How do I allowlist Moxso with an external spam filter (Microsoft 365)?

If your organization routes inbound mail through an external spam filter before it reaches Microsoft 365, you'll need to complete one extra configuration step before following the standard Moxso allowlisting guide.

Without this step, Microsoft 365 sees your spam filter's IP address instead of Moxso's. This causes the mail flow rules and Defender policies in the standard guide to not work correctly.

What you'll do

You'll create an inbound connector in Exchange that identifies Moxso's sending IPs, and enable Enhanced Filtering for Connectors (EFC) on it. This restores IP visibility so the rest of your allowlisting configuration works as expected.

Once this is done, follow the standard allowlisting steps in Moxso under Settings > Simulations.

Before you begin

You'll need admin access to the Exchange Admin Center.

Step 1: Create the inbound connector

1. Go to the Exchange Admin Center.
2. Go to Mail flow > Connectors.
3. Click + Add a connector.
4. Set Connection from to Partner organization and Connection to to Microsoft 365.
5. Click Next.
6. Enter External Spam Filter Connector as the name.
7. Click Next.
8. Under Authenticating sent emails, select By verifying that the sender's IP address matches one of the following IP addresses.
9. Enter Moxso's sending IP addresses:
• 69.169.228.38
• 69.169.228.39
10. Click Next.
11. Leave the default security settings (TLS required) unchanged and click Next.
12. Validate the connector if prompted, then click Create connector.

Step 2: Enable Enhanced Filtering for Connectors

1. Go to Mail flow > Connectors.
2. Select External Spam Filter Connector.
3. In the flyout panel, find Enhanced Filtering for Connectors and enable it.

Step 3: Continue with the standard allowlisting guide

Return to Settings > Simulations in Moxso and follow all five steps in the allowlisting guide.

PowerShell alternative

If you prefer to configure the inbound connector using PowerShell, you can use the script below instead of steps 1 and 2.

Note: The script only creates the inbound connector and enables Enhanced Filtering. You still need to complete step 3 in the Moxso product.

# =============================================================================
# Set-MoxsoInboundConnector.ps1
# Creates or updates an Exchange Online inbound connector for Moxso / EFC.
# Requires: ExchangeOnlineManagement module
# =============================================================================

# --- Configuration -----------------------------------------------------------

$AdminAccount   = "admin@yourdomain.com"   # Replace with your admin UPN
$ConnectorName  = "External Spam Filter Connector"
$ConnectorComment = "Inbound connector for external spam filter (Moxso) and EFC."
$MoxsoIPs       = @(
    "69.169.228.38",
    "69.169.228.39"
)

# --- Main --------------------------------------------------------------------

Import-Module ExchangeOnlineManagement -ErrorAction Stop

try {
    Connect-ExchangeOnline -UserPrincipalName $AdminAccount -ErrorAction Stop

    $ExistingConnector = Get-InboundConnector -Identity $ConnectorName -ErrorAction SilentlyContinue

    if (-not $ExistingConnector) {
        Write-Host "Connector not found — creating '$ConnectorName'..." -ForegroundColor Cyan

        New-InboundConnector `
            -Name                        $ConnectorName `
            -ConnectorType               Partner `
            -SenderDomains               "*" `
            -RequireTls                  $true `
            -RestrictDomainsToCertificate $false `
            -RestrictDomainsToIPAddresses $true `
            -SenderIPAddresses           $MoxsoIPs `
            -EnhancedFilteringEnabled    $true `
            -Comment                     $ConnectorComment `
            -Enabled                     $true

        Write-Host "Connector created successfully." -ForegroundColor Green

    } else {
        Write-Host "Connector found — updating '$ConnectorName'..." -ForegroundColor Cyan

        Set-InboundConnector -Identity $ConnectorName `
            -SenderIPAddresses           $MoxsoIPs `
            -RequireTls                  $true `
            -EnhancedFilteringEnabled    $true `
            -Comment                     $ConnectorComment

        Write-Host "Connector updated successfully." -ForegroundColor Green
    }

    # --- Verify ---------------------------------------------------------------
    Write-Host "`nConnector configuration:" -ForegroundColor Cyan
    Get-InboundConnector -Identity $ConnectorName |
        Format-List Name, SenderIPAddresses, RequireTls, EnhancedFilteringEnabled, Enabled, ConnectorType

} catch {
    Write-Error "Script failed: $_"

} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}