Moving mx records to O365

skipster311-175 - Thanks for such a great question, and I'm super glad to hear you're going with MDO!

We have a detailed migration guide here you should find useful: Migrate from a third-party protection service to Microsoft Defender for Office 365 - Office 365 | Microsoft Docs

Speaking from my experience, I've done both the SCL-1 method detailed in the above guide, and your mentioned method of domain by domain. - Either way the desired outcome is the same, moving carefully and slowly to ensure minimal disruption, so that's completely up to you!

Regarding your comment for safe senders, my advice is that you shouldn't need to import a single safe sender, this brings legacy debt across to your new configuration and opens up holes in your protection stack. The good news however is that by moving slowly as you plan to, you can address senders one by one, sending test emails and then fixing issues with things like SPF/DKIM to ensure correct authentication and remove the need for a safe sender / allow list entry. 

However, these are sometimes required in situations where you don't control the sending infrastructure and for example the company who owns the sending infrastructure may not be in a position to support DKIM signing at this point in time - so I'd recommend using TABL here instead. (if however it's a false positive from our side, please report it to us so we can fix it!)

My final point is around preset policies, please do use them, it keeps everything up to date for you as / when we release new protection features, sets you up for continued success in the long term. - TABL will be honoured so if you do have to add a safe sender, this will be respected by the policy!

I wish you a really successful migration, and would love to hear how you get on, don't afraid to ask any other questions you may have, hopefully this has been helpful!

Thanks

Ben.