WARNING: Exchange Online Mail Contacts

[TechMonkey]

This may not be news to anyone but we have just found that Mail Contacts moved to Office 365 are all externally addressable. Whereas with our on-site Exchange we had an EMail Address Policy removing emails from Mail Contacts and so they would be given a hidden .local address, Exchange Online does not have this option, and so any mail contact has an alias@domain email address that anyone can send to. So an email spammer may guess an email format and send emails to an address that gets passed straight through to a private and personal address. Apparently there is no way to prevent this as removing the email will stop any use of the mail contact.

 

Our solution has been to create a dynamic group containing all mail contacts and then a transport rule that bounces any external email to members of that dynamic group. If you allow external parties to email your groups and they contain a mail contact, this may break that but we do not so for now this solves it.

 

Hope that helps someone.