Configure Enhanced Filtering and trusted ARC sealers behind a third-party mail gateway

Description

When inbound mail reaches Exchange Online through another service:

• the partner inbound connector used by that service has Enhanced Filtering for Connectors turned on (Automatically detect and skip the last IP address, or the list of the service's IP addresses to skip), applied to all recipients;
• if the service modifies messages (banners, link rewriting) and seals them with ARC, its sealing domain is listed as a trusted ARC sealer;
• the inbound connector identifies the service by its IP addresses or certificate.

Rationale

Without Enhanced Filtering, Exchange Online sees the gateway as the sender: SPF checks the wrong IP address, DMARC and spoof intelligence work on broken results, and IP reputation is lost. The result is both missed forgeries and false positives, and admins tend to answer with broad allow rules. Trusted ARC sealers let Exchange Online use the authentication results the gateway saw before it changed the message.

Impact

Detection becomes stricter: messages previously trusted because they came through the gateway can now be marked as spoofed or spam. Turn Enhanced Filtering on for a test group first if the gateway's own policies were relied on.

Applies when

Only when the MX record of at least one accepted domain points to a service other than Exchange Online Protection (*.mail.protection.outlook.com), such as a third-party secure email gateway or an on-premises relay.

Audit

1. Check the MX records of the accepted domains (Resolve-DnsName example.com -Type MX). If all of them point to *.mail.protection.outlook.com, the control does not apply.
2. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader. Browse to Email & collaboration > Policies & rules > Threat policies > Enhanced filtering and open the connector used by the gateway. Check that Automatically detect and skip the last IP address or Skip these IP addresses is set and that it applies to all recipients.
3. Browse to Threat policies > Email authentication settings > ARC and check that the gateway's sealing domain is listed when the gateway signs with ARC.
4. In Exchange Online PowerShell (read-only):

   Get-InboundConnector | Format-List Name, Enabled, ConnectorType, SenderIPAddresses, TlsSenderCertificateName, EFSkipLastIP, EFSkipIPs, EFUsers
   Get-ArcConfig | Format-List ArcTrustedSealers
   

5. Fail if the gateway's connector has neither EFSkipLastIP nor EFSkipIPs set, if EFUsers limits it to some recipients, or if a sealing gateway is missing from ArcTrustedSealers.

Remediation

1. In the Defender portal, browse to Threat policies > Enhanced filtering, select the gateway's connector, choose Automatically detect and skip the last IP address (or list the gateway's IP addresses), select Apply to entire organization and save.
2. If the gateway seals with ARC, browse to Email authentication settings > ARC and add its sealing domain.
3. PowerShell equivalent (Security Administrator):

   Set-InboundConnector -Identity "<gateway connector>" -EFSkipLastIP $true -EFUsers $null
   Set-ArcConfig -Identity Default -ArcTrustedSealers "gateway.example.net"
   

4. Review the detections for a few days in Threat Explorer or the mail flow reports.

Rollback

Set-InboundConnector -Identity "<gateway connector>" -EFSkipLastIP $false -EFSkipIPs $null.

References

• Enhanced Filtering for Connectors in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Configure trusted ARC sealers Microsoft, vendor-doc, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-233, ORCA-233-1, ORCA-243) Microsoft (community project), tool, accessed 2026-10-24
• ASD Blueprint for Secure Cloud - Connectors Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-017 Honor the sender's DMARC policy for inbound spoofed mail
• related CB-M365-MAIL-036 Require TLS and restrict partners on Exchange Online connectors

People and lifecycle