After our recent post Introducing more control over Direct Send in Exchange Online, there have been more questions about scenarios that are not actually Direct Send such as senders being able to igno...
Updated Aug 07, 2025
Version 7.0
Blog Post
Our MX records point to a 3rd party service, and we have a Partner Inbound connector for it with defined IP addresses and RestrictDomainsToIPAddresses is currently $false. We are considering our options including enabling that setting. However, we have other Inbound Partner connectors for specific senders with their IP addresses and the restriction on those is also set to $false.
To lock down our organization must we enable RestrictDomainsToIPAddresses on all Partner Inbound connectors, or is it a global setting that is effective across the organization when it's set on the first connector?
The multiple Partner Inbound connectors were set up before I joined the org and those folks are gone. Is there any advantage or disadvantage to having multiple Partner connectors if the settings are the same other than the IP Addresses? Without a purpose different than the others, they feel redundant.
Thank you for clarifying Direct Send and its behavior.
- Mithun_Rathinam
Microsoft
Secret_Work_Persona , Having multiple inbound partner connectors is acceptable based on your requirements.
However, to lock down your tenant, you can configure the RestrictDomainsToIPAddresses setting in the inbound partner connector that uses a sender domain of * and includes the IP addresses of your third-party service. This ensures that:
- While other connectors for specific senders continue to accept emails from their respective sources ( For ex: Direct send to MX record endpoint)
- The connector with the restriction will reject any emails that originate from unauthorized sources, even if they claim to be from your domain.
Thank you for the response. So I'm clear, enabling the RestrictDomainsToIPAddresses setting on one inbound connector locks down the tenant even though that setting is not set on other inbound connectors.
