The colleague's guidance is correct and represents the standard administrative best practice. The most direct and efficient method to prevent external senders from emailing a distribution group is to configure the delivery management settings on the distribution group object itself within the Exchange admin center. This setting allows an administrator to explicitly permit messages only from senders within the organization, causing the Exchange transport service to reject messages from any external email address. This centralizes the control on the intended target (the group) rather than attempting to manage it through complex and inefficient rules on individual member mailboxes.

The alternative, False, is incorrect. Attempting to manage this restriction at the individual mailbox level is not scalable, is prone to error, and is not the intended design for controlling group message delivery. The control exists specifically on the distribution group object for this purpose.

1. Microsoft Learn. "Manage distribution groups in Exchange Online." Microsoft Docs. Accessed May 2024. In the section on editing group properties

the "Delivery management" settings are described

which include the option to "Choose whether people inside or outside your organization can send email to this distribution group."

2. Microsoft Learn. "Allow only messages from people in my organization." Exchange Online PowerShell documentation. Accessed May 2024. The documentation for the Set-DistributionGroup cmdlet shows the -RequireSenderAuthenticationEnabled $true parameter

which programmatically enforces that only authenticated (internal) users can send to the group. This corresponds to the setting in the Exchange admin center.