Block Microsoft Exchange Server 2016 Exchange Admin Center (EAC) website from Internet

Question

Block Microsoft Exchange Server 2016 Exchange Admin Center (EAC) website from Internet

Abdullah Salam 41

Hi,

As per requirements from our customer to restrict EAC from External network, We have configured Exchange 2016 servers configured with Option 2 using the article below:

https://learn.microsoft.com/en-us/exchange/architecture/client-access/disable-exchange-admin-center-a...

As per customer security requirements, EAC/ECP website URL should not be accessible and should be blocked without impacting OWA accessibility for the users from Exchange Servers. Need help if this can be achieved using Exchange Server Configurations.

NOTE: By following the above article, EAC access is restricted but the EAC login page is still accessible by all the users.

Lucas Liu-MSFT 6,196 Reputation points

2020-08-13T07:47:13.59+00:00

Hi @Abdullah Salam ,
If the problem is successfully solved, , please click “Accept as answer” to mark your solution or the helpful reply as answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
Thanks for your understanding.

Answer accepted by question author

Andy David - MVP 160.4K MVP Volunteer Moderator

Hi, as I commented above, I don't think there is really any good solution for you. You really can't block or prevent even seeing the ECP directory without affecting OWA.
OWA and ECP are intertwined and OWA relies on the ECP virtual directory for user options.

Abdullah Salam 41 Reputation points

2020-08-10T05:59:40.143+00:00

Hi,

We have achieved this with using F5 APM and users can still access OWA options when they click on option settings in OWA. if any user tries to access https://mail.domain.com/ecp it will say "This site can’t be reached".

Thanks..
Lucas Liu-MSFT 6,196 Reputation points

2020-08-10T06:05:31.847+00:00

Hi Abdullah-salam,
I’m pleased to know that your issue is resolved.
You could mark your solution as answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
Thanks for your understanding.

2 additional answers

Your answer

Lucas Liu-MSFT 6,196 Reputation points

2020-08-13T07:47:13.59+00:00

Hi @Abdullah Salam ,
If the problem is successfully solved, , please click “Accept as answer” to mark your solution or the helpful reply as answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
Thanks for your understanding.
Abdullah Salam 41 Reputation points

2020-08-10T05:59:40.143+00:00

Hi,

We have achieved this with using F5 APM and users can still access OWA options when they click on option settings in OWA. if any user tries to access https://mail.domain.com/ecp it will say "This site can’t be reached".

Thanks..
Lucas Liu-MSFT 6,196 Reputation points

2020-08-10T06:05:31.847+00:00

Hi Abdullah-salam,
I’m pleased to know that your issue is resolved.
You could mark your solution as answer, this will make answer searching in the forum easier and be beneficial to other community members as well.
Thanks for your understanding.

Answer 1

Lucas Liu-MSFT 6,196

Hi Abdullah-salam,
You could install IP and Domain Restrictions role and set up restrict EAC from External network in IIS. Please follow the steps below:

In Server Manager, click the Manage menu, and then click Add Roles and Features.
In the Add Roles and Features wizard, click Next. Select the installation type and click Next. Select the destination server and click Next.
On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Security, and then select IP and Domain Restrictions. Click Next.
After you install the IP and Domain Restrictions role, you could set up IP and Domain Restrictions in IIS.
Please note that based on the previous similar case, install this feature may cause all user access interruption for a few minutes, and then it will be restored.
For more information you could refer to: Adding IP Security

Abdullah Salam 41 Reputation points

2020-08-06T05:07:38.76+00:00

Hi Lucas,

Thanks for your reply but using this method EAC login page is still available for all users on the internet. Is there any way to block the EAC login page also?
Lucas Liu-MSFT 6,196 Reputation points

2020-08-06T08:19:34.067+00:00
Hi Abdullah-salam,
Please follow the below steps and see if it works:

Double click on “IP Address and Domain Restrictions”.

Select the “Add Allow Entry” and Add IP or Range then click Ok.

Click on “Edit Feature Settings”, in “Access for Unspecified clients” Select Deny and you could select the “Deny Action Type”.

Please run the IISreset in CMD start as administrator to reset the IIS.
For more information you could refer to: Exchange 2016: Deny External Access to EAC
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Abdullah Salam 41 Reputation points

2020-08-08T01:39:44.197+00:00

Hi Lucas,

Already tested that also. ECP Login page is still visible. Applying the method will not block the Login page but when the user/admin try login it doesnot work which is not the requirement.

The requirement is ECP login page SHOULD NOT BE Available and user should not see the login page.

Looks like only solution is to configure reverse proxy to drop the ECP web request.

If you have any other solution then let me know.

Answer 2

Andy David - MVP 160.4K MVP Volunteer Moderator

Take a look at these articles and test it out:

https://www.alitajran.com/disable-external-access-to-ecp-exchange-2016/
https://blog.expta.com/2018/10/how-to-block-external-access-to.html

Abdullah Salam 41 Reputation points

2020-08-04T22:31:42.597+00:00

Hi,

Thanks for sharing the articles. I will test and share my feedback if we can block EAC login page.

Also can you please let me know if the methods mentioned in article are Officially Supported. If yes can you share Official refrence link?
Andy David - MVP 160.4K Reputation points MVP Volunteer Moderator

2020-08-04T22:35:44.853+00:00

No there is no official document for these changes.

Exchange 2019 has the only officially supported method:

https://learn.microsoft.com/en-us/exchange/architecture/client-access/exchange-admin-center?view=exchserver-2019

https://learn.microsoft.com/en-us/exchange/clients/client-access-rules/client-access-rules?view=exchserver-2019
Abdullah Salam 41 Reputation points

2020-08-06T04:59:57.117+00:00

Hi Andy,

I have tested both IP and Domain Restrictions feature of IIS and Exchange 2019 Client Access Rules. Both can also be used to restrict the access to EAC but still the users on the internet can see the EAC/ECP login page. So the user is restricted AFTER THE USER LOGIN on the EAC page.

The requirement was to drop/block the ECP/EAC URL request when user tries to access the ECP/EAC URL itself from external network and EAC Login page should not be available for the user to login. looks like this can only be achieved through the reverse proxy solution.
Andy David - MVP 160.4K Reputation points MVP Volunteer Moderator

2020-08-06T11:44:30.473+00:00

As far as I know, you can't keep anyone from seeing that page, correct. They just can't access it. A reverse proxy would keep it invisible if its not published.
Note regardless, this may affect the ability to use OWA and OWA options from the internet, so be sure to test that out.