Blocking students sending to All staff email - HELP

[maxrebo]

Ive been asked to stop students sending to the All staff email address.....pretty easy to do using 365 Mail rules...BUT our current setup (which I've inherited) wont let me do it.

 

Our pupils are a member of "Pupils which is a On prem mail enabled security group

The all staff email is a On prem mail enabled security group : (allstaff@)

 

Here, the all staff email is a Mail enabled security group (on prem AD)

 

Setting up the rule in 365 :

 

Apply this rule if : The Sender \ is a member of pupil

And / The recipient is this person : all staff@

 

Block message

 

It wont let me do this and gives me the error saying "Sentto : Does not allow distribution groups"

 

I've been told by a few people in school that this should be able to be done, but I'm telling them with our setup that it cant?!

 

They also want to still allow pupils to send to staff so I cant just block it that way.

 

Am i missing something?

[drutt]

We use delivery management in the specific group on the exchange portal for this in 365:

 

https://learn.microsoft.com/en-us/exchange/recipients/distribution-groups?view=exchserver-2019#delivery-management

[ColonelPanic]

That does sound like a problem.

 

You could create a 365 email account/shared mailbox (it really doesn't matter) called "[email protected]", and set the transport rules for that (however you like with it being a 365 account) and then set up auto-forwarding to the existing allstaff@schooname distribution list?

 

Edit: Could you generate an all-staff 365 group using the dynamic group membership rules in Entra? If the email address format is consistent for all staff, but not shared with students/other staff you don't want in the group for example.

Edited February 12, 2025 by ColonelPanic

[maxrebo]

We use delivery management in the specific group on the exchange portal for this in 365:

 

https://learn.microsoft.com/en-us/exchange/recipients/distribution-groups?view=exchserver-2019#delivery-management

 

I will give this a try. Thank you.

[I_just_work_here]

We're in a hybrid AD / Entra state, with email groups defined via on-prem AD like yours. Since we don't have access to Exchange online (MAT controlled), we do all the config in AD:

 

Within Active Directory...

1) Create a new mail enabled security group (e.g. "SCHOOL_ALL_STAFF_SENDERS)

2) Add the users to the above group who you want to allow to send all staff emails

3) Go to your All Staff mail enabled security group, and open the Attribute Editor

4) Find the 'dLMemSubmitPerms' attribute.

5) Set this attribute to the object path for your allowed senders group (e.g. CN=SCHOOL_ALL_STAFF_SENDERS,OU=O365 Groups,OU=SchoolName,DC=YOUR,DC=DOMAIN)

 

This may take a little while to sync with Entra, but once done it should reject messages from people not in the senders group.

 

Hope this helps

[3s-gtech]

Pretty much as above. You need a security group for this - which is why I based all of our email lists off security groups rather than distribution groups back when I set up Exchange 12 years ago. I've always used the ECP to set it but as that's now gone it's a bit fiddlier.

 

You can also manage this with Powershell.