Microsoft 365 Email Security: Gateway Routing and Setup

Choose an incoming security gateway

Microsoft 365 email security can include a separate SMTP gateway before Exchange Online. SecuraWall Email Protection is the base package for this route: enabled anti-spam, antivirus, phishing and attachment policies inspect supported incoming mail, with quarantine for IT review. Your mailboxes remain in Microsoft 365. Backup MX provides temporary queuing without content scanning. This guide describes a deployment approach, not a certified or tenant-tested integration.

Save the tenant destination before changing MX

Obtain your tenant-specific receiving endpoint from the Microsoft 365 domain configuration. In SecuraWall, save and verify that public endpoint as the manual delivery target before changing MX. The public domain MX must not be used to rediscover the destination after it points to the gateway: that would create a routing loop. Keep the original DNS and connector configuration for a controlled rollback.

Review connectors and the Office 365 spam filter

Review Exchange Online partner inbound connectors for the gateway route. Microsoft recommends Enhanced Filtering for Connectors for supported third-party filtering topologies so Microsoft can evaluate the original sending source. Do not apply a blanket spam-filter bypass just because mail comes from the gateway. Review Microsoft guidance for the actual topology, especially hybrid routing and intermediate hops. Existing Microsoft filtering continues to have its own configuration and decisions.

Plan bypass restrictions for the whole tenant

MX directs normal DNS-based delivery; it does not prevent direct delivery to the tenant endpoint. Evaluate supported source-IP or certificate restrictions on the receiving connector before enforcing them. Review all domains, applications and hybrid paths affected by a tenant-wide rule. An incoming gateway alone does not require adding SecuraWall as an outbound sender in your domain SPF. The optional SMTP Relay add-on has separate sending authorization and SPF requirements.

Validate delivery and keep integration scope clear

Use controlled mail to recipients you own. Follow the gateway scan, quarantine decision and destination SMTP response, then check the mailbox and Microsoft message trace. Test a known recipient, an invalid recipient and temporary destination failure separately. Remote SMTP acceptance is not inbox confirmation. This route does not provide Microsoft Graph mailbox scanning, post-delivery removal, Entra directory synchronization or Microsoft single sign-on. Those are separate capabilities and are not enabled by this guide.

References and service conditions

• Microsoft: third-party cloud mail flow
• Microsoft: Enhanced Filtering for Connectors
• Current plan limits
• Security responsibilities