Connector Mode Setup

Updated 6 days ago by admin

Connector Mode is an alternative mail delivery method to using DNS based MX record redirection. It provides a quick and easy onboarding process for the Email Security product and provides additional capabilities such as a consolidated email quarantine within Microsoft 365.

This mode is only available for customers using Microsoft 365.

To set up the Connector Mode, follow the steps below:

  1. Visit the  Security Modules -> Email Security -> Product Configuration -> Domains

If you are setting up Email Security for the first time, you will be prompted to select the desired mode. If you are a Microsoft 365 customer, click the Connector Mode tile and continue with this guide.

If you are an existing customer and have MX record mode configured, but want to migrate to Connector Mode then you can click the Migrate to Connector Mode button:

  1. The Connector Mode wizard will open in a new browser window.
  2. Provide the Microsoft 365 domain you want to connect to the Email Security system. It should be a domain you use for email exchange.
    1. The domain you enter must have its MX records pointing to Microsoft 365. If you have an existing domain and are migrating to Connector Mode, we recommend you contact your Service Provider to discuss the process first.
    2. If you receive a Permission Error make sure you are signed out of any Microsoft 365 accounts that do not relate to the domain you have chosen.
  3. Select the quarantine type that you would like to use. Two quarantine types are available now:
    1. Default Email Security Quarantine: All emails scanned by the Email Security system and processed by the Quarantines action are sent to the Global Quarantine within the dashboard. This fully supports Global and Personal (end-user) quarantines.
    2. Microsoft 365 Quarantine: All emails scanned by the Email Security system and processed by the Quarantine actions are sent to the Quarantine within Microsoft 365. You can manage such emails via the Microsoft Defender portal in the same way as emails quarantined by Microsoft 365.
Microsoft 365 supports end-user quarantine only for inbound emails, therefore if a rule with the M365 User Quarantine final action or the Add to M365 Admin Quarantine action triggers for an outbound email, this email will be redirected to the Microsoft 365 Admin quarantine only.
  1. You will be redirected to the Microsoft Permission Request page to grant the required permission for the Connector Mode application.
    The Permission Request will be sent only during the first Connector Mode setup. For the reset action (removing Connector Mode), it will be skipped as long as all required permissions have already been granted.
  2. Click the Accept button and you will be redirected back to the Connector Mode wizard. The Email Security system will register the Connector Mode application within Microsoft Entra ID and assign the Exchange Administrator role.
  3. Confirm the creation of the required connectors and the transport rules. The Email Security system will create the following connectors and transport rules in your Microsoft 365 account.

Connector

Description

Email Security (clouduss.com) to M365 

Emails will be resent from the Email Security inbound server to the Microsoft 365 server.

M365 to Email Security (clouduss.com) Outbound

Emails will be resent from the Microsoft 365 server to the Email Security inbound server.

M365 to Email Security (clouduss.com) Inbound

Emails will be resent from the Microsoft 365 server to the Email Security outbound server.

Email Security (clouduss.com) Outbound to M365 Quarantine

Outbound emails that have triggered rules with Quarantine actions will be resent from the Email Security outbound server to the Microsoft 365 server.

Transport Rule

Description

What it does

Email Security (clouduss.com) Allow List

It reset the spam confidence level (SCL) to -1 for all emails sent from the Email Security servers.

It checks that an email comes from one of the Email Security IP addresses, and, sets the SCL to -1 for this email.

Email Security (clouduss.com) Inbound Mail Protection

It triggers if an email comes from outside the organisation (domain).

It uses the Email Security (clouduss.com) MTA Inbound connector to take an email from the Microsoft 365 server to the Email Security inbound server. Also, it adds the <domain>,incoming header to an email.

 

Email Security (clouduss.com) Outbound Mail Protection

It triggers if an email goes from inside the organisation to an external domain.

It uses Email Security (clouduss.com) External Outbound to send an email from the Microsoft 365 server to the Email Security outbound server. Also, it adds the <domain>,outgoing header to an email.

Email Security (clouduss.com) Internal Mail Protection

It triggers if an email is sent from one user to another user within the organisation.

The same as for Email Security (clouduss.com) Inbound Mail Protection transport rule.

(not active as part of Early Access)

Email Security (clouduss.com) - End-User Quarantine

It redirects the quarantined emails to the Microsoft end-user quarantine if the Microsoft 365 Quarantine option is selected.

It checks that an email originates from one of the Email Security IP addresses, and the X-CLOUD-ES-QUARANTINE header contains 'spam’, then sets the Audit severity level to High and the spam confidence level (SCL) to 7.

Email Security (clouduss.com) - Admin Quarantine

It redirects the quarantined emails to the Microsoft admin quarantine if the Microsoft 365 Quarantine option is selected.

It checks that an email originates from one of the Email Security IP addresses, and the X-CLOUD-ES-QUARANTINE header contains ‘admin’, then sets the Audit severity level to High, delivers the message to the hosted quarantine, and then stops processing other rules.

If the registration is successful, your mail flow will be altered to send emails to the Email Security system for scanning and, after that, return them to Microsoft 365.
  1. Optionally, you can review your Connector and Transport rules within Microsoft 365 using the following links:
If you have previously configured Connector Mode on this tenant and therefore the Connector or Transport rules already exist in the specified tenant, you must confirm that they will be overwritten, losing any customisations that you may have made.
  1. If you have selected the Microsoft 365 Quarantine, confirm the creation of the Quarantine Policy, the Anti-Spam Policy, and Quarantine Transport rules as part of the installation process
  2. The Email Security system will finish the Connector Mode configuration by performing an automated configuration of the Email Security product. For reference, these steps are described below:
  • Adds the domain name and the Exchange email server address for delivery to Security Modules -> Email Security -> Domains
  • Creates a new M365 Domain custom rule data with the Microsoft 365 domain value in Security Modules -> Email Security -> Custom Rule Data
  • Creates a new TLS Enforced rule in Security Modules -> Email Security -> Message Rules
  • If the Microsoft 365 Quarantine option is selected, replace Email Security quarantine actions with the corresponding actions for Microsoft 365 quarantine
These are standard setup steps for the Email Security product and are simply automated as part of the Connector Mode wizard. No action is required on your side.
  1. When the automatic configuration is finished, configure automatic synchronisation of your organisation’s mailboxes (email addresses) using Active Directory or Entra ID. Follow this guide for instructions.
  2. Add the SPF record provided to your domain. Assuming your domain is registered with Microsoft, please follow these steps. If your domain is hosted elsewhere, consult your Domain Registrar instructions for adding an SPF record.
    1. Visit the Microsoft 365 Admin Center -> Domains
    2. Select the domain you have configured with the Connector Mode wizard and navigate to the DNS records tab:
    3. Add the SPF record to your DNS record in the following format:
    Copy the suggested SPF record from the Connector Mode setup dashboard. Without this record, destination SMTP servers can reject emails coming from the Email Security MTA servers. 
v=spf1 ip4:xx.xx.xx.xx include:spf.protection.outlook.com -all

Where xx.xx.xx.xx is your outgoing SMTP server IP address.

  1. The Connector Mode setup is now complete

Removing Connector Mode

If you wish to remove the Connector Mode, follow these steps:

  1. Navigate to Security Modules -> Email Security -> Product Configuration -> Domains
  2. Click the Reconfigure Connector Mode button
  3. The Connector Mode uninstall wizard opens in a new tab
  4. Details for the configured domain will be shown. Click confirm and the configuration will be removed
  5. Email flow will return to the standard Microsoft 365 delivery rules. If you wish to return to DNS based MX record mode with Email Security, please follow the Getting Started guide.

How did we do?