Skip to main content
Notice removed Draw attention by RemarkLima
Bounty Ended with Jeff Meden's answer chosen by RemarkLima
added 279 characters in body
Source Link
RemarkLima
  • 455
  • 6
  • 17

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.


Additionally, as the answer from Jeff shows, O365 will use TLS whereever possible, so TLS will (should) be used between data centres, I'm still curious is there's an MPLS / Private network between the data centres and the traffic never leaves the O365 infrastructure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.


Additionally, as the answer from Jeff shows, O365 will use TLS whereever possible, so TLS will (should) be used between data centres, I'm still curious is there's an MPLS / Private network between the data centres and the traffic never leaves the O365 infrastructure?

Tweeted twitter.com/StackSecurity/status/717390568976990208
added 1024 characters in body
Source Link
RemarkLima
  • 455
  • 6
  • 17

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.


Edit to add: By secure, that the email and it's contents aren't travelling between servers unencrypted and over the public internet.

For example, if I send a document to Colleague A (Bob), and their mailserver is old and has no TLS setup, my email will be sent, over the public internet unencrypted.

Or Bob's mailserver does support encryption however Bob has setup his POP3 mailbox on his client to connect to it without any security, so whilst my email get's to his mailserver encrypted, he downloads it across the public internet unencrypted.

In both these examples, the email and their contents are not secure, they could be intercepted and read without any problems, potentially by any and every network they cross.

On the flip side, does Office 365 maintain the email traffic internally? Even between data centres? Or do the emails go over the public internet at any point? I would assume they are encrypted but is there any documentation to this effect? I have been unable to find anything.

Notice added Draw attention by RemarkLima
Bounty Started worth 50 reputation by RemarkLima
Source Link
RemarkLima
  • 455
  • 6
  • 17

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network?

If the two are in the same data centre (E.g. Ireland) then I'd assume this is the case but is it the same between data centres?

I've seen this: https://technet.microsoft.com/en-GB/library/dn751021(v=exchg.150).aspx for setting up secure connections to services outside of Office 365 but that doesn't cover internal situations.