ORCA.233.1: Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.
| ID | ORCA.233.1 |
| Severity | Medium |
| Suite | ORCA |
| Product | Defender |
| Related products | Exchange Online |
| Feature | Mail flow |
| Security area | Email and collaboration protection |
| Resource type | Connector |
| User impact of fixing | Low |
| Effort to fix | Medium |
| MITRE ATT&CK | T1566 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Exchange Online Protection (EOP) and Microsoft Defender for Office 365 works best when the mail exchange (MX) record is pointed directly at the service. In the event another third-party service is being used, a very important signal (the senders IP address) is obfuscated and hidden from EOP & MDO, generating a larger quantity of false positives and false negatives. By configuring Enhanced Filtering with the IP addresses of these services the true senders IP address can be discovered, reducing the false-positive and false-negative impact.
Remediation action
Section titled “Remediation action”Configure enhanced filtering on connectors when email path is not direct to EOP.
Related Links
Section titled “Related Links”Mito check, based on ORCA. Author: thomas-s-schmidt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.