Forum Discussion
Solved
bulk block the IP addresses in exchange online?
We check the regular sign-in attempt failures in Azure ctive directory and block multiple IP addresses from the Exchange online admin center.
We have atleast 40-50 IP addresses to be blocked in each instance. I dont see any option to bulk block the IP addresses in connection filtering in exchange online.
I didn't find any PS script either. Any leads would be appreciated.
Looks to me like you want to block auth attempts, not messages coming from those IPs, right? If so, the best way to do it is via Client Access Rules, which allow you to specify allowed/blocked IPs per protocol: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules
Or you can even block legacy auth altogether via auth polices: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online?redirectSourcePath=%252fen-us%252farticle%252fdisable-basic-authentication-in-exchange-online-bba2059a-7242-41d0-bb3f-baaf7ec1abd7
Looks to me like you want to block auth attempts, not messages coming from those IPs, right? If so, the best way to do it is via Client Access Rules, which allow you to specify allowed/blocked IPs per protocol: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/client-access-rules/client-access-rules
Or you can even block legacy auth altogether via auth polices: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online?redirectSourcePath=%252fen-us%252farticle%252fdisable-basic-authentication-in-exchange-online-bba2059a-7242-41d0-bb3f-baaf7ec1abd7
yes, this looks good. thank you guys!
- Hi,
Use Powershell to set the Connection Filter Policy
https://docs.microsoft.com/en-us/powershell/module/exchange/antispam-antimalware/set-hostedconnectionfilterpolicy?view=exchange-ps
Hope that answers your question
Best, ChrisChrisHoardMVP : thanks for your reply.
I had one doubt: the IP addresses which I want to block do not have a specific range. For eg:
Following are the samples which I want to block:
1.255.70.86
119.146.145.50
123.20.162.164
180.248.139.10
14.247.25.62
61.160.25.118
97.34.128.216
219.154.66.223Sometimes I have to block 200 of these different IP addresses. Is there any other way to achieve this?
thank you again
- Hi!
See the examples in that article - they don’t need to be in ranges you would just have them in commas and separated by dashes.
Hope that helps!
Best, Chris
