Onboarding Microsoft 365 [Inline]

You can integrate Perception Point X-Ray with Microsoft 365. This enables Perception Point X-Ray to protect all incoming mail from Microsoft 365. 

This page describes how to integrate Perception Point X-Ray with Microsoft 365 using the inline method. For details on how to integrate Perception Point X-Ray with Microsoft 365 using the Microsoft API, see "Onboarding Microsoft 365 [API]" on page 166

By default, the Microsoft 365 integrations monitor incoming emails only - not outgoing emails. 

• [Outbound monitoring can be configured for Microsoft 365 - see "Onboarding Microsoft 365 - Outbound" on page 217]
• By default, internal email is not monitored. To add monitoring for internal email, contact Perception Point Support [support@perception-point.io]. There may be additional licensing requirements for enabling internal scanning.

This page describes Step 1 of the procedure to integrate Microsoft 365 with Perception Point:

Onboarding process

• Customer onboarding involves adding the domain name and verifying a TXT record in the system.
• There is a Perception Point script to automatically add and configure the required rules and connectors, and to allowlist the Perception Point IPs.

Email flow overview

• Inbound emails initially route through the Microsoft servers for initial analysis by EOP (Exchange Online Protection).
• Leveraging rules and connectors, emails that meet specific criteria are redirected to the Perception Point scanner.

Scanning and response

• Clean: Emails that are assigned the clean verdict are sent back to the Microsoft 365 servers through the configured next-SMTP for final delivery.
• Spam: Emails that are assigned the spamverdict are given a "X-PERCEPTION-POINT-SPAM: FAIL" header.
  • In Microsoft 365, the SCL (spam confidence level) is adjusted to 6 via Rule, designating the email as spam.
• Malicious: Emails that are assigned the maliciousverdict do not return to the Microsoft 365 servers.
  • This proactive prevention stops the malicious emails from reaching the recipient's Inbox.

Flow chart diagram 

Step 1 adds one or more domains that contain the email addresses that will be protected by Perception Point X-Ray.

Step 1 includes Step 1A and Step 1B.

Perform Step 1A in Microsoft 365 Defender: 

Add entries to the Tenant Allow/Block List

1. In Microsoft 365 Defender, go to this location: https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem 
2. Click (+) Add.

For more information about the Tenant Allow/Block List, see the official Microsoft documentation .

1. In Microsoft 365 Defender, go to this location: https://security.microsoft.com/antispam 
2. In the edit Anti-spam inbound policy (Default) window on the right, scroll down and then click Edit actions.
3. In the Actionswindow that opens:
   1. under Spam, select "Move message to Junk Email folder"
   2. under High confidence spam, select "Move message to Junk Email folder"
   3. under Phishing, select "Move message to Junk Email folder"
   4. under High confidence phishing, select "Quarantine message"
4. Scroll down and click Save.

 This step of the onboarding process includes enabling the Perception Point X-Ray remediation application [also known as the M365 APP - see step 7 below]. This application enables emails to be removed from a user's Inbox if a malicious scan verdict is assigned - after the email has been delivered. For details on the remediation app, 

Perform Step1B in Perception Point X-Ray: 

1. On the right of the Perception Point X-Ray banner, click the Add Services [] icon.
2. Click Add New Domain - if this option appears. 

1. Select the Organization - if necessary.
2. Specify the Escalation Contacts. 
3. For Email Service, select  Microsoft 365.
4. For Connection Method, select Inline.
5. Click ENABLE M365 APP - in the bottom right corner. [This is the remediation app.]

The next step in the wizard appears.

1. In the Host box, enter the name of the new domain - for example, acme.com 
2. Click FIND SMTP to the right of the domain name. 

This should populate the SMTP Servers field. This is the address to which mail will be sent after it has been scanned and marked as being clean.

Licenses: By default, Perception Point X-Ray will protect all email users in the domains that you specified above. To protect only a limited number of users, contact Perception Point Support [support@perception-point.io].

The "Add TXT Records" dialog box opens. This dialog box includes the TXT record names and TXT record values, that you'll need in order to add and verify the TXT records for your domain - in Step 2.

If multi-region is enabled, there will be details for TXT records in both the primary and secondary regions. For details about the multi-region functionality, 

You can integrate Perception Point with Microsoft 365. This enables Perception Point to protect all incoming mail from Microsoft 365. 

This page describes Step 2 of the procedure to integrate Microsoft 365 with Perception Point:

You need one or more verified domains for each email service that you integrate with Perception Point. After you add a domain [as part of the email service connection process], you need to verify the domain. Verifying a domain includes:

•  Adding a TXT record to your domain provider
• Verifying the TXT record

To add a TXT record:

1. Open Perception Point X-Ray.
2. In the left navigation menu, select Account > Email Domains.
3. Locate and then open the required domain.
4. Click Copy [] to copy the "TXT record name" to the clipboard.
5. Go to your domain provider and add the TXT record name, using the value that you copied to the clipboard.
6. Click Copy [] to copy the "TXT record value" to the clipboard.
7. Go to your domain provider and add the TXT record value, using the value that you copied to the clipboard.

To verify a new TXT record:

1. Open Perception Point X-Ray.
2. In the left navigation menu, select Account > Email Domains.
3. Locate and then open the required domain.
4. Locate "TXT record verification". It should have the "Pending" status.
5. Click Verify on the right of "TXT record verification".

The status should change from Pending to Verified.

When you add a TXT record to your domain provider, it may take up to 72 hours for the domain provider to apply and replicate the change. If your domain verification status is still Pending after 72 hours - and can't be verified, 

You can integrate Perception Point with Microsoft 365. This enables Perception Point to protect all incoming mail. 

This page describes Step 3 of the procedure to integrate Microsoft 365 with Perception Point:

To enable your Microsoft 365 integration with Perception Point, some configurations must be made in your Microsoft 365 account. You can perform these configurations either:

- or - 

You can use the automatic script to perform the required Microsoft 365 account configurations. This is the recommended way to perform these configurations.

To perform the required configurations automatically:

The script will begin to run, and soon the Granting Access dialog box will appear.

1. Granting Access: 
   1. Click the Copy icon [] to copy the code that appears.
   2. Click the link that appears below: 2. Paste the code in the link below. The Enter Code pop-up opens.

1. Paste the code into the Code field, and click Next.
2. In the Pick an account dialog box that appears, click your Microsoft account. 

A "confirmation required" dialog box opens.

The automatic script will continue processing and setting the required configurations - in the background. This process will take about 10 minutes to complete. You can continue with other work on your computer while the script runs.

What's next

Perform the procedures below to manually configure the Microsoft 365 integration with Perception Point X-Ray.

1. Add the Perception Point IP addresses to the safe list 

1. Open the Microsoft 365 admin center.
2. Click Security > Policies & rules > Threat policies > Anti-spam policies > Connection filter policy (Default) > Edit connection filter policy. 

[Click here: https://security.microsoft.com/antispam]

1. Select Turn on safe list.
2.  Click Save.

2. Create an outbound connector - from Microsoft 365 to Perception Point 

This connector directs the email from your Microsoft 365 tenant to Perception Point.

1. Open the Microsoft Exchange admin center, and then click Mail flow > Connectors > Add a connector.
   [Click here: https://admin.exchange.microsoft.com/#/connectors]
   • Connection from: Office 365

1. Click Next.
2. Enter Name: Perception Point Scanning

1. Click Next.
2. Select Only when I have a transport rule set up that redirects messages to this connector.

1. Click Next
2. Select Route emails through these smart hosts and add one of the following Amazon SES FQDNs, depending on the environment in which your organization is located: [Open the drop-down below for details on your environment.]

1. Click Next.
2. Keep the default TLS settings.

Note that Perception Point X-Ray supports TLS 1.2

1. Click Next.
2. In the validation screen, use [and then validate] the following email address:

3. Create an inbound connector - from Perception Point to Microsoft 365 

This connector directs the email from Perception Point back to your Microsoft 365 tenant.

1. Open the Microsoft Exchange admin center and then click Mail flow > Connectors > Add a connector.
   [Click here: https://admin.exchange.microsoft.com/#/connectors]
   • Connection from: Partner organization

1. Click Next.
2. Enter: Name: Disable IP Throttling on Perception Point Connector

1. Make sure that What do you want to do after connector is saved? > Turn it on is selected.
2. Click Next.
3. Select the second option: By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization, and add one set of IP addresses below, depending on the environment in which your organization is located: [Open the drop-down below for details on your environment.]

1. Click Next.
2. Leave the default TLS settings.

Note that Perception Point X-Ray supports TLS 1.2

1. Click Next.
2. Click Create connector.

4. Create a routing rule 

1. In the Exchange admin center, click Mail flow > Rules > Add a rule > Create new rule.
   [Click here: https://admin.exchange.microsoft.com/#/transportrules]
2. Under Name, enter Perception Point Redirect Rule.

Under Apply this rule if, select one of the following options:

[This defines the users that will be protected by Perception Point.]

1. Click "+" to add a condition.
2. Select The sender > is external/internal.
3. In the "select recipient location" box that appears, select Outside the organization - and then click Save.

1. Click "+" to add another condition. 
2. Select Modify the message properties > set a message header
   • Message header: X-PERCEPTION-POINT-CUSTOM
   •  Value: <Any value>, for example: acme2023

You'll need to enter this value later on in this procedure [in Step 10].

1. Under Except if, select The message headers... > includes any of these words
   • Message header: X-PERCEPTION-POINT-CUSTOM
   •  message header includes: <The value that you entered in Step 9 above>

1. Click "+" to add an exception. 
2. Select The sender> IP address is in any of these ranges or exactly matches, and enter one set of IP addresses below, depending on where your domain is located:

1. Click "+" to add an exception. 
2.  Select The message > size is greater than or equal to, and then add a size limit of 40000KB.
3. Click Next.
4. Under Set rule settings, select "Stop processing more rules".

1. Click Next.
2. Change the priority to 0 (highest priority).

If you have existing block using IP rules, set the priority of this rule higher than Perception Point, and then select "Stop processing more rules"

1. Save the changes.
2. Review the rule and click Finish.
3. Select and then enable the rule.

5. Create a rule for high spam confidence 

1. In the Exchange admin center click Mail flow > Rules > Add a rule > Create a new rule.
   [Click here: https://admin.exchange.microsoft.com/#/transportrules]
2. Under Name, enter Send Office 365 spam emails to Junk folder (High).

1. Under Apply this rule if:
   1. Select The message headers... >  matches these text patterns
      1. Click Enter text, and then enter X-PP-Forefront-Antispam-Report
      2. Select Enter text patterns, and then enter SCL:9, SCL:8, SCL:7

1. Click Next.
2. Click Finish.

6. Create a rule for low spam confidence 

1. In the Exchange admin center, click Mail flow > Rules > Add a rule > Create a new rule.
   [Click here: https://admin.exchange.microsoft.com/#/transportrules]
2. Under Name, enter Send Office 365 spam emails to Junk folder (Low).

1. Under Apply this rule if:
   1. Select The message headers... >  matches these text patterns
      1. Click Enter text, and then enter X-PP-Forefront-Antispam-Report
      2. Click Enter text patterns, and then enter SCL:6, SCL:5

1. Click Next.
2. Click Finish.

7. Create a spam rule for spam emails 

1. In the Exchange admin center, click Mail flow > Rules >Add a rule > Create a new rule.
   [Click here: https://admin.exchange.microsoft.com/#/transportrules]
2. Under Name, enter Perception Point Spam Rule.

1. Under Apply this rule if:
   1. Select The message headers... >  matches these text patterns
      1. Click Enter text, and then enter X-PERCEPTION-POINT-SPAM
      2. Click Enter text patterns, and then enter FAIL

1. Click Next.
2. Click Finish.

The spam will now be sent to the user’s Junk folder.

8. Enable the remediation app 

This step enables the Perception Point remediation app. For details on the remediation app, see "Remediation App" on page 729.

1. In Perception Point X-Ray, in the left navigation menu, select Account > Channels.
2. Under Enabled Channels, locate Email Service > Microsoft 365, and then click Activate.

A new browser tab will open, enabling you to sign-in to Microsoft 365.

Email from Microsoft 365 is now scanned and protected by Perception Point X-Ray.

References:

https://docs.perception-point.io/WP/Content/PP/MS-365-Onboarding.htm

Acronis: https://docs.perception-point.io/acronis/Content/PP/MS-365-Onboarding.htm