Prevent Direct Delivery for Exchange Online, 9/17

Please see the following scheduled Information Technology Services (ITS) maintenance process:

Date: Thursday, Sept. 17, 2024                        

Start Time: 8 p.m.
End Time: 10 p.m.

The following work is being completed: A threat actor may attempt to circumvent any third-party filtering gateway by sending an external email directly to Microsoft 365 without following the MX record e.g., send to example-com.mail.protection.outlook.com instead of using the MX records for your Proofpoint Protection Server. However, Microsoft too may choose to send directly for some Microsoft services e.g., Teams, Skype, Yammer, or Sharepoint. 

The auditing rules have been put into place and the logs have been reviewed and additional legitimate senders have been added. No additional legitimate senders have shown up for a few weeks and the reject rule can now be enforced and direct sending can be blocked. This currently accounts for about 10-25,000 messages/day, most are advertisements.

This will reject all emails that are sent directly to Microsoft and not through ProofPoint our MX hosts. If you are using devices that send emails using SMTP, please ensure that your settings are pointing to WSU’s SMTP servers and not Microsoft’s or your device’s email will be rejected.

More information about using WSU’s SMTP services.

All affected groups: While this will effectively prevent external abuse by enforcing the MX requirements, internal senders that are sending directly to Microsoft (possibly devices like printers, and network appliances) should be updated to use WSU’s SMTP services instead.

All processes affected: Inbound emails that are sent directly to Microsoft. The vast majority of these are Bulk mails from external companies.

Duration of impact: This change should take about 15 minutes.

Follow up steps customers need to take: Individual email issues should be resolved by subscribing to lists and conducting transactions using the external email address or using the WSU email address instead. Concerns can be submitted to the Crimson Service Desk for follow up.

Questions? Please contact mark.bradt@wsu.edu with any questions regarding this change.