Companies that manage email signatures centrally on their own Exchange often run the same locally installed software they bought years ago. For one of the most common of those products that time is up: Exclaimer discontinued Signature Manager Exchange Edition, and support ended on 30 September 2024. There have been no bug fixes and no support since, and the vendor points to its cloud service instead.
What this means in operations
An installed version does not stop working. The problem is not the day after, it is the next change to the environment.
Signatures of this kind hang on a transport agent inside Exchange. A cumulative Exchange update, a move to a newer Windows Server, a change in the transport chain: each of those raises the question whether the agent still holds, and there is nobody left to ask. On top of that comes ordinary daily life: a template that renders differently in new Outlook, an image a recipient does not load, a certificate that needs renewing.
That is precisely why end of support is a date for planning, not for emergencies.
The three routes
Into the vendor's cloud. The route the vendor intends. Messages leave the building: they are routed through the provider's data centres by a transport agent or a connector and the signature is added there. People data comes from Entra ID, and a local Active Directory is synchronised into it through Azure AD Connect. Anyone already running both has the shortest path. Anyone deliberately keeping their directory away from the Microsoft cloud faces exactly the prerequisite they were trying to avoid.
Transport rules in Exchange. No additional software, and entirely sufficient for one uniform legal footer under every message. The limits appear as soon as the signature is supposed to be personal. A transport rule knows no directory attributes, it appends its text below quoted replies, and with images, several languages and exceptions the rule set becomes unwieldy fast. As a signature carrying name, job title, department and phone number per person it is no replacement.
A product that reads the local directory directly. The third route keeps people data where it is maintained.
Signatures from the local Active Directory
Conbool takes that third route. Outbound messages travel through the gateway, where the signature is created server side, identically for every device and without installing anything on a client. The on-premises Exchange keeps its MX record, only the outbound path is redirected through a send connector.
The fields for the signature come from the company directory. An agent runs on a member server of the domain, reads Active Directory and reports the people outbound to Conbool. The direction is the point: no inbound firewall rule, no published domain controller and no path from outside into the directory. No directory sync to the Microsoft cloud is needed, and no Entra ID either.
Reading uses ordinary read access. Incremental sync adds two rights at the domain head, DS-Replication-Get-Changes and DS-Replication-Get-Changes-In-Filtered-Set. The right that would allow password data to be read is explicitly not among them, and if the other two are missing as well, the agent keeps running without incremental sync.
The directory supplies display name, job title, department, phone, mobile, office and the postal address, along with the secondary addresses of a person. Changing a phone number in the directory changes the signature on every future message. Which attribute fills which field can be changed per field where a company maintains different attributes. The details are in the Active Directory documentation.
What to settle before replacing
Four points decide the effort involved.
First, the templates. Anyone maintaining several language versions, campaign banners and exceptions for internal mail should compile that list before the switch, not after.
Second, shared mailboxes. Without a rule that recognises them, info, accounting and team mailboxes take seats and receive personal signatures nobody wants.
Third, secondary addresses. Anyone sending under more than one address needs the aliases from the directory, otherwise the signature is missing on the second address.
Fourth, where processing happens. For companies that have to keep processing in house, Conbool is also available as an installation in their own data centre. The whole chain of directory, gateway and signature then stays under their own control.
Starting points
How the connection works in detail is in the directory documentation, and the vendor comparison is in the comparison with Exclaimer.
