Windows Office Hours: September 28, 2023

My comment was deleted with no information about why. I'll try one more time... A customer is facing an issue with emails sent to "customername.onmicrosoft.com" email addresses. They want those emails sent to such aliases (default email addresses are using customer's custom domain) to be routed to a 3rd party security solution. Microsoft official response was to have them routed through and ETR (Exchange Transport Rule), which never worked. We found later the reason is because transport rules apply after the recipient is resolved and the post-resolution email address is changed to the user custom domain bypassing the rule. We have spent many many hours in calls with Microsoft Support without a fully working solution. We don't want the 3rd party solution to be configured by Microsoft, just all traffic sent to "customerdomain.onmicrosoft.com" email addresses routed to it. This was easily done for the custom domain (pointed the DNS MX record to the 3rd party gateway), but there is no such option to the same for the "*.onmicrosoft.com" domains (although Microsoft owns these, onmicrosoft.com subdomains are independent from its parent and it should be possible), only TXT records can be managed for them. Anyways... I was hoping to find any help about this on this session. Any help would be great! Thank you!

Is there anyway to get a device out of Windows 11 Insider Preview without having to reset the OS on the device? We have found no luck with any other options?

In relation to the changes in Windows Server registry to address CVE-2022-37966 and CVE-2022-37967, October is approaching fast, I am not sure if the Microsoft Updates should add registry to the system or not. Initially I understood the registry need to be modified by the sysadmin but that this may imply that registry are installed - added by the patch. Can you expand on this or have a full work-around related to Kerberos changes in AD? Thank you.

What is the best way to deploy an app by using Intune - by the msi or should that be converted into an exe?

Intune Question Regarding Update Rings - we have an issue where Intune updated machines to Windows 11 Insider Preview that were on Windows 10 and when you attempted to manually update them to Windows 11 the machine was not eligible because of the processor, etc. How did Intune update those machines to Windows 11 Preview if you manually attempted to update to Windows 11 and was stopped.

At work, I faced a situation with a customer trying to route all emails sent to their users but through "*@customername.onmicrosoft.com" email addresses. They don't use Microsoft Defender but a different security solution, which is why they want to route all email traffic (including those emails sent to "customername.onmicrosoft.com" email addresses) to it. This was easily done for their custom domain (customername.com) by changing the DNS MX record and point it to their security solution, but there is no such option to do that for the "customername.onmicrosoft.com" domain in the M365 Admin Center (it only has the option to handle TXT records not MX records). We have spent many many hours in calls with Microsoft Support without any fully successful solution to do this just because the security solution is not the one provided by Microsoft (which I believe is non-sense, because we are not trying Microsoft to configure the 3rd party security system for us, just route the email received by Microsoft - *.onmicrosoft.com domains belong to Microsoft - to it). Official Microsoft documentation says the way this could be achieved is through an ETR (Exchange Transport Rule), but we configured it as instructed (in different Tenants, including a brand new testing one) and it doesn't work (emails are just not getting routed or other issues like quarantined emails and problems forwarding meetings appeared). We found then the reason is because transport rules apply after the recipient is resolved and the post-resolution email address is changed to the user custom domain (which is the user's primary email address) so the ETR is bypassed. Another possible complications is that user's Default domain is still the Fallback domain, not their own custom domain, but we got the exact same experience on another M365 Tenant with the custom domain set as the Default one anyways. I found about Windows Office Hours and I was hoping to find anyone who can help me check if there is any other easier, simpler, or cleaner solution to do this routing. I would really appreciate any help on this matter! 🙏