Blocking students sending to All staff email - HELP

[maxrebo]

Ive been asked to stop students sending to the All staff email address.....pretty easy to do using 365 Mail rules...BUT our current setup (which I've inherited) wont let me do it.

 

Our pupils are a member of "Pupils which is a On prem mail enabled security group

The all staff email is a On prem mail enabled security group : (allstaff@)

 

Here, the all staff email is a Mail enabled security group (on prem AD)

 

Setting up the rule in 365 :

 

Apply this rule if : The Sender \ is a member of pupil

And / The recipient is this person : all staff@

 

Block message

 

It wont let me do this and gives me the error saying "Sentto : Does not allow distribution groups"

 

I've been told by a few people in school that this should be able to be done, but I'm telling them with our setup that it cant?!

 

They also want to still allow pupils to send to staff so I cant just block it that way.

 

Am i missing something?

[drutt]

We use delivery management in the specific group on the exchange portal for this in 365:

 

https://learn.microsoft.com/en-us/exchange/recipients/distribution-groups?view=exchserver-2019#delivery-management

[ColonelPanic]

That does sound like a problem.

 

You could create a 365 email account/shared mailbox (it really doesn't matter) called "[email protected]", and set the transport rules for that (however you like with it being a 365 account) and then set up auto-forwarding to the existing allstaff@schooname distribution list?

 

Edit: Could you generate an all-staff 365 group using the dynamic group membership rules in Entra? If the email address format is consistent for all staff, but not shared with students/other staff you don't want in the group for example.

Edited February 12, 2025 by ColonelPanic

[maxrebo]

We use delivery management in the specific group on the exchange portal for this in 365:

 

https://learn.microsoft.com/en-us/exchange/recipients/distribution-groups?view=exchserver-2019#delivery-management

 

I will give this a try. Thank you.

[I_just_work_here]

We're in a hybrid AD / Entra state, with email groups defined via on-prem AD like yours. Since we don't have access to Exchange online (MAT controlled), we do all the config in AD:

 

Within Active Directory...

1) Create a new mail enabled security group (e.g. "SCHOOL_ALL_STAFF_SENDERS)

2) Add the users to the above group who you want to allow to send all staff emails

3) Go to your All Staff mail enabled security group, and open the Attribute Editor

4) Find the 'dLMemSubmitPerms' attribute.

5) Set this attribute to the object path for your allowed senders group (e.g. CN=SCHOOL_ALL_STAFF_SENDERS,OU=O365 Groups,OU=SchoolName,DC=YOUR,DC=DOMAIN)

 

This may take a little while to sync with Entra, but once done it should reject messages from people not in the senders group.

 

Hope this helps

[3s-gtech]

Pretty much as above. You need a security group for this - which is why I based all of our email lists off security groups rather than distribution groups back when I set up Exchange 12 years ago. I've always used the ECP to set it but as that's now gone it's a bit fiddlier.

 

You can also manage this with Powershell.

[Olliedawg]

I'm looking at this now. We have "hybrid" exchange with no on prem exchange server switched on so I'm stuck with ADUC attribute editor/PowerShell.

 

We have a similar setup & don't allow students to email staff DL groups. "msExchRequireAuthToSendTo" is also set to TRUE on all of our DL groups besides our main "[email protected]" group. This works spot on to only allow internal mail to those DL groups. Recently we have a parent find this all staff address somehow, and an email was sent about a students forgotten PE kit.. would like to put at stop to this to prevent any further emails.

 

Issue is, I cannot set the "msExchRequireAuthToSendTo" attribute to TRUE, as this address is used to receive various reports from our MIS (cover, fire drill etc..).

 

Wonder if it is possible to add in a AD contact, with our external MIS email address "[email protected]" listed as the email address, and add this user into the "dLMemSubmitPerms" attribute of the DL list? Has anyone ever done anything like this before?

 

[J-14P]

1 minute ago, Olliedawg said:

I'm looking at this now. We have "hybrid" exchange with no on prem exchange server switched on so I'm stuck with ADUC attribute editor/PowerShell.

 

We have a similar setup & don't allow students to email staff DL groups. "msExchRequireAuthToSendTo" is also set to TRUE on all of our DL groups besides our main "[email protected]" group. This works spot on to only allow internal mail to those DL groups. Recently we have a parent find this all staff address somehow, and an email was sent about a students forgotten PE kit.. would like to put at stop to this to prevent any further emails.

 

Issue is, I cannot set the "msExchRequireAuthToSendTo" attribute to TRUE, as this address is used to receive various reports from our MIS (cover, fire drill etc..).

 

Wonder if it is possible to add in a AD contact, with our external MIS email address "[email protected]" listed as the email address, and add this user into the "dLMemSubmitPerms" attribute of the DL list? Has anyone ever done anything like this before?

 

I've seen discussions about external addresses before, but never actually seen anyone try/solve it. Would be nice to know if the AD contact way works as we have a similar setup, and I can imagine it'll only take one external parent to trigger this change for us too.

[Boredguy]

Well an out the box method could be a mail rule.

Example

 

A MSP did something similar at one of our sites to block students from e-mailing the staff list instead of just using the extended attribute as it wasn't a mail enabled security group in AD but just a cloud distribution list.

Edited 1 hour ago by Boredguy
Added extra text

[Olliedawg]

33 minutes ago, Boredguy said:

Well an out the box method could be a mail rule.

Example

 

A MSP did something similar at one of our sites to block students from e-mailing the staff list instead of just using the extended attribute as it wasn't a mail enabled security group in AD but just a cloud distribution list.

I'll try that first, much easier if that does work!