Setting up Google Mail + MS Teams + Email connector

Hi @Kael Yao-MSFT

we can setup whatever address we like, but the clients should not be confused with different email addresses in Email and Teams, we'd like to have a single email address for each employee. What is the best practice here? I doubt we're the only ones using Teams and not having email in Microsoft.

What does the "complicated solution" include? I did have an impression that if I add email forwarding on user level, it would work. But i didn't check the reputation of those forwarded emails regarding DKIM and DMARC.

Is there some reason I can't simply tell Microsoft to respect MX records and deliver emails where it is supposed to? The concept with connectors makes sense to me, but then I don't understand why it doesn't work in my tests as emails don't seem to reach the connector if user has a mailbox.

but the clients should not be confused with different email addresses in Email and Teams

Indeed, that is exactly what is painful in this situation...

To me there is no real best practice available without Exchange as Teams heavily integrate with Exchange.

Without the Exchange mailbox many Teams feature like calendar won't be available.

One possible method I could think of is to remove the email address from the mailbox and only have the onmicrosoft.com email address left as primary email address, while it may need further test to check if there will be issues.

Is there some reason I can't simply tell Microsoft to respect MX records and deliver emails where it is supposed to?

In this scenario, from Exchange side it directly recognizes the mailbox as an active internal mailbox, thus it won't try to deliver the message elsewhere.

But my current setup does seem to work.
So I have 2 domains on Google ( .com and .at, with .com being the primary one and .at being the alias for the primary one), and I also have the same ones on Office 365. But after assigning Office 365/Teams/Exchange licenses I need to set up email forwarding for EACH account and set the forwarding to .at email address. So in my opinion this does "fool" Exchange and Exchange does forward the email to the primary domain hosted on Google (as there are no emails with .at on Microsoft). So it does currently seem to work, but I'm not sure the forwarding part is really sturdy enough. I've setup SPF with outlook entry so I hope it doesn't turn out there is something I missed in my tests. Would you have any concern with my setup.

I'm still puzzled with how other companies deal with this. Do they have different domains for Teams and Email? Or they do what I do?

So in my opinion this does "fool" Exchange and Exchange does forward the email to the primary domain hosted on Google (as there are no emails with .at on Microsoft).

Yes forwarding will work if the email addresses are not exactly the same (in this case the email domains are different).

Since SPF will fail once you forward the message to another domain, you may probably need DKIM and DMARC to bypass anti-spam filters, or you can also add the Office 365 ip addresses to SPF records of the .at domain (which may take more efforts).

I'm still puzzled with how other companies deal with this. Do they have different domains for Teams and Email? Or they do what I do?

It may depend on your company's needs.

If using different domains is possible, to me it might be the solution that causes the least trouble.

There are also some posts in the same situation for your reference:

Using Teams without Exchange Online? Just for Video Conferencing

Switching from Google Meet to Teams - any tips for a seamless switch?

(Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.)

Yes forwarding will work if the email addresses are not exactly the same (in this case the email domains are different). Since SPF will fail once you forward the message to another domain, you may probably need DKIM and DMARC to bypass anti-spam filters, or you can also add the Office 365 ip addresses to SPF records of the .at domain (which may take more efforts).

To the outside world, both (Microsoft Teams and Google Email) have the same email address displayed, and that's what counts for me. Yes, I use a different address (domain) for forwarding purposes, but besides potential reliability issues, I currently don't see any problems with that.

I don't even see why SPF would fail, because I have outlook in SPF records for both domains (just in case), so Exchange forwarding/sending emails for my domain is a SPF approved operation. At least that's what I thought, but after reading your comment I checked the DMARC report, and it does seem like this setup breaks SPF and the emails are listed under "forwarders" (need to check how that works out for my reject DMARC policy). My test case was sending emails from outlook.com to the .com address, and they do show in my gmail inbox. But I need to do more testing with different users and trace the emails.
Would adding Office 365 IPs instead of include:spf.protection.outlook.com ? Besides, I've already reached the limit of SPF records.
Bypassing antispam filters with DKIM and DMARC... I'm not familiar with it. Does it involve setup on Microsoft or Gmail side? (I guess Gmail since it's on the receiving end)

I've just checked the headers of the received email (sent from outlook to .com domain), I don't see anything problematic with it (no fails, only pass)

ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass header.i=@xxxxxxx.onmicrosoft.com header.s=selector2-xxxxxxx-onmicrosoft-com header.b=duY2WU7l;
       arc=pass (i=1 spf=pass spfdomain=xxxxxxx.com dkim=pass dkdomain=xxxxxxx.com dmarc=pass fromdomain=xxxxxxx.com);
       spf=pass (google.com: domain of johndoe@xxxxxxx.com designates 104.47.17.105 as permitted sender) smtp.mailfrom=johndoe@xxxxxxx.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=xxxxxxx.com
Return-Path: <johndoe@xxxxxxx.com>
Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05lp2105.outbound.protection.outlook.com. [104.47.17.105])
        by mx.google.com with ESMTPS id m19-20020a1709060d9300b00a185db0fa80si6368932eji.911.2023.12.05.23.16.20
        for <johndoe@xxxxxxx.at>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 05 Dec 2023 23:16:21 -0800 (PST)
Received-SPF: pass (google.com: domain of johndoe@xxxxxxx.com designates 104.47.17.105 as permitted sender) client-ip=104.47.17.105;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@xxxxxxx.onmicrosoft.com header.s=selector2-xxxxxxx-onmicrosoft-com header.b=duY2WU7l;
       arc=pass (i=1 spf=pass spfdomain=xxxxxxx.com dkim=pass dkdomain=xxxxxxx.com dmarc=pass fromdomain=xxxxxxx.com);
       spf=pass (google.com: domain of johndoe@xxxxxxx.com designates 104.47.17.105 as permitted sender) smtp.mailfrom=johndoe@xxxxxxx.com;