When you configure Netskope SMTP Proxy with Microsoft O365 Exchange, all outgoing emails from Microsoft O365 Exchange are sent to Netskope SMTP Proxy for policy evaluation.
The configuration involves the following two steps,
Configure the Microsoft O365 Exchange server and the upstream MTA in the Netskope tenant
- In the Netskope UI, go to Settings > Security Cloud Platform > SMTP.
- Under Microsoft Office 365 Exchange, click Edit.
- In the Edit Microsoft Office 365 Exchange Settings window:
- Email Server Setting: Copy and enter this FQDN in Microsoft Office 365 Exchange to route emails through the Netskope Cloud. You will require this FQDN when configuring Netskope SMTP Proxy as a connector in the Microsoft Exchange admin center.Email Domain Next Hop: Enter the following information. Netskope will use this information to associate emails with your Real-Time Protection policies.
- Domain: Enter and verify the primary domain you want to use for email processing. You can enter a domain, subdomain, or a wildcard domain (e.g., abc.com, cde.abc.com, and *.abc.com). To learn more about finding the primary domain in Microsoft O365: Finding the Microsoft O365 Exchange Tenant ID and Primary domain.Tenant ID: Enter the tenant ID, which you can find in the Directory ID box on the Properties page. To learn more about finding the tenant ID in Microsoft O365: Finding the Microsoft O365 Exchange Tenant ID and Primary domain.Next Hop: Enter the IP address/FQDN and port of the upstream MTA where you want the emails to be routed.
Caution
Configure each of your MAIL FROM domains. If not, emails from the domain will be rejected.
Click +Add to add multiple domain entries. Select Set Tenant ID and Next Hop for Each Domain if you want to enter a unique tenant ID and next hope for each domain entry.
- Domain: Enter and verify the primary domain you want to use for email processing. You can enter a domain, subdomain, or a wildcard domain (e.g., abc.com, cde.abc.com, and *.abc.com). To learn more about finding the primary domain in Microsoft O365: Finding the Microsoft O365 Exchange Tenant ID and Primary domain.
- Email Server Setting: Copy and enter this FQDN in Microsoft Office 365 Exchange to route emails through the Netskope Cloud. You will require this FQDN when configuring Netskope SMTP Proxy as a connector in the Microsoft Exchange admin center.Email Domain Next Hop: Enter the following information. Netskope will use this information to associate emails with your Real-Time Protection policies.
- Click Save.
Finding the Microsoft O365 Exchange Tenant ID and Primary domain
- Log into Microsoft O365 Administration and in the left pane select Admin. The Microsoft 365 admin center page is displayed.
- In the left pane of the Microsoft 365 admin center page, click … Show All to view all the options and select Azure Active Directory. The Azure Active Directory admin center page is displayed.
- Click Azure Active Directory in the left pane and copy the Tenant ID and Primary domain. You must specify the tenant ID and primary domain in your Netskope tenant.
Configure Netskope SMTP Proxy as an outbound connector in Microsoft’s Exchange admin center
-
Log into Microsoft O365 Administration and in the left pane select Admin. The Microsoft 365 admin center page is displayed.
-
In the left pane of the Microsoft 365 admin center page, click … Show All to view all the options and select Exchange. The Exchange admin center page is displayed.
-
In the left pane of the Exchange admin center page, click Mail Flow and then Connectors.
-
You can create a new rule for Netskope routing that will enable you to disable the Netskope connector at any time without impacting your existing routing rules.
Click the + Add a connector icon to create a new rule.
-
In the New Connector window, select your mail flow. In the From field select Office 365 and in the To field select Partner Organization. Click Next.
-
Specify a name to identify this connector and provide a description. Click Next.
-
Choose to use this connector only when I have a transport rule is set up that redirects messages to this connector. Click Next.
-
Provide Netskope’s domain name you copied previously as the host name of the partner organization and click +.
-
In the next screen, select the security options as shown in the image below to enable Office 365 to securely connect to Netskope’s SMTP proxy. To ensure the traffic goes to the Netskope cloud, add your domain name. Your domain name will follow the format: *.goskope.com
For example, if your tenant’s region is the EU, you will put: my-tenant.eu.goskope.com
-
Review your settings and click Next. The new connector is created. You can specify a test email and click Validate to validate the connector.
When the connection between Microsoft O365 Exchange and Netskope SMTP Proxy is up, Netskope SMTP Proxy replies with a 250 OK in the message to indicate that the connection was successful.
Note
Currently, the “send test email” between Microsoft O365 Exchange and Netskope SMTP Proxy fails with an error even though the connection is successful.
Example of a Rule Set Up with an Outbound Connector
- Click on the rules tab and click the + icon to create a new rule.
- In the new rule window, provide the following inputs:
- Name: Provide a name for the rule, such as “Traffic to Netskope”.
- Apply this rule if…: Select The recipient is located outside the organization.
- Do the following…: Select Redirect the message to the following connector. If you don’t see this option, click More options… at the bottom of the new rule window.
Select the connector you want to redirect messages to, from the pop-up window.
- Except if…: Click add exception and select A message header includes any of these words. Set the values to ‘x-netskope-inspected’ header includes ‘true’.
- Set the rule properties to default and click Save.
