Hi Victor,
1. Email sent from Office 365 to external (internet) routes through on-prem ESA and normal content filter,outbound mail policy and DLP policy applies.
In order to allow emails from the Office 365 to be sent outbound you would need to add the office 365 IP to the HAT RELAYLIST under Mail Policies -> HAT Overview.
Adding this would then treat those emails as outbound and would process as per the outgoing mail policies including content filters and DLP.
If the office 365 servers are dynamic then you would need to add the required subnets along with the below message filter to prevent other domains from relaying emails through the ESA.
DropRelayedMail:
if (sendergroup == 'RELAYLIST') AND
((mail-from != '@example\\.com;) OR (rcpt-to != 'example\\.com;)){
drop();
}
Message filters are added through the command line access of the appliance using command "filters".
2. Email sent between two users in office 365 does not need to route via onprem.
This would need to be configured on the office 365 server, any email injected to the ESA would be processed by the ESA so the office 365 server would need to be configured to prevent emails between users in office 365 from being sent to the ESA.
3. Outbound email from on-prem, continues to route email as normal with content filter,outbound mail policy and DLP policy applied.
As internal exchange server would be part of the HAT RELAYLIST already they would continue to be processed via the outbound mail policy.
4. Email sent from on-prem user to cloud user (i.e. our private O365 tenant) goes back out via ESA en-route to office 365,however without any filtering, or DLP policy
This would require configuration of a new outgoing mail flow policy for the recipient domain/email address on office 365 under Mail Policies -> Outgoing Mail Policies with the scanning engines disabled for just that outgoing mail policy.
Thank You!
Libin Varghese
