Skip to content
exonaut

inboundConnectors

Inbound Connectors. Connectors controlling how mail is received into the tenant. The inboundConnectors entity set lives under /exchange/v1.0/inboundConnectors in the Mail flow category.

Fact Value
Path /exchange/v1.0/inboundConnectors
Category Mail flow
Tier Tier 3, Mail flow
Read role MailFlow.Read.All (Community)
Write role MailFlow.ReadWrite.All (Pro)
Backing cmdlets Get-InboundConnector, Set-InboundConnector, New-InboundConnector, Remove-InboundConnector

Routes

Section titled “Routes”
Method Path Synopsis Role Plan
GET /exchange/v1.0/inboundConnectors List inboundConnectors entries. MailFlow.Read Community
POST /exchange/v1.0/inboundConnectors POST /inboundConnectors - creates a connector via New-InboundConnector. Returns 201 + Location. MailFlow.ReadWrite Pro
GET /exchange/v1.0/inboundConnectors/{key} Get a single inboundConnectors entry by Identity. MailFlow.Read Community
PATCH /exchange/v1.0/inboundConnectors/{key} PATCH /inboundConnectors/{key} - partial update via Set-InboundConnector. Returns 200 + updated entity. MailFlow.ReadWrite Pro
DELETE /exchange/v1.0/inboundConnectors/{key} DELETE /inboundConnectors/{key} - destructive, no soft-delete. MailFlow.ReadWrite Pro

GET /exchange/v1.0/inboundConnectors

Section titled “GET /exchange/v1.0/inboundConnectors”

List inboundConnectors entries.

Backing cmdlet: Get-InboundConnector. Role: MailFlow.Read (Community).

Parameter In Type Required Description
all query bool (switch) Return all results instead of the EXO default of 1000. Maps -ResultSize Unlimited on Get-InboundConnector; prevents silent truncation in large tenants.

List inboundConnectors

Section titled “List inboundConnectors”

Returns the tenant’s inbound connectors, which control how mail from partner organizations or on-premises servers flows into Exchange Online. Backed by Get-InboundConnector.

GET /exchange/v1.0/inboundConnectors?$top=3 HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#inboundConnectors",
  "value": [
    {
      "Id": "Partner Connector",
      "Name": "Partner Connector",
      "Identity": "Partner Connector",
      "DistinguishedName": "CN=Partner Connector,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
      "AdminDisplayName": "",
      "Comment": "21/08/2025 - testing purposes in support of blocking Direct Send - Ayla Kol",
      "Guid": "3f1c9a72-8b04-4d61-9e2a-1c7f6b0d5e84",
      "NameHashGuid": "9478bb8c-63a4-2d70-f8b8-11bb1c5975b1",
      "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
      "Enabled": true,
      "ConnectorType": "Partner",
      "ConnectorSource": "AdminUI",
      "SenderDomains": [
        "smtp:*;1"
      ],
      "SenderIPAddresses": [
        "192.0.2.1",
        "192.0.2.2"
      ],
      "AssociatedAcceptedDomains": [],
      "ClientHostNames": [],
      "TrustedOrganizations": [],
      "ScanAndDropRecipients": [],
      "RequireTls": false,
      "RestrictDomainsToCertificate": false,
      "RestrictDomainsToIPAddresses": false,
      "TlsSenderCertificateName": null,
      "CloudServicesMailEnabled": false,
      "TreatMessagesAsInternal": false,
      "EFSkipLastIP": false,
      "EFSkipIPs": [],
      "EFSkipMailGateway": [],
      "EFTestMode": false,
      "EFUsers": [],
      "WhenCreated": "2026-03-30T17:55:35+03:00",
      "WhenChanged": "2026-03-30T17:55:42+03:00",
      "WhenCreatedUTC": "2026-03-30T17:55:35+03:00",
      "WhenChangedUTC": "2026-03-30T17:55:42+03:00",
      "ExchangeObjectId": "ceb7a795-72ef-4675-8c89-dec3f45b4339",
      "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
      "OrganizationalUnitRootInternal": "contoso.onmicrosoft.com"
    }
  ]
}

Notes: The tenant has a single inbound connector; the list reflects that. SenderIPAddresses uses RFC 5737 documentation IPs here.

Related: GET /exchange/v1.0/inboundConnectors/{key}

POST /exchange/v1.0/inboundConnectors

Section titled “POST /exchange/v1.0/inboundConnectors”

POST /inboundConnectors - creates a connector via New-InboundConnector. Returns 201 + Location.

Backing cmdlet: New-InboundConnector. Role: MailFlow.ReadWrite (Pro).

Parameter In Type Required Description
name body yes
senderDomains body yes
associatedAcceptedDomains body
clientHostNames body
cloudServicesMailEnabled body
comment body
connectorSource body
connectorType body
efSkipIPs body
efSkipLastIP body
efSkipMailGateway body
efTestMode body
efUsers body
enabled body
requireTls body
restrictDomainsToCertificate body
restrictDomainsToIPAddresses body
scanAndDropRecipients body
senderIPAddresses body
tlsSenderCertificateName body
treatMessagesAsInternal body
trustedOrganizations body
dryRun query bool (switch)

Create fails when senderDomains is missing

Section titled “Create fails when senderDomains is missing”

New-InboundConnector requires both name and senderDomains. Omitting senderDomains returns a 400 BadRequest from the write-param validation before the cmdlet is invoked.

POST /exchange/v1.0/inboundConnectors HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "name": "exonaut-sample-inboundConnectors"
}
HTTP/1.1 400 Bad Request
Content-Type: application/json


{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'senderDomains' is required.",
    "target": "senderDomains"
  },
  "correlationId": "0HN7X4Q2A1B3C:00000004"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/inboundConnectors

Create an inbound connector

Section titled “Create an inbound connector”

Creates an inbound mail-flow connector via New-InboundConnector. Name and senderDomains are required; the connector governs how mail from a partner org or on-prem server is accepted into EXO.

POST /exchange/v1.0/inboundConnectors HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "name": "exonaut-sample-inboundConnectors",
  "senderDomains": [
    "contoso.com"
  ],
  "connectorType": "Partner",
  "requireTls": true,
  "tlsSenderCertificateName": "mail.contoso.com",
  "comment": "EXONAUT sample inbound connector for partner mail flow",
  "enabled": true
}
HTTP/1.1 201 Created
Location: /exchange/v1.0/inboundConnectors/exonaut-sample-inboundConnectors


{
  "Id": "exonaut-sample-inboundConnectors",
  "Identity": "exonaut-sample-inboundConnectors",
  "Name": "exonaut-sample-inboundConnectors",
  "SenderDomains": [
    "smtp:contoso.com;1"
  ],
  "ConnectorType": "Partner",
  "RequireTls": true,
  "TlsSenderCertificateName": "mail.contoso.com",
  "Comment": "EXONAUT sample inbound connector for partner mail flow",
  "Enabled": true
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/inboundConnectors

GET /exchange/v1.0/inboundConnectors/{key}

Section titled “GET /exchange/v1.0/inboundConnectors/{key}”

Get a single inboundConnectors entry by Identity.

Backing cmdlet: Get-InboundConnector. Role: MailFlow.Read (Community).

Get a single inboundConnectors entry

Section titled “Get a single inboundConnectors entry”

Returns the full inbound connector identified by {key}. Backed by Get-InboundConnector with -Identity {key}.

GET /exchange/v1.0/inboundConnectors/{key} HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 200 OK


{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#inboundConnectors/$entity",
  "Id": "Partner Connector",
  "Name": "Partner Connector",
  "Identity": "Partner Connector",
  "DistinguishedName": "CN=Partner Connector,CN=Transport Settings,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR01A017,DC=PROD,DC=OUTLOOK,DC=COM",
  "AdminDisplayName": "",
  "Comment": "21/08/2025 - testing purposes in support of blocking Direct Send - Ayla Kol",
  "Guid": "3f1c9a72-8b04-4d61-9e2a-1c7f6b0d5e84",
  "NameHashGuid": "9478bb8c-63a4-2d70-f8b8-11bb1c5975b1",
  "OrganizationId": "EURPR01A017.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR01A017.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration",
  "Enabled": true,
  "ConnectorType": "Partner",
  "ConnectorSource": "AdminUI",
  "SenderDomains": [
    "smtp:*;1"
  ],
  "SenderIPAddresses": [
    "192.0.2.1",
    "192.0.2.2"
  ],
  "AssociatedAcceptedDomains": [],
  "ClientHostNames": [],
  "TrustedOrganizations": [],
  "ScanAndDropRecipients": [],
  "RequireTls": false,
  "RestrictDomainsToCertificate": false,
  "RestrictDomainsToIPAddresses": false,
  "TlsSenderCertificateName": null,
  "CloudServicesMailEnabled": false,
  "TreatMessagesAsInternal": false,
  "EFSkipLastIP": false,
  "EFSkipIPs": [],
  "EFSkipMailGateway": [],
  "EFTestMode": false,
  "EFUsers": [],
  "WhenCreated": "2026-03-30T17:55:35+03:00",
  "WhenChanged": "2026-03-30T17:55:42+03:00",
  "WhenCreatedUTC": "2026-03-30T17:55:35+03:00",
  "WhenChangedUTC": "2026-03-30T17:55:42+03:00",
  "ExchangeObjectId": "ceb7a795-72ef-4675-8c89-dec3f45b4339",
  "OrganizationalUnitRoot": "contoso.onmicrosoft.com",
  "OrganizationalUnitRootInternal": "contoso.onmicrosoft.com"
}

Notes: The {key} is the connector’s Name/Identity (‘Partner Connector’ here). SenderIPAddresses uses RFC 5737 documentation IPs.

Related: GET /exchange/v1.0/inboundConnectors

Get a single inboundConnectors entry - not found

Section titled “Get a single inboundConnectors entry - not found”

Returns a 404 with the canonical error envelope when the supplied {key} does not resolve to an existing inbound connector. Backed by Get-InboundConnector with -Identity {key}.

GET /exchange/v1.0/inboundConnectors/{key} HTTP/1.1
Authorization: Bearer {token}
HTTP/1.1 404 Not Found


{
  "error": {
    "code": "NotFound",
    "message": "Exchange object 'does-not-exist-12345' could not be found.",
    "target": "identity",
    "innerError": {
      "cmdlet": "Get-InboundConnector"
    }
  },
  "correlationId": "0HNLSU6PPVJ03:00000001"
}

Notes: The 404 envelope is emitted by ExoExceptionMiddleware when the cmdlet cannot resolve -Identity.

Related: GET /exchange/v1.0/inboundConnectors

PATCH /exchange/v1.0/inboundConnectors/{key}

Section titled “PATCH /exchange/v1.0/inboundConnectors/{key}”

PATCH /inboundConnectors/{key} - partial update via Set-InboundConnector. Returns 200 + updated entity.

Backing cmdlet: Set-InboundConnector. Role: MailFlow.ReadWrite (Pro).

Parameter In Type Required Description
associatedAcceptedDomains body
cloudServicesMailEnabled body
comment body
connectorSource body
connectorType body
efSkipIPs body
efSkipLastIP body
efSkipMailGateway body
efTestMode body
efUsers body
enabled body
name body
requireTls body
restrictDomainsToCertificate body
restrictDomainsToIPAddresses body
scanAndDropRecipients body
senderDomains body
senderIPAddresses body
tlsSenderCertificateName body
treatMessagesAsInternal body
trustedOrganizations body
dryRun query bool (switch)

Update an inbound connector

Section titled “Update an inbound connector”

Partial update of an inbound connector via Set-InboundConnector. Only the supplied SetWritable fields are changed; Identity comes from the URL key. Returns 200 with the updated entity.

PATCH /exchange/v1.0/inboundConnectors/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json


{
  "comment": "Updated by EXONAUT - TLS now required",
  "requireTls": true,
  "enabled": false
}
HTTP/1.1 200 OK
Content-Type: application/json


{
  "Id": "exonaut-sample-inboundConnectors",
  "Identity": "exonaut-sample-inboundConnectors",
  "Name": "exonaut-sample-inboundConnectors",
  "Comment": "Updated by EXONAUT - TLS now required",
  "RequireTls": true,
  "Enabled": false
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/inboundConnectors

DELETE /exchange/v1.0/inboundConnectors/{key}

Section titled “DELETE /exchange/v1.0/inboundConnectors/{key}”

DELETE /inboundConnectors/{key} - destructive, no soft-delete.

Backing cmdlet: Remove-InboundConnector. Role: MailFlow.ReadWrite (Pro).

Parameter In Type Required Description
dryRun query bool (switch)

Delete an inbound connector

Section titled “Delete an inbound connector”

Permanently removes an inbound connector via Remove-InboundConnector. This is destructive - there is no soft-delete. Returns 204 No Content on success.

DELETE /exchange/v1.0/inboundConnectors/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json
HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/inboundConnectors

?dryRun=true previews of any write stay on Community.