Bypassing mail filters using mail.onmicrosoft.com

In M365, besides a user's email address [email protected] they also have an email address in the form [email protected]. Also they may have an email address in the form [email protected].

Depending on what mail filter you use, sending an email to [email protected], or [email protected], will bypass the filter because if the filter is filtering at mx level.

This is obviously a risk.

You can fix this by using an Exchange online transport rule:

if address includes example.mail.onmicrosoft.com reject.

If you think it is appropriate you can reject with a response to the sender telling them why.