I actually stumbled across a neat cmdlet that I have never noticed before, Validate-OutboundConnector. It basically allows you to observe and validate the route that your messages take through your connectors in the cloud. 

The Who and the What:

Simply connect to remote powershell and run Validate-OutboundConnector -Identity "Connector Name" -Recipients "you@yourdomain.com" and you'll get a cool play by play of the hops your email takes to it's destination. You can also throw in the '-Verbose' switch

Below is an example that I ran, you can also run it with the '-Verbose' switch if you like.

PS C:\Users\Mitchel> Validate-OutboundConnector -Identity Outbound -Recipients blahblahblah8675309@hotmail.com

RunspaceId : 381ab9da-18d2-4f80-a44a-eea4f82cde89
TaskName : Connector Validation
IsTaskSuccessful : True

Timestamp:6/8/2015 8:54:43 AM
EventId:SEND
Source:SMTP
MessageSubject:Test email for connector validation
MessageId:<964f428e-c75e-490a-b272-1156932922b2@CY1PR0201MB1066.namprd02.prod.outlook.com>
Recipients:blahblahblah8675309@hotmail.com
RecipientCount:1
RecipientStatus:250 blahblahblah8675309@hotmail.com
SourceContext:;250
<964f428e-c75e-490a-b272-1156932922b2@CY1PR0201MB1066.namprd02.prod.outlook.com> Queued mail for
delivery;ClientSubmitTime:
Sender:O365ConnectorValidation@contoso.onmicrosoft.com
EventData:E2ELatency:2.813, ExternalSendLatency:1.969, Microsoft.Exchange.Hygiene.TenantOutboundConn
ectorCustomData:Name=Outbound;ConnectorType=Partner;UseMxRecord=True, ToEntity:Internet,
FromEntity:Unknown, MsgRecipCount:1, OutboundProxyTargetIPAddress:65.55.92.168,
OutboundProxyTargetHostName:mx3.hotmail.com, OutboundProxyFrontendName:BL2FFO11FD031,
DeliveryPriority:Normal, Oorg:contoso.onmicrosoft.com, OriginalFromAddress:<>,
AccountForest:NAMPR02A001.prod.outlook.com

; SubTasksResults = TaskName = blahblahblah8675309@hotmail.com; IsTaskSuccessful = True; TaskDetail = OK;
SubTasksResults = |
|}
Identity :
ObjectState : New
IsValid : True

You can confirm success on your end by looking for this value:

IsTaskSuccessful : True

Your recipient will get a nice test message confirming it:

It's also helpful if another admin from another company is blaming you/us unnecessarily, sending them this output is pretty hard to argue with. You can also script this to easily send in intervals or run against multiple connectors as well various other troubleshooting/monitoring scenarios.

I didn't see any real mention of it anywhere on the internet, so I decided to write a blog post in the interim. I hope it helps!

Mitchel

Every now and then, we are presented with the question: "How do we prevent internal messages from being Auto-Forwarded to external recipients?" which usually follows with us reviewing a transport rule or several other creative methods that fail to stop forwarding externally.

The "catch" with Auto-Forwarded messages is that you want to focus more on the destination of the Auto-Forward message rather than the source, in this case, the external recipient we're trying to prevent from receiving our email. The user with the Auto-Forward configured is not considered the "sender" of the forwarded message in the transport layer. That configuration just instructs Transport on how/where to deliver a copy of the message that is sent to them before it even touches their mailbox. When you try to scope the rule to the original intended recipient or sender, the rule will not function in the manner you are intending because it fails to address the origin or the destination of Auto-Forwarded message and often assumes that the intended recipient is also the source of the message, in error.

As a result of this common confusion, below are the methods that I would use for testing and implementing this restriction in my own environment. If enough people want a deeper dive into the supporting technology, let me know in the comments and I can revise this.

Scoped Method:

Prior to implementing a global change in production, it's wise to scope it to test users initially to verify that it works as desired. Below is how to properly scope the rules.

1. Create New Rule

2. *Apply this rule if...

• 1. The sender is located... "Inside the organization"
• 2. The recipient is located... Put the external destination's email address or define their Contact in this field
• 3. The message type is... "Auto-Forward"

3. Choose your desired action (NDR/Forward etc etc), I chose to reject the message with an explanation

Global Method:

Once you're sure that this rule is acting accordingly to Auto-Forward messages destined externally, you can implement into production by doing the following.

1. Create New Rule

2. *Apply this rule if...

• 1. The sender is located... "Inside the organization"
• 2. The recipient is located... "Outside the organization"
• 3. The message type is... "Auto-Forward"
  

3. Choose your desired action (NDR/Forward etc etc), I chose to reject the message with an explanation.

I hope this helps

-Mitchel

We do not get many cases like this in CSS for some reason. I believe this is because most enterprises seem to leverage their Tenant Admin for support and provisioning the service. As this service grows, there will be more and more support personnel supporting this service in the enterprise. Occasionally, we will get asked how to restrict specific functionality from users though. One thing you should consider is that anything changed/executed in EAC is ultimately just triggering a cmdlet to be run. All of the pages will be visible, but their ability to read/write values depends on the cmdlets you allow them to run via RBAC.

Solution:

Since this can potentially impact production support users, I highly recommend copying a Management Role that you intend on trimming up, just so that you're not changing anything that anyone is using presently. To do that, you just need to specify a parent role to when running New-ManagementRole in remote powershell (this cannot be done via EAC)

Example:

New-ManagementRole –Name “Transport Rules Limited” –Parent “Transport Rules"
New-ManagementRole –Name “Transport Hygiene Limited” –Parent “Transport Hygiene”

From there, you can run something like this:

Get-ManagementRoleEntry "Transport Hygiene Limited\*"

OR

Get-ManagementRoleEntry "Transport Rules Limited\*"

Which should output something like this (notice that the parameters aren't fully enumerated):

Disable-HostedContentFilter... Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Disable-MalwareFilterRule      Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Enable-HostedContentFilterRule Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Enable-MalwareFilterRule       Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Get-HostedConnectionFilterP... Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}
Get-HostedContentFilterPolicy  Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}
Get-HostedContentFilterRule    Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}
Get-HostedOutboundSpamFilte... Transport Hygiene Limited {ErrorAction, ErrorVariable, OutBuffer, OutVariable...}
Get-MalwareFilterPolicy        Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}
Get-MalwareFilterRule          Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}
New-HostedConnectionFilterP... Transport Hygiene Limited {AdminDisplayName, Confirm, EnableSafeList, ErrorAction...}
New-HostedContentFilterPolicy  Transport Hygiene Limited {AddXHeaderValue, AdminDisplayName, Confirm, DownloadLink...}
New-HostedContentFilterRule    Transport Hygiene Limited {Comments, Confirm, Enabled, ErrorAction...}
New-MalwareFilterPolicy        Transport Hygiene Limited {Action, AdminDisplayName, Confirm, CustomAlertText...}
New-MalwareFilterRule          Transport Hygiene Limited {Comments, Confirm, Enabled, ErrorAction...}
Release-QuarantineMessage      Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Remove-HostedConnectionFilt... Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Remove-HostedContentFilterP... Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Remove-HostedContentFilterRule Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Remove-MalwareFilterPolicy     Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Remove-MalwareFilterRule       Transport Hygiene Limited {Confirm, ErrorAction, ErrorVariable, Identity...}
Set-HostedConnectionFilterP... Transport Hygiene Limited {AdminDisplayName, Confirm, EnableSafeList, ErrorAction...}
Set-HostedContentFilterPolicy  Transport Hygiene Limited {AddXHeaderValue, AdminDisplayName, Confirm, DownloadLink...}
Set-HostedContentFilterRule    Transport Hygiene Limited {Comments, Confirm, ErrorAction, ErrorVariable...}
Set-HostedOutboundSpamFilte... Transport Hygiene Limited {AdminDisplayName, BccSuspiciousOutboundAdditionalRecipient...
Set-MalwareFilterPolicy        Transport Hygiene Limited {Action, AdminDisplayName, Confirm, CustomAlertText...}
Set-MalwareFilterRule          Transport Hygiene Limited {Comments, Confirm, ErrorAction, ErrorVariable...}
Get-QuarantineMessage          Transport Hygiene Limited {Confirm, Direction, Domain, EndExpiresDate...}
Get-QuarantineMessageHeader    Transport Hygiene Limited {ErrorAction, ErrorVariable, Identity, OutBuffer...}

Run the following and it will force it to enumerate those fields:

$FormatEnumerationLimit =-1

Then you can run and it will display the cmdlets and switches the user belonging to that role can run. If it's not listed, they can't run it.

Get-ManagementRoleEntry "Transport Hygiene Limited\*" | fl name,parameters

Name : Set-HostedContentFilterPolicy
Parameters : {AddXHeaderValue, AdminDisplayName, BulkThreshold, Confirm, DownloadLink, EnableEndUserSpamNotifications,
EnableLanguageBlockList, EnableRegionBlockList, EndUserSpamNotificationCustomFromAddress,
EndUserSpamNotificationCustomFromName, EndUserSpamNotificationCustomSubject,
EndUserSpamNotificationFrequency, EndUserSpamNotificationLanguage, EndUserSpamNotificationLimit,
ErrorAction, ErrorVariable, HighConfidenceSpamAction, Identity, IncreaseScoreWithBizOrInfoUrls,
IncreaseScoreWithImageLinks, IncreaseScoreWithNumericIps, IncreaseScoreWithRedirectToOtherPort,
LanguageBlockList, MakeDefault, MarkAsSpamBulkMail, MarkAsSpamEmbedTagsInHtml, MarkAsSpamEmptyMessages,
MarkAsSpamFormTagsInHtml, MarkAsSpamFramesInHtml, MarkAsSpamFromAddressAuthFail,
MarkAsSpamJavaScriptInHtml, MarkAsSpamNdrBackscatter, MarkAsSpamObjectTagsInHtml,
MarkAsSpamSensitiveWordList, MarkAsSpamSpfRecordHardFail, MarkAsSpamWebBugsInHtml, ModifySubjectValue,
OutBuffer, OutVariable, QuarantineRetentionPeriod, RedirectToRecipients, RegionBlockList, SpamAction,
TestModeAction, TestModeBccToRecipients, WarningAction, WarningVariable, WhatIf}

Name : New-HostedContentFilterPolicy
Parameters : {AddXHeaderValue, AdminDisplayName, BulkThreshold, Confirm, DownloadLink, EnableEndUserSpamNotifications,
EnableLanguageBlockList, EnableRegionBlockList, EndUserSpamNotificationCustomFromAddress,
EndUserSpamNotificationCustomFromName, EndUserSpamNotificationCustomSubject,
EndUserSpamNotificationFrequency, EndUserSpamNotificationLanguage, EndUserSpamNotificationLimit,
ErrorAction, ErrorVariable, HighConfidenceSpamAction, IncreaseScoreWithBizOrInfoUrls,
IncreaseScoreWithImageLinks, IncreaseScoreWithNumericIps, IncreaseScoreWithRedirectToOtherPort,
LanguageBlockList, MarkAsSpamBulkMail, MarkAsSpamEmbedTagsInHtml, MarkAsSpamEmptyMessages,
MarkAsSpamFormTagsInHtml, MarkAsSpamFramesInHtml, MarkAsSpamFromAddressAuthFail,
MarkAsSpamJavaScriptInHtml, MarkAsSpamNdrBackscatter, MarkAsSpamObjectTagsInHtml,
MarkAsSpamSensitiveWordList, MarkAsSpamSpfRecordHardFail, MarkAsSpamWebBugsInHtml, ModifySubjectValue,
Name, OutBuffer, OutVariable, QuarantineRetentionPeriod, RedirectToRecipients, RegionBlockList,
SpamAction, TestModeAction, TestModeBccToRecipients, WarningAction, WarningVariable, WhatIf}

Name : Disable-HostedContentFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Disable-MalwareFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Enable-HostedContentFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Enable-MalwareFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Get-HostedConnectionFilterPolicy
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable}

Name : Get-HostedContentFilterPolicy
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable}

Name : Get-HostedContentFilterRule
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, State, WarningAction, WarningVariable}

Name : Get-HostedOutboundSpamFilterPolicy
Parameters : {ErrorAction, ErrorVariable, OutBuffer, OutVariable, WarningAction, WarningVariable}

Name : Get-MalwareFilterPolicy
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable}

Name : Get-MalwareFilterRule
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, State, WarningAction, WarningVariable}

Name : New-HostedContentFilterRule
Parameters : {Comments, Confirm, Enabled, ErrorAction, ErrorVariable, ExceptIfRecipientDomainIs, ExceptIfSentTo,
ExceptIfSentToMemberOf, HostedContentFilterPolicy, Name, OutBuffer, OutVariable, Priority,
RecipientDomainIs, SentTo, SentToMemberOf, WarningAction, WarningVariable, WhatIf}

Name : New-MalwareFilterPolicy
Parameters : {Action, AdminDisplayName, Confirm, CustomAlertText, CustomExternalBody, CustomExternalSubject,
CustomFromAddress, CustomFromName, CustomInternalBody, CustomInternalSubject, CustomNotifications,
EnableExternalSenderAdminNotifications, EnableExternalSenderNotifications,
EnableInternalSenderAdminNotifications, EnableInternalSenderNotifications, ErrorAction, ErrorVariable,
ExternalSenderAdminAddress, InternalSenderAdminAddress, Name, OutBuffer, OutVariable, WarningAction,
WarningVariable, WhatIf}

Name : New-MalwareFilterRule
Parameters : {Comments, Confirm, Enabled, ErrorAction, ErrorVariable, ExceptIfRecipientDomainIs, ExceptIfSentTo,
ExceptIfSentToMemberOf, MalwareFilterPolicy, Name, OutBuffer, OutVariable, Priority, RecipientDomainIs,
SentTo, SentToMemberOf, WarningAction, WarningVariable, WhatIf}

Name : Release-QuarantineMessage
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, ReleaseToAll,
ReportFalsePositive, User, WarningAction, WarningVariable, WhatIf}

Name : Remove-HostedContentFilterPolicy
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Remove-HostedContentFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Remove-MalwareFilterPolicy
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Remove-MalwareFilterRule
Parameters : {Confirm, ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction, WarningVariable,
WhatIf}

Name : Set-HostedContentFilterRule
Parameters : {Comments, Confirm, ErrorAction, ErrorVariable, ExceptIfRecipientDomainIs, ExceptIfSentTo,
ExceptIfSentToMemberOf, HostedContentFilterPolicy, Identity, Name, OutBuffer, OutVariable, Priority,
RecipientDomainIs, SentTo, SentToMemberOf, WarningAction, WarningVariable, WhatIf}

Name : Set-HostedOutboundSpamFilterPolicy
Parameters : {AdminDisplayName, BccSuspiciousOutboundAdditionalRecipients, BccSuspiciousOutboundMail,
BlockUnlistedDomains, Confirm, ErrorAction, ErrorVariable, Identity, NotifyOutboundSpam,
NotifyOutboundSpamRecipients, OutBuffer, OutVariable, WarningAction, WarningVariable, WhatIf}

Name : Set-MalwareFilterPolicy
Parameters : {Action, AdminDisplayName, Confirm, CustomAlertText, CustomExternalBody, CustomExternalSubject,
CustomFromAddress, CustomFromName, CustomInternalBody, CustomInternalSubject, CustomNotifications,
EnableExternalSenderAdminNotifications, EnableExternalSenderNotifications,
EnableInternalSenderAdminNotifications, EnableInternalSenderNotifications, ErrorAction, ErrorVariable,
ExternalSenderAdminAddress, Identity, InternalSenderAdminAddress, MakeDefault, OutBuffer, OutVariable,
WarningAction, WarningVariable, WhatIf}

Name : Set-MalwareFilterRule
Parameters : {Comments, Confirm, ErrorAction, ErrorVariable, ExceptIfRecipientDomainIs, ExceptIfSentTo,
ExceptIfSentToMemberOf, Identity, MalwareFilterPolicy, Name, OutBuffer, OutVariable, Priority,
RecipientDomainIs, SentTo, SentToMemberOf, WarningAction, WarningVariable, WhatIf}

Name : Get-QuarantineMessage
Parameters : {Confirm, Direction, Domain, EndExpiresDate, EndReceivedDate, ErrorAction, ErrorVariable, Identity,
MessageId, OutBuffer, OutVariable, Page, PageSize, RecipientAddress, Reported, SenderAddress,
StartExpiresDate, StartReceivedDate, Subject, Type, WarningAction, WarningVariable, WhatIf}

Name : Get-QuarantineMessageHeader
Parameters : {ErrorAction, ErrorVariable, Identity, OutBuffer, OutVariable, WarningAction}

OK COOL, HOW DO I REMOVE/SCOPE THIS FURTHER???

Simple! If you see a cmdlet that you don't want your support staff to run, let's say you don't want them to be able to do anything regarding the connection filters (IP Allow/Block etc), run the following:

Remove-ManagementRoleEntry “Transport Hygiene Limited\New-HostedConnectionFilterPolicy”
Remove-ManagementRoleEntry “Transport Hygiene Limited\Remove-HostedConnectionFilterPolicy”
Remove-ManagementRoleEntry “Transport Hygiene Limited\Set-HostedConnectionFilterPolicy”

This makes it so they can only read the settings but cannot execute changes if they're a member of this role.

Bonus:

Want an easy way to see which role allows a specific cmdlet? Easy! Obviously, you can narrow it down to the cmdlet/Role if you wish, but I just dump it to an easily searchable text file.

Get-ManagementRoleEntry *\* | fl name, parameters, role | out-file C:\temp\cmdlets.txt

As always, I hope this helps!

Mitchel

Recently a customer was dealing with a virus/spam issue that was interesting. They were getting spammed and the subjects were intentionally misspelled by leaving a character off of the end of the word and came with a nasty virus attached. The problem is that when they created a transport rule to quarantine these malicious emails with the intentionally misspelled subjects, it was also quarantining valid emails with subjects that were spelled correctly. I honestly think that the misspellings were there intentionally so as to make it difficult to block them without causing false positives on the transport level. We were able to fix this via Regular Expressions.

https://technet.microsoft.com/en-us/library/aa997187%28v=exchg.141%29.aspx

Solution:

1. Create a New Transport Rule

2. Hit 'More Options' at the bottom

3. Select 'Apply this rule if...'

4. Select 'Subject matches these text patterns'

5. In order to match words/phrases exactly, simply put a '^' at the beginning of the phrase/word and a '$' at the end, Example:
^This is totally not a viru$

6. Check ‘Defer the message if rule processing doesn’t complete’ at the bottom

Any message that comes in and meets the above criteria exactly (not more or less) will be actioned on appropriately. In this case we just sent them to quarantine, but you can reject/NDR/redirect them as you see fit.

-Mitchel

It's not uncommon for Exchange Online support to receive the occasional call where customers want to know how to stay on top of our public IP's. They change occasionally and unless customers are current with our RSS feeds on THIS page, then they'll likely find out that they're out of date when they start observing mail delays. Obviously, there is a better way to go about this. 

Disclaimer:
If you leverage your Firewall to Restrict/Allow Microsoft Public IPs, running this will likely break hybrid mail flow and should not be attempted. It's also worth noting that the ranges listed at https://technet.microsoft.com/en-us/library/hh373144.aspx will be slightly different than the results you get from running Get-HybridMailFlowDatacenterIPs. This is because the cmdlet only lists IP ranges that are specifically leveraged for mail flow and the website lists all IP ranges that the Exchange Online service uses for all of it's public facing functions, such as Client Access, EAC/ECP, Free/Busy, Migrations and of course, Mail Flow.

Manual Method:

1. Connect Exchange Management Shell to your tenant in Exchange Online (Refer to this link for help, https://blogs.technet.com/b/mitchelatmicrosoft/archive/2014/12/23/connecting-powershell-to-your-tenant.aspx )

2. Create a variable to pipe over to your Set-ReceiveConnector cmdlet

$FormatEnumerationLimit =-1
$ip = Get-HybridMailflowDatacenterIPs

3. You can run Get-HybridMailFlowDatacenterIPs by itself to verify the results. If you don't run $FormatEnumerationLimit =-1 prior to running this, you'll see that the IP range list is not enumerated:
Example:

DatacenterIPs : {65.55.88.0/24, 94.245.120.64/26, 207.46.51.64/26, 207.46.163.0/24...}

After running $FormatEnumerationLimit =-1 and running Get-HybridMailFlowDatacenterIPs, you should see the entire list:
Example:

DatacenterIPs : {65.55.88.0/24, 94.245.120.64/26, 207.46.51.64/26, 207.46.163.0/24, 213.199.154.0/24,
213.199.180.128/26, 216.32.180.0/24, 216.32.181.0/24, 2a01:111:f400:7c00::/54, 23.103.128.0/20,
23.130.156.0/22, 23.103.128.0/19, 104.47.0.0/17, 23.103.198.0/23, 23.103.200.0/21, 23.103.191.0/24,
2a01:111:f400:fc00::/54, 64.4.22.64/26, 65.55.169.0/24, 65.55.83.128/27, 134.170.132.0/24,
134.170.140.0/24, 134.170.171.0/24, 157.55.133.160/27, 157.55.158.0/23, 157.55.234.0/24,
157.55.206.0/23, 157.56.73.0/24, 157.56.87.192/26, 157.56.108.0/24, 157.56.110.0/24, 157.56.111.0/24,
157.56.112.0/24, 157.56.206.0/24, 157.56.208.0/22, 207.46.100.0/24, 207.46.101.128/26}

4. Once you have verified that you're seeing all of the IP ranges, you can feed them into a Set-ReceiveConnector cmdlet

Get-ReceiveConnector "Inbound From Office 365" | Set-ReceiveConnector -RemoteIPRanges $ip.DatacenterIPs

5. Run Get-ReceiveConnector "Inbound From Office 365" | fl Identity,RemoteIPRanges to verify that the IP ranges are current

Entire Script to paste into EMS:

$FormatEnumerationLimit =-1
$ip = Get-HybridMailflowDatacenterIPs
Get-ReceiveConnector "Inbound From Office 365" | Set-ReceiveConnector -RemoteIPRanges $ip.DatacenterIPs

Scripted Method:
Would you like to just run a script to do this? No problem!

1. Compile this script into a .PS1 file and modify the identity of the receive connector accordingly as well as the username after Get-Credential

$FormatEnumerationLimit =-1
$O365Cred = Get-Credential YourTenantAdmin@tenant.onmicrosoft.com
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
$ip = Get-HybridMailflowDatacenterIPs
Get-ReceiveConnector "Receive Connector Name" | Set-ReceiveConnector -RemoteIPRanges $ip.datacenterips

2. Once you have this saved into .ps1 file, simply run it in Exchange Management Shell, type in your password and wait for it to complete, it should only take a matter of seconds.

Script/Scheduled Task Method:
Want it to just run for you? No problem! It involves caching a Tenant Admin password in your powershell script though.

1.  Compile this script into a .PS1 file, name it HybridIPs.PS1, throw it in the folder C:\Scripts (or change the file location in the script) and modify the identity of the receive connector accordingly as well as the username and password:

$FormatEnumerationLimit =-1
$Pass = ConvertTo-SecureString "ReplaceWithPlainTextPassword" -AsPlainText -Force
$O365Cred = New-Object System.Management.Automation.PSCredential ("YourTenantAdmin@tenant.onmicrosoft.com", $Pass)
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
$ip = Get-HybridMailflowDatacenterIPs
Get-ReceiveConnector "Receive Connector Name" | Set-ReceiveConnector -RemoteIPRanges $ip.datacenterips
Start-Sleep -S 10
Exit

2. Run powershell as an Administrator on your Hybrid Server and run the following command:
Set-ExecutionPolicy Unrestricted

3. Create a Basic Task, name it appropriately, set your desired time and interval and select it to Start a Program. In the Program/script field, paste in the following:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

A. If you're on Exchange 2013 Hybrid, add the following into 'Add arguments (optional)' field:

-command ". 'C:\Program Files\Microsoft\Exchange Server\V15\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; C:\Scripts\.\hybridips.ps1"

B. If you're on Exchange 2010 Hybrid, add the following into 'Add arguments (optional)' field:

-version 2.0 -command ". 'C:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; C:\scripts\.\hybridips.ps1"

Then give it a try. You should see Powershell open and run through its' motions. If you run into any issues, feel free to ask me in the comments section.

I hope this helps! I may be updating this in the very near future with a script to account for any/all potential failures as well as logging changes.

-Mitchel

A common question that we have to go over with customers that are new to this service is how to connect to the tenant via Powershell. Here's how I go about it.

Pre-Requisites:

Install the following components

Sign-In Assistant:

https://www.microsoft.com/en-us/download/details.aspx?id=39267

Azure AD cmdlets:

https://go.microsoft.com/fwlink/p/?linkid=236297

Easy Method:

Copy and paste the following into powershell. Update YourTenantAdmin@tenant.onmicrosoft.com to your tenant admin account

Import-Module MSOnline
$O365Cred = Get-Credential YourTenantAdmin@tenant.onmicrosoft.com
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
Connect-MsolService –Credential $O365Cred

Powershell will prompt you for a password and will connect to the tenant

Advanced:

Pre-Requesite

Run powershell as an Administrator and run the following:

Set-ExecutionPolicy Unrestricted

1. Scripted Method w/ Password Prompt
Convert the easy method above into a powershell script / .PS1 file:

Import-Module MSOnline
$O365Cred = Get-Credential YourTenantAdmin@tenant.onmicrosoft.com
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
Connect-MsolService –Credential $O365Cred

Run it and Powershell will prompt only for your password and connect to the service

2. Script + Saved password (Warning: Your password will be saved in plain text in order for this to work).
Change PlainTextPassword to your password and change YourTenantAdmin@tenant.onmicrosoft.com to your tenant admin UPN, save it as a .PS1 File

Import-Module MSOnline
$SecPass = ConvertTo-SecureString "PlainTextPassword" -AsPlainText -Force
$O365Cred = New-Object System.Management.Automation.PSCredential ("YourTenantAdmin@tenant.onmicrosoft.com", $SecPass)
$O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
Import-PSSession $O365Session
Connect-MsolService –Credential $O365Cred

Run it and Powershell will then connect to your O365 Tenant without a credential prompt. This method is very convenient, but I would only recommend it when running it as part of a process/scheduled task where you don't want a credential prompt or manually intervene. However, you can use it to connect to the tenant if you are not concerned with the security risks.

I hope it helps!

-Mitchel