Exchange admin center (ECP) is by default accessible from the internet. In the wake of recent Exchange breaches (and also as a good security practice) it would be wise to shut off access to the ECP from the internet.

Before just doing this, do your research and make sure this is acceptable for your environment.