Security Policy Errors

Fix Inbound On-Premises Connector TLS Warning in Exchange

Khadija Khan Oct 1, 2026 869 views

Question details

The user needs to investigate and resolve an alert indicating that mail flow from an on-premises connector is arriving without proper TLS encryption.

How to Fix the Inbound On-Premises Connector TLS Warning

Product: Microsoft Exchange
Device & OS: not provided
Scenario: Monitoring inbound mail flow security and responding to a system alert regarding unencrypted messages.
Observed behavior: The system displays the alert: "Inbound OnPremises connector seeing significant mail flow without TLS."

Before you start

Ensure you have Exchange Administrator permissions in Microsoft 365 to view connector configurations and run message trace reports.

Solution 1Recommended

Review Connector Settings and Message Trace Logs

Check your Exchange admin center settings to enforce TLS encryption and identify which inbound messages are bypassing security.

This warning is triggered when Microsoft 365 detects a high volume of emails from your on-premises servers that are not encrypted with Transport Layer Security (TLS). Identifying the source through message tracing is the first step to securing your mail flow.

Verify Connector Security Settings

Navigate to the Exchange admin center, go to 'Mail flow' > 'Connectors', and select your Inbound On-Premises connector. Check the security settings to ensure TLS encryption is explicitly required.

Run a Message Trace

In the Exchange admin center, navigate to 'Mail flow' > 'Message trace'. Run a trace for the affected timeframe to pinpoint which specific emails and sender IP addresses are arriving without TLS.

Check On-Premises Transport Logs

Access your local Exchange server and review the SMTP send transport logs. Look for failed TLS negotiation attempts or certificate validation errors when sending to Microsoft 365.

TLS Version Requirements: Microsoft 365 requires TLS 1.2 or higher. Ensure your on-premises Exchange server is fully updated and configured to use modern TLS protocols.

Solution 2

Consult the Exchange Server Management Forum

If configuration checks do not resolve the issue, reach out to Microsoft specialists for complex hybrid Exchange environments.

Free Microsoft Office alternative

Need a Lightweight Office Alternative for Your Daily Work?

While you manage your server and email configurations, simplify your everyday document tasks with WPS Office. It provides a highly compatible suite for word processing, spreadsheets, and presentations without the heavy resource footprint.

1. Visit the WPS Office Website: Go to the official WPS Office website on your computer.
2. Download the Installer: Click the 'Free Download' button to get the lightweight installation package.
3. Install and Work: Run the installer, follow the on-screen instructions, and start opening your Office documents instantly.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation that doesn't slow down your system or conflict with server tools.Free alternative to Microsoft Office with a familiar, easy-to-use interface.Built-in PDF editing, merging, and conversion tools for seamless document management.

microsoft office alternative - wps office

Frequently Asked Questions

What is an Inbound On-Premises Connector in Exchange?

It is a configuration within Microsoft 365 (Exchange Online) that defines how emails from your organization's own on-premises email servers are securely received and processed.

Why is TLS important for my mail flow?

TLS (Transport Layer Security) encrypts email data as it travels across the internet. It prevents unauthorized interception and ensures message confidentiality between your local servers and Microsoft 365.

How do I force TLS on an Exchange connector?

In the Exchange admin center, edit your connector's properties. Under the 'Security' section, select the checkbox to reject email messages if they are not sent over TLS.

Why might my on-premises server fail to send over TLS?

Common causes include expired or misconfigured SSL certificates on the local server, outdated operating systems that don't support TLS 1.2, or firewalls inspecting and altering SMTP traffic.

Microsoft Office Security Issues