{
  "id": "CB-M365-MAIL-036",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-036",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-036.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-036.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-036",
    "title": "Require TLS and restrict partners on Exchange Online connectors",
    "finding": {
      "title": "Exchange Online connectors accept or send partner mail without enforced TLS or sender restriction",
      "description": "Mail exchanged with partners can travel in clear text or be intercepted, and a loosely defined inbound connector can be abused by anyone who matches it."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "connectors",
      "tls",
      "mail-flow",
      "partners"
    ],
    "description": "Every enabled connector is defined as narrowly as possible:\n\n- partner and on-premises inbound connectors require TLS (`RequireTls $true`) and identify the\n  sender by its certificate (`TlsSenderCertificateName`, `RestrictDomainsToCertificate $true`) or\n  by its IP addresses (`SenderIPAddresses`, `RestrictDomainsToIPAddresses $true`); `SenderDomains`\n  lists named domains, not `*`, unless the connector is restricted by certificate or IP address;\n- outbound connectors to partners or smart hosts use TLS with certificate validation\n  (`TlsSettings` set to `CertificateValidation` or `DomainValidation`, never empty or\n  `EncryptionOnly`) and list named recipient domains;\n- connectors that are no longer used are removed.\n",
    "rationale": "Partner connectors usually carry sensitive exchanges (finance, legal, subsidiaries). Without\nenforced TLS and certificate checks, the traffic can be read or redirected by a network attacker.\nAn inbound connector that trusts a domain without checking the source lets anyone send as that\ndomain with the trust the connector grants.\n",
    "impact": "Partners whose servers do not present a valid certificate, or whose IP addresses changed, can no\nlonger deliver through the connector. Agree on certificates and addresses with each partner and\ntest with a validation run before enforcing.\n",
    "audit": {
      "manual": "1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Mail flow** > **Connectors** and open each enabled connector.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-InboundConnector | Format-List Name, Enabled, ConnectorType, SenderDomains, SenderIPAddresses, RequireTls,\n     TlsSenderCertificateName, RestrictDomainsToCertificate, RestrictDomainsToIPAddresses\n   Get-OutboundConnector | Format-List Name, Enabled, ConnectorType, RecipientDomains, SmartHosts, UseMXRecord, TlsSettings, TlsDomain\n   ```\n4. Fail if a partner or on-premises inbound connector has `RequireTls` set to `False`, or is\n   restricted neither by certificate nor by IP address; if an outbound connector has\n   `TlsSettings` empty or `EncryptionOnly`; or if an enabled connector has no documented owner.\n"
    },
    "remediation": {
      "manual": "1. For each connector, confirm its purpose, owner and partner with the business; remove unused\n   ones.\n2. In the Exchange admin center, **Mail flow** > **Connectors**, edit the connector (Exchange\n   Administrator): require TLS, identify the partner by certificate or IP address, and for\n   outbound connectors require a trusted certificate (and the expected domain name).\n3. PowerShell equivalent:\n   ```powershell\n   Set-InboundConnector -Identity \"<partner>\" -RequireTls $true -TlsSenderCertificateName \"mail.partner.example\" -RestrictDomainsToCertificate $true\n   Set-OutboundConnector -Identity \"<partner>\" -TlsSettings DomainValidation -TlsDomain \"mail.partner.example\"\n   ```\n4. Run **Validate this connector** in the Exchange admin center after each change.\n",
      "rollback": "Restore the previous connector settings (`-RequireTls $false`, `-TlsSettings EncryptionOnly`) while\nthe partner fixes its certificate.\n"
    },
    "references": [
      {
        "title": "Set up connectors for secure mail flow with a partner organization",
        "url": "https://learn.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-for-secure-mail-flow-with-a-partner",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-InboundConnector",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-inboundconnector",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OutboundConnector",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-outboundconnector",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud - Connectors",
        "url": "https://blueprint.asd.gov.au/configuration/exchange-online/mail-flow/connectors/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-8(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      },
      {
        "framework": "mitre-attack",
        "id": "T1040"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-010",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-018",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}