In this post we will go through how to achieve conditional mail routing in Exchange Online Protection, without the need of having forwarding addresses per user. This means we can deliver incoming emails sent to the same domain to different back end servers, based on other criterias than forwarding addresses, like certain attributes or group membership.
If interested in how to do this using the mail users and forwarding addresses method, Andreas wrote a post a while ago about using Exchange Online as a mail gateway for decentalized email domains.
Scenario:
- Exchange Online Protection is in place for all incoming emails.
- You have a single Exchange organization, but different servers across the globe. You want to have external incoming emails directly to the correct mailbox server without transferring them trough your WAN connection.
- DirSync from your tenant to EOP is already activated and in place, which means all users and Groups are already in WAAD.
- Our incoming email routing will look like in the sketch below, based on AD Group membership.
Setup
As we in this case already have decided to base our email routing on AD groups which is already in sync with WAAD, the things we need to configure in EOP for each target server are following:
1. Create an outbound connector with support for Criteria Based Routing (CBR). Of course more than one smart host can be added for redundancy purposes. 
New-OutboundConnector -Name "CBR - eumx.365lab.net" `
-ConnectorType OnPremises `
-SmartHosts "eumx.365lab.net" `
-UseMXRecord $false `
-IsTransportRuleScoped $true
2. Create a mail flow/transport rule for each destination connector/ad group.
New-TransportRule -Name "CBR - eumx.365lab.net" `
-SentToMemberOf "Europe@365lab.net" `
-RouteMessageOutboundConnector "CBR - eumx.365lab.net"
To avoid mail flow issues for users that are not in any of the groups, make sure you keep your existing default outbound connector.
/Johan
Tailspintoys - 365lab.net 