Center (EAC)?
The Malware detection response (action)
The custom alert text (deletion txt)
The notifications (who to send to and the ability to customize the notifications)
Malware Filter Configuration
Malware filtering is automatically enabled company-wide via the default anti-malware policy. As an administrator, you can view and edit, but not delete, the default anti-malware policy so that it is tailored to best meet the needs of your organization.

12. Anti-Spam
Connection Filtering
Content Filtering
Outbound Spam

13. Multi-layered anti-spam protection
Connection filtering
Blocks up to 80% of all spam based on IP block/allow lists
Sender-recipient filtering
Blocks up to 15% of all spam based on internal lists and sender reputation
Content filtering
Blocks up to 5% of all spam based on internal lists and heuristics

14. Connection Filter What is Connection Filtering ?
It is blocking or allowing inbound messages based on the originating IP address
The connection filter checks IP Allow and IP Block lists prior to checking the content of each message
Messages from specifically allowed IP addresses bypass filtering
Messages from senders in the IP Block list are blocked, except in cases where they also appear in the IP Allow list
You can add an IP address or address range to an IP Allow list or IP Block list in EAC
You can also check Enable safe list to skip messages from trusted senders, derived from lists that Microsoft subscribes to.

15. Content Filter
Content Filtering- Content filtering examines each part of the inbound message, such as the header and message body, using a list of regular expressions. A score is then assigned to the message if a rule is matched. Several URL lists are also used to block messages that contain specific, suspicious URLs. You can configure actions for each confidence-threshold level by editing the default content filter policy. For example, you can send messages to the quarantine or to the Junk folder of each recipient. Content filtering includes international filtering, which means that you can choose to block messages written in specific languages or sent from specific countries or regions, and Advanced Spam Filtering Options, which inspects attributes in a message and acts upon the message if it matches a specific configured attribute. If you are concerned about phishing, some advanced options offer a combination of Sender ID and SPF-record technologies to authenticate and verify that messages are not spoofed.

16. Content Filter Actions
Delete
Quarantine
Add x-header
Move to Junk folder
Prepend subject line with text
Redirect to address
Filter messages from particular countries, or by language
Delete message Deletes the entire message, including all attachments.
Quarantine message
Sends the message to quarantine instead of to the intended recipients. If you select this option, in the Retain spam for (days) field input box, specify the number of days during which the spam message will be quarantined. (It will automatically be deleted after the time elapses. The default value is 15 days and you can specify a maximum of 30 days.) This is the initial default action for all confidence levels until you modify the default spam content filter policy, after which the default action will be changed to move messages to the Junk folder unless you specifically select one of the other actions.
Move message to Junk folder
Sends the message to the Junk folder of the specified recipients.
Add X-header
Sends the message to the specified recipients but adds a special X-header to the message that identifies it as spam. This X-header is then added to the headers of all subsequent spam messages. You can create rules to filter messages that are marked with X-headers, if needed. You can customize the X- header text that is added to messages using the Add this X-header text input box.
Prepend subject line with text
Sends the message to the intended recipients but prepends the subject line with the text that you specify in the Prefix subject line with this text input box.
Redirect message to address
Sends the message to a designated address instead of to the intended recipients. Specify the “redirect” address in the Redirect to this address input box.
IMPORTANT: Any changes to antispam policies can take up to an hour to replicate across all datacenters.

17. Content Filter Advanced Options
Increase Spam Score
Mark As Spam
Test Mode Options
Content Filter Advanced Options
When an option is set to test mode, no action is taken on messages that meet the spam filter criteria. However, messages can be tagged with an X-header before they are delivered to the intended recipient; this X-header lets you know which ASF option was matched and what would happen if the option was set to on. If you specified Test for any of the advanced options, you can configure the following test mode settings to be applied when a match is made to a test-enabled option:
None: Take no test mode action on the message. This is the default.
Add the default test X-header text: Selecting this option sends the message to the specified recipients but adds a special X-header to the message that identifies it as having matched a specific advanced spam filtering option.
Send a Bcc message to this address: Checking this option sends a blind carbon copy of the message to the address you specify in the input box.
TIP: If you are concerned about phishing, it is recommended to turn on the SPF record hard fail and the conditional sender ID hard fail options.

18. Spam Confidence Level SCL Rating Spam Confidence Interpretation
Default Action -1
Non-spam coming from a safe sender, safe recipient, or safe listed IP address (trusted partner)
Deliver the message to the recipients’ inbox.
0, 1
Non-spam because the message was scanned and determined to be clean
5, 6
Spam
The initial default is to deliver the message to the quarantine. However, if the default spam content filter policy is modified, by default the message will instead be delivered to the Junk folder. 9
High confidence
When an message goes through spam filtering it is assigned a spam score. That score is mapped to an individual Spam Confidence Level (SCL) rating and stamped in an X-header. Microsoft Exchange Online takes actions upon the messages depending upon the spam confidence interpretation of the SCL rating.
The above table shows how the different SCL ratings are interpreted by the filters and the default action that is taken on inbound messages for each rating.
SCL ratings of 2, 3, 4, 7, and 8 are not used by the service.
An SCL rating of 5 or 6 is considered suspected spam, which is less certain to be spam than an SCL rating of 9.
Different actions for spam and high confidence spam can be configured by editing the default content filter policy in the Exchange Administration Center.

19. Outbound Spam Why do you need outbound spam filtering?
Outbound spam filtering is needed because malicious programmers and their malware are out there taking over computers inside corporate networks every day. This means that users in your organization can be sending large amounts of outbound spam without your knowledge
Outbound spam filtering is always enabled, thereby protecting organizations using the service and their intended recipients. Similar to inbound filtering, outbound spam filtering is comprised of connection filtering and content filtering, however the outbound filter settings are not configurable. If an outbound message is determined to be spam, it is routed through the high risk delivery pool, which reduces the probability of the normal outbound-IP pool being added to a block list. If a customer continues to send outbound spam through the service, they will be blocked from sending messages. Although outbound spam filtering cannot be disabled or changed, you can configure several company-wide outbound spam settings via the default outbound spam policy

20. Quarantine
Messages are not quarantined by default. In order to start quarantining messages, you need to configure the content filter to stop sending messages to junk folder, and choose to redirect SPAM to quarantine queue.

21. Quarantined Messages
Messages that are identified as spam or that match an Exchange transport rule can be sent to the quarantine
If you are an administrator, you can perform the following actions against quarantined messages via EAC: - Search for quarantined messages - View details about quarantined messages - Release specific messages to a recipient within your organization - Quickly report a quarantined message as a false positive

22. Working with Quarantined Messages and PowerShell
To retrieve information about quarantined s Get-QuarantineMessage -StartReceivedDate 02/13/ EndReceivedDate 02/14/2013
To release a quarantined message
Get-QuarantineMessage -MessageID <5c695d7e a4b0- | Release-QuarantineMessage

23. Junk Management
Users can now receive spam notifications for messages destined to them that were marked as junk and quarantined
Users can choose to either release or report on quarantined messages

24. Reporting

25. Built-in Reporting
Provides a clear view on spam filtering and malware attacks

26. Testing changes to Malware and Content filters
Testing Malware filter
Create a file called EICAR.txt with the following text: FILE!$H+H*
Attach EICAR.TXT to a new mail message, and send it through the service.
Confirm your antimalware filter settings have taken affect (policy changes can take up to an hour to replicate across datacenters)
This “EICAR” test attachment will cause the message to be treated as malicious antivirus/antimalware engines
Testing Content filter
Test Content filter using GTUBE message. A GTUBE message should always be detected as spam by the content filter, and the actions that are performed upon the message should match your configured settings. Include the following GTUBE text in a mail message on a single line, without any spaces or line breaks:
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST- *C.34X

27. Module Review
What are the three main topics which make up the suite in Exchange Online Protection ?
Anti-Malware, Anti-Spam, Quarantine
What are the three types of filtering available ?
Malware Filtering, Content Filtering, Connection Filtering
What does the outbound spam policy do ?
If an outbound message is determined to be spam, it is routed through the high risk delivery pool, which reduces the probability of the normal outbound-IP pool being added to a block list. If a customer continues to send outbound spam through the service, they will be blocked from sending messages

28. Exchange Online Mail Flow

29. Overview
This module covers the mail flow capabilities of Exchange Online, including
Transport rules
Delivery reports and message tracing
Inbound and outbound connectors

30. Rules

31. Types Of Rules Transport Rules
Let you apply messaging policies to messages in the transport pipeline
Actions, such as redirecting a message or adding recipients, rights-protecting messages, and rejecting or silently deleting a message can be taken
Transport Protection Rules
Administrators can use transport protection rules to implement messaging policies to inspect message content, encrypt sensitive content, and use rights management to control access to the content
Outlook Protection Rules
In Exchange Online, Outlook, and OWA users and administrators can apply Information Rights Management (IRM) protection to messages by applying an Active Directory Rights Management Services (AD RMS) rights policy template. This requires an AD RMS deployment in the organization

32. Transport Rules
Use transport rules to look for specific conditions on messages that pass through your organization and take action on them
Transport rules allow you to: - Prevent inappropriate content from entering or leaving - Filter confidential organization information - Track or copy messages that are sent to or received from specific individuals - Redirecting inbound and outbound messages for inspection before delivery - Applying disclaimers to messages as they pass through the organization
You can only create a maximum of 100 transport rules in Exchange Online
Exchange Transport Rules provide an additional level of mail flow control for Exchange Online Administrators. The basic goal of creating a transport rule is to have Exchange Online (EXO) inspect any messages sent to and received by the users in a tenant and complete a task against that message. These rules can help Exchange Online Administrators lessen security and compliance issues in their organization. For example, a common transport rule created by EXO Administrators is to apply a legal disclaimer to each message leaving their organization.
Exchange Transport Rules will replace FOPE Wave 14 Policy rules. If a customer wants to have a policy to block all mail from a specific sender, or mail with a specific character set, they must use the Transport Rules.

33. Transport Rule Components
A transport rule consists of the following components:
Conditions: identify the messages that you want the rule to apply to
Actions: specify what you want to do to the messages that are identified by the conditions
Exceptions: override conditions and prevent the rule from acting on specific messages
Choose a mode for this rule: (Enforce, Test with Policy Tips, Test without Policy Tips)
Exchange Transport Rules provide an additional level of mail flow control for Exchange Online Administrators. The basic goal of creating a transport rule is to have Exchange Online (EXO) inspect any messages sent to and received by the users in a tenant and complete a task against that message. These rules can help Exchange Online Administrators lessen security and compliance issues in their organization. For example, a common transport rule created by EXO Administrators is to apply a legal disclaimer to each message leaving their organization.
Exchange Transport Rules will replace FOPE Wave 14 Policy rules. If a customer wants to have a policy to block all mail from a specific sender, or mail with a specific character set, they must use the Transport Rules.

34. How to Create a New Rule?
Transport Rules are created by using the New Rules Wizard. You can access the wizard by going to Mail Flow > Rules > New, and selecting the kind of rule that you want to create.

35. Transport Rules via PowerShell
How to create a New Transport Rule
New-TransportRule -Name "Mark messages from the Internet to Sales DG" -FromScope NotInOrganization -SentTo "Sales Department" -PrependSubject "External message to Sales DG:“
How to verify the Rule was created
Get-TransportRule "Mark messages from the Internet to Sales DG“
How to view all rules in your Exchange Online Tenant
Get-TransportRule

36. Delivery Reports

37. Delivery Reports
Message tracking within your Exchange Organization only
Track delivery information about messages sent by or received from any specific mailbox in your organization
Optionally add words to search for in the subject line
Subject line is displayed in the results, not message content
Track messages for up to 14 days after they were sent or received
Note: It does not track messages sent from POP or IMAP clients, such as Windows Mail, Outlook Express, or Mozilla Thunderbird

38. Message Tracking

39. Message Trace
The message trace feature enables an administrator to follow messages as they pass through your Exchange Online or Exchange Online Protection service
It helps you determine whether a targeted message was received, rejected, deferred, or delivered by the service within the past 7 days
It also shows what actions have occurred to the message before reaching its final status
Obtaining detailed information about a specific message lets you efficiently answer your user’s questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance

40. How to Run a Message Trace
Navigate to Mail Flow > Message Trace in EAC
Select Fields (to narrow search)
Options include:
Sender
Recipient
Message was Sent or Received
Delivery Status or Message ID
None is also an allowed option, which will display the previous 7 days of information. Please note that only 7 days is retained by the Service
Click Search to run the Message Trace
*Message Trace information is available for up to 90 days

41. View Message Trace Results
After running a search, the results will be listed in the Message Trace Results pane below the search section
The following information is displayed about each message:
Date
Sender
Recipient
Subject
Status
Each column can be sorted by clicking on the column name. Clicking it will switch the current sort order
If results exceed 500 entries there will be a page navigation section which will appear for use
After running the message trace in the EAC, the results will be listed, sorted by date, with the most recent message appearing first. You can sort on any of the listed fields by clicking their headers. Clicking a column header a second time will reverse the sort order. When viewing message trace results, the following information is provided about each message:
Date: The date and time at which the message was received by the service, using the Coordinated Universal Time (UTC) time standard
Sender: The address of the sender in the form
Recipient: The address of the recipient or recipients. This should include the address from the To list as originally received before any DL expansion. There will be one To address per result. When a DL is expanded, and you have rights to see the expansion, then the expanded results will also be shown. (There will be a result shown for the DL as well as one per recipient within the expanded DL.)
Subject: The subject line text of the message. If necessary, this is truncated to the first characters
Status: This field specifies whether the message was Delivered to the recipient, Failed to be delivered to the recipient (either because it failed to reach its destination or because it was filtered), is Pending delivery (it is either in the process of being delivered or the delivery was deferred but is being re-attempted), was Expanded (there was no delivery because the message was sent to a DL that was expanded to the recipients of the DL), or has a status of None (there is no status of delivery for the message to the recipient because the message was either rejected or redirected to a different recipient)
Note: The message trace results are displayed in a scrollable list that can display a maximum of 500 entries per page. Additional pages can be accessed by using the page navigation feature.

42. Message Tracing via PowerShell
Using Get-MessageTrace to see information
Get-MessageTrace -SenderAddress -StartDate 06/13/2012 -EndDate 06/15/2012
Obtain more detailed information by pipelining the results to the Get- MessageTraceDetail cmdlet
Get-MessageTrace -Id 2bbad36aa4674c7ba82f4b307fff549f - SenderAddress -StartDate 06/13/2012 -EndDate 06/15/2012 | Get-MessageTraceDetail

43. Connectors

44. Connector Types
Connectors are used to control inbound and outbound mail flow
With connectors, you can route mail to and receive mail from recipients outside of your organization, a partner through a secure channel, or a message-processing appliance
The most commonly used connector types are Outbound connectors, which control outbound messages, and Inbound connectors, which control inbound messages
Connectors can be configured to enforce IP address and domain restrictions, as well as TLS encryption, for both inbound and outbound mail

45. Using Connectors
Mail flows into and out of Exchange Online through EOP without the need to create any inbound or outbound connectors by default
Create connectors when you need to customize inbound and outbound mail flow between:
Exchange Online and On-Premises
Exchange Online and External Recipients
Exchange Online and Partner Organizations
An example scenario where connectors using TLS are created to enforce encrypted mail flow between EOP and a partner

46. On-Premises Organization Exchange Online Protection
MX resolves to on-premises gateway
MX is switched to Exchange Online Protection
Outbound Exchange Online traffic is delivered direct
You can choose to route outbound on-premises mail via EOP
Secure Mail
External Recipient
On-Premises Organization
Internet
Third Party Security System
Exchange
Exchange Online Protection
Secure Mail
Encrypted & Authenticated Mail Flow
“David”
On-premises
Mailbox
Exchange Online
“Chris”
Cloud
Mailbox

47. Centralized Transport
MX resolves to on-premises gateway
All in and out of the Exchange Online tenant must go via on-premises
MX is switched to Exchange Online Protection
Centralized Transport
External Recipient
On-Premises Organization
Internet
Third Party Security System
Exchange
Exchange Online Protection
Secure Mail
Encrypted & Authenticated Mail Flow
Exchange Online
“David”
On-premises
Mailbox
“Chris”
Cloud
Mailbox

48. Who Wants to Ask Questions??
Contact
Jayant Gupta
Office 365, Premier Field Engineer
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION