/
Step 2 - Configure Microsoft 365 for Inbound and Outbound Mail

Step 2 - Configure Microsoft 365 for Inbound and Outbound Mail

    Subscribe

    You can configure Microsoft 365 with Email Gateway Defense as your inbound and/or outbound mail gateway.

    If you make changes to the settings, allow a few minutes for the changes to take effect.

    Microsoft 365 IP addresses and user interfaces can change; refer to Microsoft documentation for configuration details.

    You can specify Email Gateway Defense as an inbound mail gateway through which all incoming mail for your domain is filtered before reaching your Microsoft 365 account. Email Gateway Defense filters out spam and viruses, then passes the mail on to the Microsoft 365 mail servers. 

    You can also specify Email Gateway Defense as the outbound mail gateway through which all mail is sent from your domain via your Microsoft 365 account to the recipient. As the outbound gateway, Email Gateway Defense processes the mail by filtering out spam and viruses before final delivery. By configuring Microsoft 365, you instruct the Microsoft 365 mail servers to pass all outgoing mail from your domain to Email Gateway Defense (the gateway server).

    Step 1. Launch the Setup Wizard

    Before you launch the wizard, verify you have the following:

    • Microsoft 365 admin credentials

    • Credentials to run a PowerShell script or terminal to manually execute PowerShell scripts

    Note that you cannot reopen the wizard after you have completed the wizard. If you have started the wizard but did not complete it, log into BarracudaONE and select Apps > Email Gateway Defense. Click Set Up Now in the top banner to relaunch the wizard.

    The setup wizard includes steps to identify your email server, add MX records, and remove MX records. Each of the domains where you want to filter email must be verified by Email Gateway Defense for proof of ownership; Email Gateway Defense does not process email for a domain until the verification process is complete.

    Note that after verifying your domain, any mail sent to your domain from another Barracuda Email Gateway Defense customer will be processed normally by your Email Gateway Defense account and not delivered via MX records.

    1. Log into BarracudaONE. Select Apps > Email Gateway Defense. If this is your first time launching the setup wizard, you will be redirected to the Barracuda Trials Hub page. Click Open under Email Protection.

      Alternatively, if you have started the setup wizard but did not complete it, click Set Up Now in the top banner to launch the setup wizard.

      The setup wizard launches. 

    2. Click Next in the upper right corner to get started.

    3. Click Connect to connect to Microsoft. 

    Note that if you are using inline deployment method, you cannot skip the “Connect to Microsoft” step.

    1. You will be prompted to log in with a global admin account to give permissions to the application to access your Microsoft data. Click Accept to authorize Barracuda Networks to access your details.

    2. Once you are connected, Barracuda Networks will initiate a scan to identify any email threats. During this process, click Next in the upper right corner to continue.

    3. Select the Region for your data center. Then click Next.

    After you select your region, you cannot change it.

    1. Confirm the domain(s) you would like to protect. Then click Next.

      multipleDomains.png

    Note: Selecting one domain allows inline or MX deployment. Selecting multiple domains uses inline deployment only.

    1. Choose the deployment section that matches your domain selection:

      • If you selected one domain, you can choose either MX record deployment or Inline deployment.

        mxDeployment.jpg

      • If you selected multiple domains, see the Inline deployment section below.

    Use this deployment method if you selected one domain in the previous step. To set up your email flow, you will need to add the new MX records and remove the old MX records. To add the new MX records: Log into your DNS hosting account. Add the primary and backup MX records shown in the Add new MX records section. Instructions for your DNS hosting provider will vary; you can use search terms such as add, edit, manage, or MX records. Add the MX records with a low priority, for example, 99. Adding the new MX records to your existing list should look similar to this: After updating your MX records, allow at least 24-48 hours before completing the next step to allow time for your changes to propagate. Verify that the new Email Gateway Defense MX records have been added by clicking on the Verify records button.  Once your MX records are added, a green verified check mark will appear next to the MX record. To remove the old MX Records: Log into your DNS hosting account. Remove the existing MX records shown in the Remove old MX records section. Instructions for your DNS hosting provider will vary; you can use search terms such as add, edit, manage, or MX records. Update the priority of your primary and backup Barracuda MX records to 1 and 10.  In the Email Gateway Defense wizard, verify that your non-Barracuda Networks MX records have been removed by clicking on the Verify update button. Once your MX records are removed, a green verified check mark will appear.  After you have successfully completed all the steps in the Email Gateway Defense setup wizard, click the Complete setup button at the upper right corner. To exit the wizard and come back at a later time, click Exit. 

    Use this deployment method for one or more domains. Confirm that you want to use inline deployment for the following domain(s). Then click Next. After clicking Next, you will be prompted to sign into Microsoft to accept an additional application. This application will be used to create the necessary rules and connectors required for inline deployment.  After accepting permissions, you will be returned to the setup wizard. Click Next to begin the deployment. During deployment, the setup wizard will automatically create the following:  Three mail flow rules – Two rules for processing inbound mail and one rule for outbound mail. Note: The outbound mail flow rule will be disabled by default.  Three connectors – Two connectors for processing inbound mail and one connector for processing outbound mail.  Anti-Spam connection filtering policy – An entry in the Anti-Spam connection filtering policy to bypass spam filtering for emails originating from Barracuda Networks. Policy to allow spoofing – An “Allow spoofing” policy for emails sent from Barracuda Networks. Once the deployment is complete, click the Complete setup button at the upper right corner. You will be redirected to your Message Log.  You have now successfully set up Email Gateway Defense using the inline deployment method.   Note that this deployment has been configured only for mail sent to the domain selected in the setup wizard. 

    Step 2. Deploy Partner Connector

    The steps in this section enhance the security of the connection between Email Gateway Defense and Microsoft 365.

    Create a Partner Connector

    Creating a partner connector will allow you to use enhance filtering along with tenant access restrictions, ensuring a safe and secure environment.

    1. Log into https://admin.exchange.microsoft.com/#/connectors.

    2. Click the Add a connector button, and use the wizard to create a new connector.

      add_connector.png

    3. For Connection from, select Partner organization. Then, click Next.

      add_new_connector.png

    4. Enter a Name “Barracuda Inbound Connector” and (optional) Description to identify the connector. Then, click Next.

      connector_name.png

    5. Select By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization.

      1. Click the + to enter the correct IP range for your region. Then, click Next.
        This is the region selected when setting up your Barracuda Networks instance. Refer to the Email Gateway Defense IP Ranges Used for Configuration for the IP ranges corresponding to your region. 
        For example, for the US region, enter 209.222.82.0/24.

        authenticate_sent_email.png

    6. Use the default settings for the Security restrictions: Reject email messages if they aren’t sent over TLS. Then, click Next.

      security_restrictions.png

    7. Review your settings and then click Create connector.

      review_connector.png

    Enable Enhanced Filtering for Connectors 

    To enable Enhanced Filtering for Connectors, use the following instructions:

    1. Log into https://security.microsoft.com/skiplisting.

    2. Select Barracuda Inbound Connector, the partner connector you previously created.

    3. Select Automatically detect and skip the last IP address and Apply to entire organization.

    4. Click Save.

    Review Microsoft Anti-Spam Settings

    Enhanced Filtering for Connectors allows customers to continue to leverage anti-spam capabilities provided in Exchange Online. Review your Microsoft anti-spam policy to ensure it is configured to follow recommended best practices.

    1. Log into the Microsoft Defender portal https://security.microsoft.com/.

    2. On the left, navigate to Email & collaboration > Policies & rules.

    3. Select Threat policies > Anti-spam.

    4. Select Anti-spam inbound policy (Default).

    5. Scroll down and click Edit actions.

    6. Review your settings and click Save.

    Note: The settings shown here are the default Microsoft anti-spam settings. Organizations may opt for a different level of filtering based on the needs of the organization. To learn more about Microsoft anti-spam policies, see https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-about.

    Step 3. Add Additional Email Domains (Optional)

    You configured your primary email domain in Step 1 of the wizard, above. Barracuda Networks recommends adding all Microsoft 365 accepted domains into Email Gateway Defense.

    Repeat these steps, as needed, for additional Microsoft 365 domains before continuing with the next step.

    Obtain the hostname:

    1. Log into the Microsoft 365 admin center.

    2. In the left pane, click Settings > Domains.

    3. In the Domains table, click on your domain.

    4. Take note of the hostname. This is the address of your destination mail server, for example, cudaware-com.mail.protection.outlook.com

    Enter the hostname:

    Barracuda Networks recommends using a hostname rather than an IP address so that you can move the destination mail server and update DNS records without making changes to the Email Gateway Defense configuration. This address indicates where Email Gateway Defense should direct inbound mail from the Internet to your Microsoft 365 Exchange server. For example, your domain displays to the Internet as: bess-domain.mail.protection.outlook.com

    1. Log into the Barracuda Cloud Control as administrator. In the left panel, click Email Gateway Defense. Select the Domains tab, then click Add Domain.

    2. Enter the domain name and destination mail server hostname obtained from your Microsoft 365 account:

    3. Click Add Domain; the Domain Settings page displays, listing the new domain.

    4. Verify that the domain is yours. Follow the instructions in How to Set Up MX Records for Domain Verification. Make sure that you see that the domain is successfully verified, then return to this page. 

      We value your feedback.
      If you have questions, suggestions, or feedback on our documentation, contact the Campus Product Documentation team.
      For general product inquiries or technical support, please contact the global Barracuda Support team.