Avanan - Protect External

To create and configure the Avanan - Protect External rule:

  1. In the Exchange admin center, Click Mail flow > Rules.
  2. To add a rule, click Add a rule and select Create a new rule.
  3. For Name, enter Avanan - Protect External.
  4. For Apply this rule if..., add this condition:

    The sender is located outside the organization.

  5. For Do the following..., add these two actions:

    1. Modify the message properties:

      1. In the first field, select Modify the message properties.

      2. In the next field, select set the message header.

      3. Click the first Enter text and enter X-CLOUD-SEC-AV-Info

      4. Click the second Enter header and enter this value: {portal}, office365_emails, inline (replace "{portal}" with your portal name)

    2. Redirect the message to: Use the following connector, select Avanan DLP Outbound connector.

      1. In the first field, select Redirect the message to.

      2. In the next field, select the following connector.

      3. Select Avanan DLP Outbound connector and click Save.

  6. For Except if..., add these two exceptions:

    1. The message has an SCL greater than or equal to 5.

      1. In the first field, select The message properties.

      2. In the next field, select include an SCL greater than or equal to.

      3. From the dropdown, select 5 and click Save.

    2. Sender's IP address is in the range:

      1. In the first field, select The sender.

      2. In the next field, select IP address is in any of these ranges or exactly matches.

      3. Enter the IP address, click Add and then click Save.

        • If your data residency is in the United States, enter this IP address:

          • 18.97.17.224/28

          • 35.174.145.124

        • If your data residency is in Europe, enter this IP address:

          • 3.40.131.0/28

          • 52.212.19.177

        • If your data residency is in Australia, enter this IP address:

          • 13.211.69.231

          • 18.98.196.176/28

        • If your data residency is in Canada, enter this IP address:

          • 15.222.110.90

          • 18.99.4.64/28

        • If your data residency is in India, enter this IP address:

          • 3.109.187.96

          • 18.96.227.0/28

        • If your data residency is in United Kingdom, enter this IP address:

          • 3.41.0.160/28

          • 13.42.61.32

        • If your data residency is in United Arab Emirates, enter this IP address:

          • 3.29.194.128

          • 18.96.97.192/28

        • If your data residency is in Singapore, enter this IP address:

          • 3.44.1.224/28

          • 18.99.40.64

    Note:

    If you have other inbound connectors using IP addresses, add their IP addresses to this list.

  7. Click Next.
  8. In the Rule mode, select Enforce.
  9. From the Severity drop-down list, select the severity level.
  10. Select the Activate this rule on check box and select the required date and time.
  11. Select the Deactivate this rule on check box and select the required date and time.
  12. Select the Stop processing more rules checkbox.
  13. In the Match sender address in message field, select Header.
  14. Click Next.
  15. In the Review and finish window, verify the settings and click Finish.