Skip to content

Commit fd634a9

Browse files
Maddy-CloudflareMaddy-Cloudflare
committed
[Email Security] Add M365 MX/Inline use cases
1 parent b704e64 commit fd634a9

File tree

13 files changed

+435
-0
lines changed

13 files changed

+435
-0
lines changed

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/microsoft365-email-security-mx.mdx‎ renamed to ‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx‎

File renamed without changes.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/five-junk-admin-quarantine.mdx‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: 5 - Junk email folder and administrative quarantine
3+
pcx_content_type: integration-guide
4+
updated: 2023-01-12
5+
sidebar:
6+
order: 5
7+
head:
8+
- tag: title
9+
content: Deliver emails to the junk email folder - Office 365
10+
11+
---
12+
13+
import { Render } from "~/components"
14+
15+
In this tutorial, you will learn to deliver `SUSPICIOUS` and `BULK` messages to the user's junk email folder, and `MALICIOUS`, `SPAM`, and `SPOOF` messages to the Administrative Quarantine (this requires an administrator to release the emails).
16+
17+
## Configure domains
18+
19+
<Render file="email-security/deployment/m365-use-case-configure-domain" params={{ one: "Do not check any dispositions." }} />
20+
21+
## Configure anti-spam policies
22+
23+
<Render file="email-security/deployment/m365-use-cases-antispam" params={{ one: "_AdminOnlyAccessPolicy_", two: "_AdminOnlyAccessPolicy_", three: "_AdminOnlyAccessPolicy_", four: "step7-adminonly-case5.png" }} />
24+
25+
## Create transport rules
26+
27+
<Render file="email-security/deployment/m365-use-case-transport-rules" params={{ one: "Email Security Deliver to Junk Email folder`", two: "`SUSPICIOUS`, `BULK`", three: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules.png", five: "`Email Security Admin Managed Host Quarantine`", six: " `MALICIOUS`, `UCE`, `SPOOF`", seven: "_Redirect the message to_ > _hosted quarantine_", eight: "step10-hosted-quarantine-case5.png" }} />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/four-user-quarantine-admin-quarantine.mdx‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: 4 - User managed quarantine and administrative quarantine
3+
pcx_content_type: integration-guide
4+
updated: 2023-01-12
5+
sidebar:
6+
order: 4
7+
head:
8+
- tag: title
9+
content: User managed quarantine and administrative quarantine - Office 365
10+
11+
---
12+
13+
import { Render } from "~/components"
14+
15+
In this tutorial, you will learn to deliver `SPAM` and `SPOOF` messages to the user managed quarantine, and `MALICIOUS` messages to the administrative quarantine (this requires an administrator to release the emails).
16+
17+
## Configure domains
18+
19+
<Render file="email-security/deployment/m365-use-case-configure-domain" params={{ one: "Do not check any dispositions." }} />
20+
21+
## Create quarantine policies
22+
23+
<Render file="email-security/deployment/m365-use-case-2-4-create-quarantine-policy" />
24+
25+
## Configure quarantine notifications
26+
27+
<Render file="email-security/deployment/m365-use-case-configure-quarantine-notifications" />
28+
29+
## Configure anti-spam policies
30+
31+
To configure anti-spam policies:
32+
33+
1. Open the [Microsoft 365 Defender console](https://security.microsoft.com/)
34+
35+
2. Go to **Email & collaboration** > **Policies & rules**.
36+
37+
3. Select **Threat policies**.
38+
39+
4. Under **Policies**, select **Anti-spam**.
40+
41+
5. Select the **Anti-spam inbound policy (Default)** text (not the checkbox).
42+
43+
6. In the **Actions** section, scroll down and select **Edit actions**.
44+
45+
7. Set the following conditions and actions (you might need to scroll up or down to find them):
46+
47+
* **Spam**: *Quarantine message*.
48+
* **Select quarantine policy**: *UserNotifyUserRelease*.
49+
* **High confidence spam**: *Quarantine message*.
50+
* **Select quarantine policy**: *UserNotifyAdminRelease*.
51+
* **Phishing**: *Quarantine message*.
52+
* **Select quarantine policy**: *UserNotifyAdminRelease*.
53+
* **High confidence phishing**: *Quarantine message*.
54+
* **Select quarantine policy**: *UserNotifyAdminRelease*.
55+
* **Retain spam in quarantine for this many days**: Default is 15 days. Email Security recommends 15-30 days.
56+
57+
8. Select **Save**.
58+
59+
## Create transport rules
60+
61+
<Render file="email-security/deployment/m365-use-case-transport-rules" params={{ one: "`Email Security User Quarantine Message`", two: "`UCE`, `SPOOF`", three: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules-case4.png", five: "`Email Security User Quarantine Message Admin Release`", six: "`MALICIOUS`", seven: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _9_", eight: "step10-admin-release-case4.png" }} />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/index.mdx‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Use cases
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 1
6+
group:
7+
hideIndex: true
8+
---
9+
10+
import { DirectoryListing } from "~/components"
11+
12+
13+
<DirectoryListing />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/one-junk-admin-quarantine.mdx‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: 1 - Junk email and Email Security Admin Quarantine
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 1
6+
head:
7+
- tag: title
8+
content: Junk email and Email Security Admin Quarantine -
9+
Microsoft 365
10+
11+
---
12+
13+
import { Render } from "~/components"
14+
15+
In this tutorial, you will learn how to deliver emails to the Microsoft 365 junk email folder and the Admin Quarantine in Email Security.
16+
17+
## Create quarantine policies
18+
19+
<Render file="email-security/deployment/m365-use-case-1-3-create-quarantine-policy" />
20+
21+
## Configure quarantine notifications
22+
23+
<Render file="email-security/deployment/m365-use-case-configure-quarantine-notifications" />
24+
25+
## Configure anti-spam policies
26+
27+
<Render file="email-security/deployment/m365-use-cases-antispam" params={{ one: "_UserNotifyAdminRelease_", two: "_UserNotifyAdminRelease_", three: "_UserNotifyAdminRelease_" }} />
28+
29+
## Create transport rules
30+
31+
To create the transport rules that will send emails with certain dispositions to Email Security:
32+
33+
1. Open the new [Exchange admin center](https://admin.exchange.microsoft.com/#/homepage).
34+
35+
2. Go to **Mail flow** > **Rules**.
36+
37+
3. Select **Add a Rule** > **Create a new rule**.
38+
39+
4. Set the following rule conditions:
40+
41+
* **Name**: `Email Security Deliver to Junk Email folder`.
42+
* **Apply this rule if**: *The message headers* > *includes any of these words*.
43+
* **Enter text**: `X-CFEmailSecurity-Disposition` > **Save**.
44+
* **Enter words**: `SUSPICIOUS`, `BULK` > **Add** > **Save**.
45+
* **Apply this rule if**: Select **+** to add a second condition.
46+
* **And**: *The sender* > *IP address is in any of these ranges or exactly matches* > enter the egress IPs in the [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/) page.
47+
* **Do the following** - *Modify the message properties* > *Set the Spam Confidence Level (SCL)* > *5*.
48+
49+
5. Select **Next**.
50+
51+
6. You can use the default values on this screen. Select **Next**.
52+
53+
7. Review your settings and select **Finish** > **Done**.
54+
55+
8. Select the rule `Email Security Deliver to Junk Email folder` you have just created, and select **Enable**.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/three-junk-admin-quarantine.mdx‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
title: 3 - Junk email and administrative quarantine
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 3
6+
head:
7+
- tag: title
8+
content: Junk email and administrative quarantine - Microsoft 365
9+
10+
---
11+
12+
import { Render } from "~/components"
13+
14+
In this tutorial, you will learn how to deliver `SUSPICIOUS` and `BULK` messages to the users's junk email folder, and `MALICIOUS`, `SPAM`, and `SPOOF` messages to the administrative quarantine (this requires an administrator to release the emails).
15+
16+
## Create quarantine policies
17+
18+
<Render file="email-security/deployment/m365-use-case-1-3-create-quarantine-policy" />
19+
20+
## Configure quarantine notifications
21+
22+
<Render file="email-security/deployment/m365-use-case-configure-quarantine-notifications" />
23+
24+
## Configure anti-spam policies
25+
26+
<Render file="email-security/deployment/m365-use-cases-antispam" params={{ one: "_UserNotifyAdminRelease_", two: "_UserNotifyAdminRelease_", three: "_UserNotifyAdminRelease_" }} />
27+
28+
## Create transport rules
29+
30+
<Render file="email-security/deployment/m365-use-case-transport-rules" params={{ one: "`Email Security Deliver to Junk Email folder`", two: "`SUSPICIOUS`, `BULK`", three: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules.png", five: "`Email Security User Quarantine Message`", six: "`MALICIOUS`, `UCE`, `SPOOF`", seven: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _9_", eight: "step10-user-quarantine.png" }} />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/use-cases/two-junk-user-quarantine.mdx‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
title: 2 - Junk email and user managed quarantine
3+
pcx_content_type: integration-guide
4+
sidebar:
5+
order: 2
6+
head:
7+
- tag: title
8+
content: Junk email and user managed quarantine - Microsoft 365
9+
10+
---
11+
12+
import { Render } from "~/components"
13+
14+
In this tutorial, you will learn how to deliver `SUSPICIOUS` and `BULK` messages to the user's junk folder, and `SPAM` and `SPOOF` messages to the user managed quarantine.
15+
16+
## Create quarantine policies
17+
18+
<Render file="email-security/deployment/m365-use-case-2-4-create-quarantine-policy" />
19+
20+
## Configure quarantine notifications
21+
22+
<Render file="email-security/deployment/m365-use-case-configure-quarantine-notifications" />
23+
24+
## Configure anti-spam policies
25+
26+
<Render file="email-security/deployment/m365-use-cases-antispam" params={{ one: "_UserNotifyUserRelease_", two: "_UserNotifyAdminRelease_", three: "_UserNotifyAdminRelease_" }} />
27+
28+
## Create transport rules
29+
30+
<Render file="email-security/deployment/m365-use-case-transport-rules" params={{ one: "`Email Security Deliver to Junk Email folder`", two: "`SUSPICIOUS`, `BULK`", three: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _5_", four: "step4-rules.png", five: "`Email Security User Quarantine Message`", six: "`UCE`, `SPOOF`", seven: "_Modify the message properties_ > _Set the Spam Confidence Level (SCL)_ > _9_", eight: "step10-user-quarantine.png" }} />

‎src/content/partials/cloudflare-one/email-security/deployment/m365-use-case-1-3-create-quarantine-policy.mdx‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
{}
3+
4+
---
5+
6+
To create quarantine policies:
7+
8+
1. Open the [Microsoft 365 Defender console](https://security.microsoft.com/)
9+
10+
2. Go to **Email & collaboration** > **Policies & rules**.
11+
12+
3. Select **Threat policies**.
13+
14+
4. Under **Rules**, select **Quarantine policies**.
15+
16+
5. Select **Add custom policy**.
17+
18+
6. Set the **Policy name** to `UserNotifyAdminRelease`.
19+
20+
7. Select **Next**.
21+
22+
8. In **Recipient message access**, select **Set specific access (Advanced)**, and then:
23+
24+
* In **Select release action preference**, choose *Allow recipients to request a message to be released from quarantine*.
25+
* In **Select additional actions recipients can take on quarantined messages**, select the **Delete** and **Preview** checkboxes.
26+
27+
9. Select **Next**.
28+
29+
10. In **Quarantine notification**, select **Enable**.
30+
31+
11. Select **Next**.
32+
33+
12. Review your settings and select **Submit**.
34+
35+
13. Select **Done**.

‎src/content/partials/cloudflare-one/email-security/deployment/m365-use-case-2-4-create-quarantine-policy.mdx‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
{}
3+
4+
---
5+
6+
To create quarantine policies:
7+
8+
1. Open the [Microsoft 365 Defender console](https://security.microsoft.com/).
9+
10+
2. Go to **Email & collaboration** > **Policies & rules**.
11+
12+
3. Select **Threat policies**.
13+
14+
4. Under **Rules**, select **Quarantine policies**.
15+
16+
5. Select **Add custom policy**.
17+
18+
6. Set the **Policy name** to `UserNotifyUserRelease`.
19+
20+
7. Select **Next**.
21+
22+
8. In **Recipient message access**, select **Set specific access (Advanced)**, and then:
23+
24+
* In **Select release action preference**, choose *Allow recipients to release a message from quarantine*.
25+
* In **Select additional actions recipients can take on quarantined messages**, select the **Delete** and **Preview** checkboxes.
26+
27+
9. Select **Next**.
28+
29+
10. In **Quarantine notification**, select **Enable**.
30+
31+
11. Select **Next**.
32+
33+
12. Review your settings and select **Submit**.
34+
35+
13. Select **Done**.
36+
37+
14. Select **Add custom policy**.
38+
39+
15. Set the **Policy name** to `UserNotifyAdminRelease`.
40+
41+
16. Select **Next**.
42+
43+
17. In **Recipient message access**, select **Set specific access (Advanced)**, and then:
44+
45+
* In **Select release action preference**, from the drop-down menu, choose *Allow recipients to request a message to be released from quarantine*.
46+
* In **Select additional actions recipients can take on quarantined messages**, select the **Delete** and **Preview** checkboxes.
47+
48+
18. Select **Next**.
49+
50+
19. In **Quarantine notification**, select **Enable**.
51+
52+
20. Select **Next**.
53+
54+
21. Review your settings and select **Submit**.
55+
56+
22. Select **Done**.

‎src/content/partials/cloudflare-one/email-security/deployment/m365-use-case-configure-domain.mdx‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
inputParameters: quarantinePolicy
3+
4+
---
5+
6+
import { Markdown } from "~/components"
7+
8+
You first need to configure the domains you are onboarding on the Email Security dashboard. To configure your domains:
9+
10+
1. Log in to the [Email Security dashboard](https://horizon.area1security.com/).
11+
2. Go to **Settings** (the gear icon).
12+
3. Go to **Email configuration** > **Domains & Routing** > **Domains**.
13+
4. Make sure each domain you are onboarding has been added.
14+
5. For each domain you are configuring, select **...** > **Edit**, and set the following options:
15+
* **Domain** - `<YOUR_DOMAIN>`.
16+
* **Configured as** - `MX Records`.
17+
* **Forwarding to** - This should match the expected MX record for each domain in your [Microsoft 365 account](https://admin.microsoft.com/#/Domains/).
18+
* **IP Restrictions** - Leave this field empty.
19+
* **Outbound TLS** - `Forward all messages over TLS`.
20+
* **Quarantine Policy** - {props.one}

0 commit comments

Comments
 (0)