After our recent post Introducing more control over Direct Send in Exchange Online, there have been more questions about scenarios that are not actually Direct Send such as senders being able to igno...
Updated Aug 07, 2025
Version 7.0
Blog Post
Mithun_Rathinam I already have an Inbound connector configured to access emails from our third-party email gateway where our MX records point and when I tried to hit abc-com.mail.protection.outlook.com it gives me the connector ID and says Inbound restricted.
However, I exported the report because I saw "Noconnector" in report and after I received report I saw only O365 (email address removed for privacy reasons) Reports logs only.
Does it mean we are already locked down and nothing to worry about RejectDirectSend, if it is still disabled in our environment? because we are still not sure if any traffic is still using through DirectSend as we have on-premise relay as well. ?
- Mithun_Rathinam
Microsoft
Yes Pankaj_Messaging_Specialist .If you have an inbound partner connector configured to lock down your tenant using parameters like RestrictDomainsToCertificate or RestrictDomainsToIPAddresses, then yes, you're covered.
In such cases, if someone attempts Direct Send, they will receive an error similar to the one shown below unless you have any other matching connectors to accept that email. This behavior is expected and confirms that the security configuration is working as intended.
Hello Mithun,
Do M365 service maintain logs which can tell if some threat Actor is trying to use/exploit MX connector against any Tenant. Tenant having partner connector as above will see email dropped before SMTP session complete so all tracking logs won't show such attempt.I am getting this when I tried to sent an email from external network.
- Mithun_Rathinam
This looks good. The partner connector is rejecting the direct connections as expected.
