Is this necessary if exchange is not accessible to the internet? No EWS or OWA? MDM for access to mobile email? Proof point or something like it as your email edge to the internet?

Certainly eliminates Exchange as the initial breach, but it will be a juicy target after they get in with stolen VPN credentials

This is so polarizing. What’s the reasoning? We are half in/half out already and stuck on moving forward with 365 or going back to on-prem

Recent experience is teaching me that it’s impossible to securely run Exchange on prem. It’s been the initial point of entry for numerous compromises.

Getting past the FUD, what do you suggest orgs do? Are there any common IOCs people should look for?

The most common indicator we’re seeing is w3wp.exe spawning csc.exe. Look for webshells under …\Exchange Server\*\FrontEnd\HttpProxy\{owa,ecp}\*