Configuring Exchange Online connectors

When you register a tenant and the provisioning of our services is completed, you are asked to do a few additional steps to finish your tenant's configuration (Fig. 1.). This includes creating Exchange Online connectors. You can add and configure them later, either automatically or manually, but keep in mind that email signatures will not be added until connectors are properly set. Creating outbound and inbound Exchange Online connectors for your tenant is required so that emails sent from your organization can be forwarded to the CodeTwo Email Azure Service. Additionally, an Exchange Online transport rule needs to be configured for the outbound connector, to specify senders whose messages will be processed by the service. The CodeTwo Email Azure Service checks these messages against the signature rules you created and stamps them with signatures.

ESIG for O365 New tenant - next steps
Fig. 1. Additional steps required to finish the configuration of a tenant.

The program allows you to configure Exchange Online connectors automatically or manually. Use the links below to learn more.

Info

If you want to remove the existing connectors, see this article on uninstalling CodeTwo Email Signatures for Office 365.

Automatic configuration of Exchange Online connectors

If you decided to configure connectors right away, select the first radio button (Automatically manage my connectors) and click the Configure connectors button displayed on the Next steps page (see Fig. 1.).

Tip

If you skip the connectors configuration at this moment, you can get back to it anytime from the Manage tenant pages in the CodeTwo Admin Panel. To access these pages, enter the Dashboard or Tenants tab and use the Manage tenant (ESIG for O365 settings button2 13px) button next to the name of your tenant. Choose Exchange Online connectors from the left menu, select the first radio button (Automatically manage my connectors) and click Configure connectors (Fig. 2.).

ESIG for O365 Manage tenant - Connectors
Fig. 2. The Exchange Online connectors section.

In either case, a connectors configuration wizard will start (Fig. 3.). Depending on your choices, the wizard will automatically configure Exchange Online connectors and transport rule.

ESIG for O365 Connectors wizard 1
Fig. 3. Connectors configuration wizard - step 1.

Click Next to start the configuration and the wizard will ask you to provide your Office 365 global admin credentials (step 2. Login - not shown here). This is because the initial authorization via Azure's OAuth 2.0 does not allow any third-party apps to access the connectors configuration in Office 365 tenants.

Info

Your credentials are not stored with any CodeTwo service. If necessary, you can skip the connectors configuration via the wizard and set them up manually in your Office 365. However, we strongly advise against manual configuration of connectors.

In the next step (3. Senders scope, see Fig. 4.) you can specify senders whose emails will be routed through the CodeTwo Email Azure Service to receive signatures. By default, the program asks you to limit the scope to a particular distribution group (Fig. 4.), but you can also select all AD users.

Important

Every sender selected in this step will use one license from your license pool, no matter if the sender is defined in any signature rule. That is why you should pay special attention to properly define the scope of senders.

An option to limit connectors scope.
Fig. 4. Configuring the scope of senders.

In this step you also need to decide if you want to apply signatures to emails sent within your organization - see the checkbox at the bottom of Fig. 4.

Tip

A good idea is to prepare a separate distribution group for all users that may require email signatures. Such solution will let you avoid excessive usage of licenses.

If you wish to further customize the range of users whose emails will be stamped with signatures, you can do that by creating signature rules (see our Quick Guide and articles in the signature management section).

In the last step of the wizard (Fig. 5.), click Configure to auto-configure your Office 365 connectors. You will see the progress in the trace log window.

The last step of connectors configuration.
Fig. 5. The last step of connectors configuration.

Once this step is complete (Fig. 6.), click Finish.

Important

Note that it can take from a few minutes to more than an hour for the changes in the connector configuration to propagate. Email signatures created in the program might not be added to messages sent from your tenant during that time.

If you configured the program to process messages sent to a distribution group/list, every change made to this group (e.g. adding new users) also requires time to propagate in your Office 365. Learn more

Connectors configuration finished.
Fig. 6. Successful configuration of connectors.

Info

If you cannot or do not want to use the wizard, see the section on manual configuration of connectors and transport rule.

You can now install and launch the Manage Signatures App to start managing your signature rules. Read this article for details.

Manual configuration of Exchange Online connectors

You can also configure Exchange Online connectors manually in the Exchange admin center of your Office 365. Manual setup might be useful if you have any problems with the connectors' configuration wizard (e.g. when you have MFA enabled), if you need non-standard (not available in the wizard) settings, or if you simply prefer to create connectors yourself.

Warning

CodeTwo strongly recommends that you use the configuration wizard instead of manually setting up connectors, to avoid mistakes and unsupported customizations.

To configure the connectors manually, follow the steps below.

  1. Access the mail flow configuration pages in Exchange admin center.
  2. Configure the inbound connector for CodeTwo Email Signatures for Office 365.
  3. Configure the outbound connector for the program.
  4. Configure the transport rule for the outbound connector.

Opening mail flow configuration in Exchange admin center

To manually add your connectors, start with logging in to your Office 365 tenant as administrator. On the Home screen (Fig. 7.) select Admin to enter your Office 365 admin center.

Office 365 home screen
Fig. 7. Accessing Office 365 admin center.

Enter your Office 365 Exchange admin center using the navigation menu on the left side (Fig. 8.).

Accessing Exchange admin center from Office 365 Admin center.
Fig. 8. Opening Exchange admin center.

Select mail flow from the menu (Fig. 9.).

Accessing mail flow configuration pages from Exchange admin center.
Fig. 9. Accessing mail flow configuration pages in Exchange admin center.

Now you have to configure the mail flow configuration pages. The whole procedure is described in details in the sections below. In a nutshell, you will need to add two connectors (Fig. 10.) and a transport rule:

ESIG for O365 Connectors Exchange admin center
Fig. 10. CodeTwo connectors in Exchange admin center.

Configuration of the inbound connector

First, create an inbound connector on the connectors tab (see Fig. 10.). Click the plus (+) button to create a new connector. On the pop-up page (Fig. 11.), select From: Your organization's email server, To: Office 365.

Inbound connector configuration.
Fig. 11. Inbound connector configuration.

On the next page (Fig. 12.), enter the following name: CodeTwo Inbound Connector 2.0 and make sure that the Turn it on and Retain internal Exchange email headers (recommended) checkboxes are both enabled (selected).

ESIG for O365 Inbound Connector 2.0
Fig. 12. Inbound connector configuration.

On the last page (Fig. 13.), select the first radio button and provide the domain name as follows:

[your unique subdomain name].smtp.codetwo.online

Info

In order to get [your unique subdomain name], go to User Panel, access the Exchange Online connectors page in the Manage tenant section of your tenant, and use the link displayed in the I manage my connectors manually section.

Inbound connector configuration.
Fig. 13. Inbound connector configuration.

Click Next and then Save to finish the configuration.

Configuration of the outbound connector

Next, create an outbound connector via the plus (+) button (see Fig. 10.). On the pop-up page (Fig. 14.), select From: Office 365, To: Your organization's email server.

Outbound connector configuration.
Fig. 14. Outbound connector configuration.

On the next page, enter the following name: CodeTwo Outbound Connector and make sure that the Turn it on and Retain internal Exchange email headers (recommended) checkboxes are both enabled (selected), as shown in Fig. 15.

Outbound connector configuration.
Fig. 15. Outbound connector configuration.

In the next step (Fig. 16.), choose the first option (Only when I have a transport rule set up...).

Outbound connector configuration.
Fig. 16. Outbound connector configuration.

On the next page (Fig. 17.), add the following CodeTwo smarthost address:

[your unique subdomain name].smtp.codetwo.online

Info

In order to get [your unique subdomain name], go to User Panel, access the Exchange Online connectors page in the Manage tenant section of your tenant, and use the link displayed in the I manage my connectors manually section.

ESIG for O365 manual outbound connector 4
Fig. 17. Outbound connector configuration.

In the next step, configure the options as shown in Fig. 18. and make sure that you provide the address:

*.codetwo.com

as the domain name on the certificate. Proceed to the connector validation step by clicking Next.

Outbound connector configuration.
Fig. 18. Outbound connector configuration.

Finally, you have to validate the outbound connector (Fig. 19.) by typing any external (not hosted in Office 365) email address. Click Validate and - after successful validation - click Save to finish the configuration of the outbound connector.

ESIG for O365 outbound connector validation.
Fig. 19. Validation of the outbound connector.

Warning

If you are not able to validate your connectors and you get the following (or similar) error:

401 4.5.4 Invalid arguments - possible version mismatch [VE1EUR01FT009.eop-EUR01.prod.protection.outlook.com]

then you might be experiencing a recent Office 365 health issue. This problem is not related to our software.

Configuration of the transport rule

Once you're done with connectors, you need to create a new transport rule that will specify senders whose emails will be processed by the CodeTwo Email Azure Service.

Important

Every sender selected in this step will use one license from your license pool, no matter if the sender is defined in any signature rule. That is why you should pay special attention to properly define the scope of senders in the transport rule.

This configuration corresponds to the Senders scope step during the automatic configuration of connectors (learn more earlier in this article). You can specify the following scopes of senders:

Configuration of the transport rule for all AD users

To configure a transport rule for all AD users (including emails sent internally in your organization), switch to the rules tab (Fig. 20.). Use the plus (+) button to add a new rule with the Apply rights protection to messages... template.

Adding a transport rule for the program's outbound connector.
Fig. 20. Adding a transport rule for the program's outbound connector.

Configure the rule so that it looks exactly like the one shown in Fig. 21.

 


Fig. 21. Proper configuration of the transport rule.

The configuration is as follows:

  • Name: "CodeTwo Exchange transport rule"
  • Apply this rule if... The sender... is external/internal, Inside the organization
  • Do the following... Redirect the message to... the following connector, CodeTwo Outbound Connector
  • Except if... add exceptions:
    • The sender address... matches "<>",
    • The message type is... "Calendaring",
    • A message header... matches these text patterns, specify header name as "X-CodeTwoProcessed", Enter text pattern, specify words or phrases, add "true"

Leave other options with default settings, except for these fields:

  • Defer the message if rule processing doesn't complete - must be enabled (selected);
  • Match sender address in message - change to Header or envelope.

Review your settings - compare them with Fig. 21. and make sure they look the same.

Important

In the above configuration, emails of all of your users will be routed through the CodeTwo Email Azure Service to receive signatures. This might lead to excessive usage of licenses (learn more).

This transport rule is applied to both outgoing and internal messages. If you do not want to add signatures to emails sent between the users inside your tenant, you need to specify an additional condition, as described in this section.

Configuration of the transport rule for a selected distribution group

If you want to add a transport rule that limits your users to a particular distribution group/list, start with configuring a transport rule for all users, as described earlier in this article. If all the settings are exactly as in Fig. 21., add another condition in the Apply this rule if... field: you can select individual senders (The sender... is this person) or groups (The sender... is a member of this group) from the menu. An example of changing the scope of senders to a distribution group (Engineering) is shown in Fig. 22.


Fig. 22. Limiting the scope of senders.

The above transport rule will be applied to both outgoing and internal messages sent by the users you specified. If you do not want to add signatures to emails sent between the users inside your tenant, you need to configure another condition, as described in the next section.

Configuration of the transport rule to exclude internal emails

If you would like to stop adding signatures to your internal correspondence, you need to modify your transport rule by adding an extra condition in the Apply this rule if... field. Click add condition, select The recipient... is external/internal and choose Outside the organization. The condition should appear as shown in Fig. 23

Additional condition to exclude internal correspondence.
Fig. 23. Additional condition to exclude internal correspondence.

See next

Installing and launching the signature management application

Was this information useful?