Using new virtural directory for ECP or using IP Address and Domain Restriction to disable ECP from public internet

Question

Hello;

I am trying to protect my Exchange ECP from internet, subject to my research; there are two methods can be used.

(1) Create a new virtual directory like the steps show here, but can I just do it on ECP not OWA? I want to keep the OWA without change.

https://techcommunity.microsoft.com/t5/exchange-team-blog/configuring-multiple-owa-ecp-virtual-directories-on-the-exchange/ba-p/611217

(2) Using IP Address and Domain Restriction in IIS

I tried to apply it on "Default Web Site | ecp" virtual directly only, but it also blocking the OWA

Is it just apply this to ecp virtual directory without affecting OWA?

thanks!

Answer 1

Depending on Exchange Version:

2019:

https://learn.microsoft.com/en-us/exchange/architecture/client-access/disable-exchange-admin-center-access?view=exchserver-2019

2013/2016:

https://blog.expta.com/2018/10/how-to-block-external-access-to.html

This will affect OWA

Or look at:

https://www.codetwo.com/admins-blog/how-to-disable-external-access-to-ecp/

Answer 2

Hi @Kane

I agree with Andy, if you are using Exchange 2019, Client Access Rules would be very easy to use without affecting OWA.
However, this feature is not available in former versions of Exchange.

And if you have some firewall or reverse proxy in your environment, I suppose you may also create rules if it is supported to block external requests to the ECP url.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.