# Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors

Exchange Online Protection (EOP) and Microsoft Defender for Office 365 works best when the mail exchange (MX) record is pointed directly at the service.

Source: https://maester.dev/docs/tests/ORCA.233.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/thomas-s-schmidt" title="Thomas Schmidt · Original author"><img src="https://github.com/thomas-s-schmidt.png" alt="Thomas Schmidt" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/thomas-s-schmidt">Thomas Schmidt</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/orca">ORCA</a> · Defender · Mail flow · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ORCA.233.1
```

## Overview

Exchange Online Protection (EOP) and Microsoft Defender for Office 365 works best when the mail exchange (MX) record is pointed directly at the service. In the event another third-party service is being used, a very important signal (the senders IP address) is obfuscated and hidden from EOP & MDO, generating a larger quantity of false positives and false negatives. By configuring Enhanced Filtering with the IP addresses of these services the true senders IP address can be discovered, reducing the false-positive and false-negative impact.

#### Remediation action

Configure enhanced filtering on connectors when email path is not direct to EOP.

#### Related Links

* [Enhanced Filtering for Connectors](https://aka.ms/orca-connectors-docs-1)
* [Microsoft 365 Defender Portal - Enhanced Filtering](https://aka.ms/orca-connectors-action-skiplisting)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ORCA.233.1 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Connector |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing |
| PowerShell test | [Test-ORCA233_1](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.233.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/orca/Test.ORCA.233.1.ps1`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.233.1.ps1)
- Documentation: [`tests/orca/Test.ORCA.233.1.md`](https://github.com/maester365/maester/blob/main/tests/orca/Test.ORCA.233.1.md)