Office 365 ATP in conjunction with a Third Party spam filter

[bdelamotte83]

Hi,

I'm just after any advice, experience, comments, lessons learned, etc in relation to using Office 365 Advanced Threat Protection to enhance anti-spam capabilities for Exchange Online.....but in a scenario where the anti-spam is being handled by an external service and not EOP.

* Should we do this?

* Does ATP lose some of it's capabilities when the filtered mail from the external spam filter is treated as clean (SCL -1 or equivalent)?

* If there is no sender rewrite by the third party spam filter, does ATP mailbox intelligence or anti-phishing policies even work?

* Anything to add would be welcome here really

Regards

[#2 · Accepted solution]

Hi

Officially it’s not recommended or supported. See article

https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-part...

This is because it can impact functionality with EOP such as track and trace, spam and phishing filtering and reporting. As ATP works with EOP this would have a knock on effect to ATP.

I am sure that organisations have implemented it in this way but referring to the document above it’s not recommended

Hope that answers your question

Best, Chris

[#3]

@Christopher Hoard Thanks for the feedback, cheers

[#4]

@bdelamotte83 So I don't know if you're still looking for an answer to this, but it certainly is possible and it works well. Microsoft has even built functionality in to Office 365 to allow for this, they just don't recommend it because (of course) they prefer you use their product as opposed to someone else's.

I'm writing this assuming you route your email through a third-party email security gateway, which then passes email along to Office 365. The feature you are looking for is called Enhanced Filtering for Connectors in Exchange Online: "Enhanced Filtering for Connectors (also known as "skip listing") allows you to filter email based on the actual source of messages that arrive over the inbound connector." In fact, this feature is designed just for the scenario you're describing: "Enhanced Filtering for Connectors is meant to show the value of Exchange Online Protection (EOP) and Advanced Threat Protection (ATP) ... Although it is possible to keep Enhanced Filtering enabled as a permanent solution..."

We use Proofpoint's email security gateway and wondered the same thing as you - can we layer on Exchange EOP protection in order to increase email security for our end users? The answer is yes, and we've just rolled this out to our entire organization. Using this feature also allows you to see what sort of emails EOP would have blocked without actually blocking them. EOP still analyzes the emails, but if you have a rule bypassing this filtering, it won't actively block them until this rule is in place.

I'm happy to give you more details on how exactly this works and how you can perform phased testing for some users - let me know if you're interested. There is not a lot of documentation on the mechanics of enhanced filtering, but I can attest to the fact that it works well, blocking a lot of additional phishing, BEC, and junk email that Proofpoint doesn't catch.

[#5]

@Alex Rourke Hi Alex, I would be very interested to know how you set up the Enhanced Filtering for Connectors is conjunction with your third party spam filter solution. I am trying to do the exact same thing because I realized our 3rd party solution was not able to block some phishing attempts that Microsoft was able to spot but because we have a rule in place that set confidence level to -1 to all incoming email from our 3rd party provider, somes users end up receiving bad emails in their mailbox. I think the EFFC would fix this but I want to make sure I configure it properly. Thanks in advance for your help!