Email protection with Exchange hybrid

The email protection on SFOS works like the Email Protection on UTM - So not sure why it would stop working here? 

But often times the "Scan SMTP firewall rule" causes this behavior. Check your firewall rules, there is a "ANY to ANY SMTP" Rule. You should adapt this and exclude your Exchange server. 

Thanks for your quick reply. I am not sure if I understand. Outbound emails are working if we use our Exchange Server as e. g. relay for our internal scanner and servers. Problem are incoming emails from Exchange Online. They are not routed to our internal exchange server. Should we create an email rule that excludes incoming emails from Exchange Online for spam checks?

How did you configure that on UTM? This should be applicable on SFOS as well. 

There was no special configuration. All incoming emails regarding our domain should be forwarded to our internal Exchange Server.We made the same rule as in UTM.

This works for external email perfectly. But not for emails from Exchange Online. Now we must use SFOS as relay for emails from Exchange Online. This works. But we need the internal routing cause of signature tools etc.

The message is with incoming emails from Exchange Online: "Relay not permitted". But that's the point, we don't want to relay, we want to route this emails to the internal exchange Server........

So you should configure the Email Domain inbound as well. Actually the SMTP Profiling / Relay is the same UTM vs SFOS. 

Inbound Emails can be configured based on the Domain and then routed to the Exchange. 

Thanks for your patience.

That's what we did. We copied our configuration from UTM to SFOS. We created a policy for our domain with a rule for a static host (our internal exchange server). And this works for external emails from customers quite well but does not work for Exchange Online.

There is one difference in SFOS. In UTM we configured in this rule not just the domain but the host. Now we only can configure "domain.com" but before we also had an entry for "mailhost.domain.com" for this static route!?

The question is, why does SFOS route external emails to our internal mail server but not emails from our Exchange Online? It seems like this emails were not recognized as target for our domain!?

In Exchange Online we configured "mailhost.ourdomain.com" as smarthost. I think this is the problem. That we can't use the mailhost as target any more but only the domain......

Let me rephrase what both system do: 

You have the relay approach, where you can give one host the permission to send whatever they want to whoever they want. For example, you can say the Exchange on prem can send from your domain to sophos.com. That is the relay section in UTM/SFOS. 

You have the Profile approach. Where you can say "i am the owner of this domain". For example you can say: test.com is my domain, so whoever sends an SMTP 25 communication to this domain, SFOS/UTM will accept this and send it to the mailserver you configured.

As you get "relay not permitted", SFOS considers the Email as a "Relay" email and not a profile email. 

So to speak: 

This is the same as: 

And SFOS will accept the emails based on "protected domains" like it did on UTM as "Domains". 

Yes, OK, I see. That's how we use it. But what am I missing then? It worked for years on UTM, where is the problem then!?