I've been doing some research on Office 365 reporting and don't seem to be finding a direct answer to my question.
Essentially, we have a domain that's set up with 2 MX records: the primary MX record points to an on-premises Barracuda spam filter, and the secondary MX record points to Office 365 directly.
There are concerns that a malicious attacker could be, and is, sending emails directly to Office 365, bypassing the Barracuda. Or, the Barracuda could be experiencing a DoS (whether directed by attacker, Internet service interruption, etc) that is causing a failover to the secondary MX record for legitimate sending SMTP systems.
I've been tasked to find, in Office 365, any occurrences of emails sent directly to Office 365 that were not redirected from the on-premises Barracuda. Does Office 365 have such a report I could run to gather this information? Will it allow me to filter out the legitimate Barracuda IP address so that I only see eamils coming from the untrusted Internet?
Both GUI and PowerShell tools for this job would be viable options for me.
Thank you in advance.