How to export mail flow connectors in Exchange Online

Before you start

Use an account in the Organization Management role group, which Microsoft lists for connectors in Exchange Online. Microsoft says members of View-Only Management can view the configuration of the same features.

Connectors carry mail between Microsoft 365 and your own email servers or a partner organisation. A tenant with none set up has none to export, and the Hybrid Configuration Wizard creates its own. The examples read the connectors and export them; they turn none on or off, validate none and change nothing.

Option 1

Export mail flow connectors with PowerShell

Install the module once, then connect and export the inbound and outbound connectors to 2 CSV files. The outbound connectors are read 4 ways, once for each combination of the test mode and rule scope filters, and each is kept once.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $inbound = @(Get-InboundConnector -ResultSize Unlimited | ForEach-Object {
        [pscustomobject]@{
            Name = $_.Name; Enabled = $_.Enabled; Type = $_.ConnectorType
            SenderDomains = ($_.SenderDomains -join '; ')
            SenderIPAddresses = ($_.SenderIPAddresses -join '; ')
            RequireTls = $_.RequireTls; Certificate = $_.TlsSenderCertificateName
            RestrictToIPAddresses = $_.RestrictDomainsToIPAddresses
            RestrictToCertificate = $_.RestrictDomainsToCertificate
            TreatAsInternal = $_.TreatMessagesAsInternal; Changed = $_.WhenChanged
        }
    })
    # Each filter returns only the connectors that match it, so all 4 are read.
    $filters = @(
        @{}, @{ IsTransportRuleScoped = $true }, @{ IncludeTestModeConnectors = $true },
        @{ IsTransportRuleScoped = $true; IncludeTestModeConnectors = $true }
    )
    $seen = @{}
    $outbound = @(foreach ($filter in $filters) {
        foreach ($connector in Get-OutboundConnector @filter -ResultSize Unlimited) {
            $key = "$($connector.Identity)"
            if ($seen.ContainsKey($key)) { continue }
            $seen[$key] = $true
            [pscustomobject]@{
                Name = $connector.Name; Enabled = $connector.Enabled
                Type = $connector.ConnectorType
                RecipientDomains = ($connector.RecipientDomains -join '; ')
                SmartHosts = ($connector.SmartHosts -join '; ')
                UseMXRecord = $connector.UseMXRecord; TlsSettings = $connector.TlsSettings
                RuleScoped = $connector.IsTransportRuleScoped
                TestMode = $connector.TestMode; Validated = $connector.IsValidated
                Changed = $connector.WhenChanged
            }
        }
    })
    if ($inbound.Count + $outbound.Count -eq 0) {
        Write-Output 'The tenant has no inbound or outbound connectors.'
    } else {
        $inbound | Sort-Object Name |
            Export-Csv -Path './inbound-connectors.csv' -NoTypeInformation -Encoding utf8
        $outbound | Sort-Object Name |
            Export-Csv -Path './outbound-connectors.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($inbound.Count) inbound and $($outbound.Count) outbound connectors."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

Each CSV has 1 row for each connector, with the domains, addresses and hosts joined by semicolons. To keep more settings, add properties to either [pscustomobject]; to read 1 connector in full, pass its name to Get-InboundConnector or Get-OutboundConnector and pipe it to Format-List.

Option 2

Review connectors in the admin centre

1. Open the Exchange admin centre for the correct tenant.
2. Go to Mail flow > Connectors. The list includes connectors created by the Hybrid Configuration Wizard or with PowerShell.
3. Select a connector to open its details and read its status, where mail comes from and goes to, and its security settings.
4. Read the validation history for a connector that carries mail out of Microsoft 365.
5. Close the details without choosing Validate this connector or Edit name or status: validating sends a test message, and editing changes the connector.

This suits checking 1 or 2 connectors in a tenant you already have open. For a record to keep and compare, or to be sure no test mode connector is missed, use PowerShell or a report.

Common questions

Why does the export have an outbound connector the list did not show?

The script asks for connectors in test mode and connectors scoped to mail flow rules, which Get-OutboundConnector leaves out unless asked. A rule scoped connector is used only when a mail flow rule routes mail to it.

Do I need a connector to send mail to the internet?

No. Mail between Exchange Online mailboxes and internet addresses needs no connector. Connectors are for mail to and from your own email servers or a partner organisation that needs specific settings.

Which mail flow rules use a connector?

A rule names its outbound connector with RouteMessageOutboundConnector. To export every rule with its actions, see how to export mail flow rules in Exchange Online.