Configuring Inline with Hygiene mode

In the Microsoft Exchange admin center, select Other features.

Click the link in the Spam filter row. The Microsoft Defender 365 page opens.

Verify that the “Anti-spam inbound policy (Default)” spam filter's status is "Always on", then click on the policy. A pop-up window appears.

In the pop-up window, click Edit allowed and blocked senders and domains.

Under Domains, select Allow domains.

Click +Add domains and enter fireeyecloud.com as an allowed domain. Click Add domains.

Click Done to save your settings.

Click Save to save the allowed list.

In the Microsoft Exchange admin center, select Other features. Click the link in the Connection filter row. The Anti-spam policies page in Microsoft Defender 365 opens.

Select Connection filter policy (Default).

Click Edit connection filter policy.

Enter the first IP address corresponding with the geographic region of your Email Security - Cloud account in the Always allow messages from the following IP addresses or address range entry box. Then, enter the remaining IP addresses.

Click Save to save the rule configuration.

In the Microsoft Exchange admin center, click Mail flow > Connectors.

Click +Add a connector to create a new connector.

Set the Connection from value to Partner organization.

The default Connection to value is Office 365. Click Next.

Enter the connector name and description (optional).

Verify that the Turn it on checkbox is selected. Click Next.

Select By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization.

Enter the first sender IP address corresponding with the geographic region of your Email Security - Cloud account. Click the + button. Repeat this step for the remaining IP addresses.

Click Next.

Verify that the Reject email messages if they aren't sent over TLS option is selected. Click Next.

Note

This option ensures that all email is encrypted in transit.

Verify that the connector settings have been correctly configured, then click Create connector.

Click Done.

Go to the Microsoft security center. You must be an administrator.

Under Email & collaboration, select Policies & rules.

Click Threat policies.

Under Policies, select Anti-spam.

Select Anti-spam inbound policy (Default).

Click Edit spam threshold and properties.

Under SPF record: hard fail, select Off.

Click Save.

In the Microsoft Exchange admin center, click Mail flow > Rules.

Click +Add a rule, then select Create a new rule from the drop-down menu.

Enter a name for the rule.

Under the Apply this rule if section, select The sender > IP address is in any of these ranges or exactly matches. A pop-up window appears.

Enter the first sender IP address corresponding with the geographic region of your Email Security — Cloud account. Click Add. Then, repeat for the remaining IP addresses.

Click Save.

Under the Do the following section, select Modify the message properties > Set the spam confidence level (SCL). A pop-up window appears.

Verify that Bypass spam filtering is selected, then click Save.

Click Next.

Important

Do not select Stop processing more rules and do not change any other default settings. Doing so may interfere with how O365 processes spam messages.

Click Next. Review the rule configuration, then click Finish.

Verify that the rule is enabled and has a higher priority than any transport rules or rules with Stop processing more rules selected.

In the Microsoft Exchange admin center, click Mail flow > Connectors.

Click +Add a connector to create a new connector.

Set the Connection from value to Partner organization.

The default Connection to value is Office 365. Click Next.

Enter the connector name and description (optional).

Verify that the Turn it on checkbox is selected. Click Next.

Select By verifying that the sender domain matches one of the following domains.

In the domain name field, enter *, then click the + button.

Click Next.

Select Reject email messages if they aren't sent from within this IP address range.

Enter the first sender IP address corresponding with the geographic region of your Email Security — Cloud account. Click the + button. Repeat this step for the remaining IP addresses.

Note for multi-domain tenants with outbound scanning: If your Email Security - Cloud tenant hosts multiple associated domains and you have enabled Outbound Email Scanning, you must include both the Inbound and Outbound Trellix IP ranges in this list.

When an email is sent from one domain to another within the same tenant (e.g., Domain A to Domain B), Email Security - Cloud processes the outbound message and routes it back to O365 via its outbound delivery IPs. If this connector only includes Inbound IPs, internal messages between your domains will be rejected.

Click Next.

Click Create connector.

Click Done.