MicrosoftMicrosoft
I'm far from an expert, but from what I can tell, using IIS IP restrictions to limit ECP to internal addresses has two strikes against it:
1. The ECP site is still available from the outside, but the authentication fails. It effectively blocks the ECP site from being seen from the outside, but it's sloppy.
2. External OWA users can't manage their settings (OOO, signatures, etc) because OWA uses ECP to manage those.
It seems to me like the method in this blog post would solve issue #1 by making the ECP completely unavailable from the outside, but issue #2 would still exist. And with this method you would have to re-deploy with each new CU/SP, and that seems just as sloppy
if not more than issue #1 above.
Am I thinking correctly here, or am I missing something? (probably the latter. =)
