We have ecp published externally and from what I understand it provides some end-user functionality. But this also makes EAC available externally, which I want to block. So I really can't go to the reverse proxy/firewall and not publish "/ecp" as this will impact users coming externally. Is there another way I can block EAC externally without impact

Hi,

For your description, we can turn external access off by setting the AdminEnabled parameter of the ECP virtual directory to false. For example: Set-ECPVirtualDirectory -Identity "CAS01\ecp (default web site)" -AdminEnabled $false

Doing this way, we can control whether users are allowed to have Internet access to the EAC from outside of your organization, while still allowing an end user to access Outlook Web App Options. More details about it, please refer to: https://technet.microsoft.com/en-us/library/jj218639(v=exchg.150).aspx

Thanks

Thank you, that was what I was looking for.