Blog Post

Exchange Team Blog
1 MIN READ

Directory Based Edge Blocking for Exchange Online Protection

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Oct 24, 2013

We have received consistent feedback from our customers that the ability to reject messages for invalid recipients at the service network perimeter is important. We are aggressively working to design a solution that will make Directory Based Edge Blocking (DBEB) available within Exchange Online Protection (EOP).  This functionality is targeted to be added to the service in the first quarter of 2014.

In the meantime, here are some suggested configurations to help customers who want this type of capability until the service is able to offer recipient validation:  

  • Enabling Recipient filteringon-premises on your Exchange servers.  This is the recommended solution until the EOP functionality is available. This essentially adds one step to the process of communications.  EOP will communicate with your Exchange servers and then Exchange recipient filtering can handle as configured:  
    • Customer Concern:  Increased load on on-premises servers?
    • Microsoft response:  Impact to the customer’s servers should be minimal. The Recipient Validation feature will reject recipients after the RCPT TO:  command within the SMTP conversation well before accepting the message into the org.  Because of this the resources expended are very minimal and the cost of NDR generation is on the EOP side which will result in minimal impact to your on-premises servers.
  • Transport rules can be used to mimic the behavior as well, and would have to be tested to each customers' desired configuration.

Wendy Wilkes
Senior Program Manager
Office 365 Customer Experience

Updated 11/21/2013 to include the target release timeframe.

Updated Jul 01, 2019
Version 2.0
announcements
exchange online
security

14 Comments

Show More
  • Anonymous's avatar
    Anonymous
    Oct 24, 2013

    FOPE Standalone customers who are currently using DBEB in FOPE will not be migrated to Office 365 until this feature has been added to EOP. We have a feature comparison table available that compares FOPE to EOP.

    http://technet.microsoft.com/en-us/library/dn305011(v=exchg.150).aspx

    technet.microsoft.com/.../dn305011(v=exchg.150).aspx

  • Anonymous's avatar
    Anonymous
    Oct 24, 2013

    You already *have* a mechanism in-place with Exchange that will work whether Exchange is the internal edge or not -- EdgeSync subscriptions. Implement them from the EOP side. BOOM.

  • Anonymous's avatar
    Anonymous
    Oct 24, 2013

    Well this is unnerving.  Why isn't the fact that this feature is missing from EOP stated anywhere on the communications I've received from Microsoft about the transition?   Those emails, and the website they direct me to, make no mention about losing any features that are currently present in FOPE.   In fact, the email I received says "As part of the transition we will move all of your policy settings and configuration to the new service".    Apparently "all" doesn't mean what I thought it meant.   Recipient validation I would think is part of "all" the policies we have set up today.   And another commentor, Kevin, strongly implies EUQ being gone too, is that true?  If so, that will be a huge problem for us.   I have to plan to retrain 10,000 users if that's the case, as well as find another product to re-implement that functionality.

    What else haven't you told us?   What else is missing from EOP that we are using today in FOPE?  I *NEED* to know this to plan effectively.    "Leave the work to us" suddenly sounds like a good way to be in front of management the day after the transition explaining why things aren't working the way they did previously.

    My confidence is a bit shaken, to say the least.  Maybe it's time to shop for another service that has better communication with their customers.   Or that doesn't put you through an "upgrade" that removes features you are already paying for, and rely upon.

  • Anonymous's avatar
    Anonymous
    Oct 24, 2013

    Your suggestions assume that Exchange is the internal edge within the organization. That is not our architecture. Even if it were, we had assumed that the edge services we are purchasing from Microsoft would have functionality common to all edge service offerings. Next thing you'll be telling us the end user quarantine is gone. Oh, wait.

    Perhaps you could consider spinning off the former FOPE as a separate company, maybe call it FrontBridge, so that your customers will have an alternative that offers a full set of edge service functionality.