Require TLS and restrict partners on Exchange Online connectors

Description

Every enabled connector is defined as narrowly as possible:

• partner and on-premises inbound connectors require TLS (RequireTls $true) and identify the sender by its certificate (TlsSenderCertificateName, RestrictDomainsToCertificate $true) or by its IP addresses (SenderIPAddresses, RestrictDomainsToIPAddresses $true); SenderDomains lists named domains, not *, unless the connector is restricted by certificate or IP address;
• outbound connectors to partners or smart hosts use TLS with certificate validation (TlsSettings set to CertificateValidation or DomainValidation, never empty or EncryptionOnly) and list named recipient domains;
• connectors that are no longer used are removed.

Rationale

Partner connectors usually carry sensitive exchanges (finance, legal, subsidiaries). Without enforced TLS and certificate checks, the traffic can be read or redirected by a network attacker. An inbound connector that trusts a domain without checking the source lets anyone send as that domain with the trust the connector grants.

Impact

Partners whose servers do not present a valid certificate, or whose IP addresses changed, can no longer deliver through the connector. Agree on certificates and addresses with each partner and test with a validation run before enforcing.

Audit

1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader.
2. Browse to Mail flow > Connectors and open each enabled connector.
3. In Exchange Online PowerShell (read-only):

   Get-InboundConnector | Format-List Name, Enabled, ConnectorType, SenderDomains, SenderIPAddresses, RequireTls,
     TlsSenderCertificateName, RestrictDomainsToCertificate, RestrictDomainsToIPAddresses
   Get-OutboundConnector | Format-List Name, Enabled, ConnectorType, RecipientDomains, SmartHosts, UseMXRecord, TlsSettings, TlsDomain
   

4. Fail if a partner or on-premises inbound connector has RequireTls set to False, or is restricted neither by certificate nor by IP address; if an outbound connector has TlsSettings empty or EncryptionOnly; or if an enabled connector has no documented owner.

Remediation

1. For each connector, confirm its purpose, owner and partner with the business; remove unused ones.
2. In the Exchange admin center, Mail flow > Connectors, edit the connector (Exchange Administrator): require TLS, identify the partner by certificate or IP address, and for outbound connectors require a trusted certificate (and the expected domain name).
3. PowerShell equivalent:

   Set-InboundConnector -Identity "<partner>" -RequireTls $true -TlsSenderCertificateName "mail.partner.example" -RestrictDomainsToCertificate $true
   Set-OutboundConnector -Identity "<partner>" -TlsSettings DomainValidation -TlsDomain "mail.partner.example"
   

4. Run Validate this connector in the Exchange admin center after each change.

Rollback

Restore the previous connector settings (-RequireTls $false, -TlsSettings EncryptionOnly) while the partner fixes its certificate.

References

• Set up connectors for secure mail flow with a partner organization Microsoft, vendor-doc, accessed 2026-10-24
• Set-InboundConnector Microsoft, vendor-doc, accessed 2026-10-24
• Set-OutboundConnector Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud - Connectors Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-010 Reject Direct Send messages that claim to come from the organization
• related CB-M365-MAIL-018 Configure Enhanced Filtering and trusted ARC sealers behind a third-party mail gateway

People and lifecycle