How to Configure IP Address Filtering in Microsoft 365
Question details
The user is inquiring about whether Microsoft 365 supports IP address filtering and how to configure it to restrict or permit incoming mail server traffic.
- Product
- Microsoft 365 Exchange
- Device & OS
- not provided
- Scenario
- Administrators need to secure their organization's email environment by allowing or blocking specific mail servers based on their source IP addresses.
- Observed behavior
- The goal state is an active connection filter policy in Exchange Online Protection that accurately filters incoming emails using specified source IP addresses.
Ensure you have the necessary administrator privileges for the Microsoft 365 Exchange admin center to view and modify protection and connection filter policies.
Configure the Connection Filter Policy in Exchange Online
Use the Exchange admin center to edit the default connection filter policy, allowing you to explicitly add allowed or blocked source IP addresses for your mail servers.
Microsoft 365 provides robust IP address filtering specifically through Exchange Online and Exchange Online Protection (EOP). By modifying the connection filter policy, administrators can control exactly which mail servers are trusted and which should be outright rejected before they reach user inboxes.
Sign in to your Microsoft 365 admin console and navigate directly to the Exchange admin center.
On the left sidebar, click on Protection, and then select the Connection Filter tab.
Locate the default connection filter policy in the list, click to select it, and choose the Edit (pencil) icon.
Under the IP Allow list or IP Block list sections, click the plus icon to add the specific source IP addresses you wish to filter.
Click Save to apply your new IP filtering rules. It may take a few moments for the policy to propagate across your Exchange Online Protection environment.
Need a Fast, Free Alternative for Your Daily Office Tasks?
While server-side configurations like IP filtering are handled by Microsoft 365 admin portals, you might be looking for a lightweight, cost-effective office suite for your desktop productivity. WPS Office provides a robust, professional alternative to traditional Microsoft desktop apps without the subscription fees.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Suite: Run the downloaded installation file and follow the quick setup wizard.
- 3. Open Your Files: Launch WPS Office to instantly open, edit, and save your existing Word, Excel, and PowerPoint documents.
Frequently Asked Questions
Does Microsoft 365 block known malicious IP addresses automatically?
Yes, Microsoft 365 uses Exchange Online Protection (EOP), which incorporates built-in threat intelligence and spam filtering to automatically block known malicious IP addresses without requiring manual configuration.
Can I filter IP addresses for specific user accounts rather than the whole organization?
IP filtering configured in the Exchange admin center's connection filter policy applies globally to your entire organization. To filter for specific users, you would need to set up custom mail flow rules (transport rules).
Where can I find the official Microsoft 365 IP address ranges?
Microsoft publishes and regularly updates its official service endpoints and IP address ranges on its enterprise documentation site. Searching for 'Microsoft 365 URLs and IP address ranges' will direct you to the official list.
Why are messages from my allowed IP addresses still being quarantined?
Even if an IP address is on your allowed list, other Microsoft 365 security policies—such as spoof intelligence, anti-phishing rules, or malware filters—may still quarantine a message if its content or sender behavior violates specific security criteria.
