Mailflow Rules Tamper Alert and Remediation

We are excited to introduce a powerful enhancement, ‘MFR Tamper Alert and Remediation’, that will transform how you manage your M365 mail flow rules and connectors for Sophos Mailflow.

With this enhancement, Sophos Email can now monitor changes made in the M365 environment and notify you if any modifications made there impacts your Mailflow setup in Sophos. Moreover, in most cases, you can apply necessary corrections directly from Sophos Central, minimizing the need to go to M365 portal or to reach out to our support team.

Key Benefits:

1. Monitoring of M365 change logs: Stay informed about any changes made to M365 mail flow rules and connectors.
2. Proactive Notifications through multiple channels: Receive alerts in Sophos Central and email notifications to review modifications promptly.
3. Efficient Correction Process: Apply fixes directly from the Sophos Central system, saving time and effort.

This enhancement ensures uninterrupted email protection when M365's mail flow rules or connectors are updated. By promptly reviewing and rectifying any issues, you can maintain the integrity of your email security. Please note that the alerts and the notifications may be delayed by up to an hour.

Please note that an alert doesn’t necessarily mean that your MFR setup is broken. It is to notify you that some configuration in M365 has changed, and you should review the configuration and make sure that the Sophos MFR setup is intact.

The notifications are sent in 3 ways:

1. An alert in Sophos Central dashboard.
2. An email notification
3. Status update on Sophos Central’s domain settings page.

To receive these alerts, you must make sure to:

• Turn auditing on in M365
• Grant necessary permissions to Sophos

Reference screenshots:

Dashboard alerts:

Domain status update:

For detailed instructions on activating the alerts and applying the necessary corrections, refer to the updated product documentation here.