Exchange Online for Microsoft 365
Mail server variant for Microsoft 365. Can be deployed automatically via the Setup Assistant or manually in the Exchange Admin Center.
Prerequisite: Step 1, Domain & DNS Setup is complete and all four DNS checks are green.
What happens here: Two connectors and two transport rules in Microsoft 365 are set up so that outbound emails flow through Conbool and inbound ones are accepted from Conbool.
Effort: 5 minutes automatic, 30 minutes manual.
Recommended: Automatic via Setup Assistant
In the Setup Assistant under Home → Setup, select the Automatic via Exchange Online mode in the Mail Server step. Conbool connects to the Microsoft 365 tenant via Microsoft Entra Admin Consent and creates connectors and transport rules automatically.
Wizard flow:
- Click Connect to Microsoft 365.
- Sign in via the Microsoft login with an account that has Exchange admin rights.
- Choose the rollout scope, see next section.
- Click Start Deployment. The wizard reports success once the connectors and rules have been created in the tenant.
If this works, the connection is done. Continue with the connection test and completion.
Routing Rule Scope
During automatic deployment, the scope of the Conbool Exchange transport rule is set. The three modes differ in which senders the rule applies to:
| Mode | Condition in the rule |
|---|---|
| All senders | -FromScope InOrganization, all internal mailboxes |
| Selected senders | -From <list>, only the manually entered email addresses |
| Group | -FromMemberOf <group address>, all members of a Microsoft 365 group or distribution list |
Which mode fits depends on the setup — for example whether only a subset of mailboxes uses Conbool, whether a migration runs in phases, or whether compliance handles individual departments separately. On re-deployment the scope is adjusted without touching DNS or MX.
Alternative: Manual in the Exchange Admin Center
If automatic setup is not possible (e.g. limited admin role), connectors and rules are created manually in the Exchange Admin Center.
Step A. Outbound Connector
Navigation: Microsoft 365 Admin Center → Exchange Admin Center → Mail flow → Connectors → + Add a connector
| Field | Value |
|---|---|
| Connection from | Office 365 |
| Connection to | Partner organization |
| Name | Conbool Outbound Connector |
| Connector type | OnPremises |
| Smart Hosts | mail.conbool.com |
| TLS settings | DomainValidation, TLS domain mail.conbool.com |
| Use MX Record | No |
| Is Transport Rule Scoped | Yes |
| Enabled | Yes |
Step B. Inbound Connector
Navigation: Exchange Admin Center → Mail flow → Connectors → + Add a connector
| Field | Value |
|---|---|
| Connection from | Partner organization |
| Connection to | Office 365 |
| Name | Conbool Inbound Connector |
| Connector type | OnPremises |
| Sender Domains | * for all domains |
| Require TLS | Yes |
| TLS Sender Certificate Name | mail.conbool.com |
| Restrict Domains to Certificate | Yes |
| Enabled | Yes |
Step C. Transport Rule "Relay to Conbool"
Navigation: Exchange Admin Center → Mail flow → Rules → + Add a rule → Create a new rule
This rule routes outbound emails through Conbool and prevents loops.
- Name: Conbool Exchange transport rule
- Sender address location: Header or envelope
- Apply this rule if: The sender is located → Inside the organization
- Do the following: Route the message to the following connector → Conbool Outbound Connector
- Except if (add all four exceptions):
- A message header matches → Header:
X-Conbool-<YourDomain>(e.g.X-Conbool-example-com) → Pattern:true - The message type is → Calendaring
- A message header contains → Header:
Return-Path→ Words:<> - The sender address matches → Pattern:
<>
- A message header matches → Header:
- Priority:
0 - Mode: Enforce
- Save and enable.
Step D. Transport Rule "Classify Spam"
Navigation: Exchange Admin Center → Mail flow → Rules → + Add a rule → Create a new rule
This rule automatically sorts emails marked as spam by Conbool into the Spam folder.
- Name: Conbool Spam classification rule
- Apply this rule if: A message header matches → Header
X-Conbool-Flag→ PatternYES - Do the following: Modify the message properties → Set the spam confidence level (SCL) →
7 - Priority:
1 - Mode: Enforce
- Save and enable.
Step E. Release Bypass Rule
Ensures that mail released from the Conbool quarantine is delivered directly, without being marked as spam again or routed through Conbool a second time. On release, Conbool sets the header X-Conbool-Released: yes; this rule detects the header and skips both spam classification and any further transport rules.
In auto mode the rule is created automatically. In manual mode it must be created by hand, otherwise released messages may end up in quarantine or the spam folder again.
Navigation: Exchange Admin Center → Mail flow → Rules → + Add a rule → Create a new rule
- Name: Conbool Quarantine Release Bypass
- Apply this rule if (all three conditions, combined with AND):
- A message header matches → Header:
X-Conbool-Released→ Pattern:yes - The sender is located → Outside the organization
- The recipient is located → Inside the organization
- A message header matches → Header:
- Do the following:
- Modify the message properties → Set the spam confidence level (SCL) →
-1 - Stop processing more rules
- Modify the message properties → Set the spam confidence level (SCL) →
- Priority:
2 - Mode: Enforce
- Save and enable.
Why SCL −1 + stop processing: SCL −1 marks the mail as trusted (not spam). Stop processing prevents the routing rule from Step C from sending the mail through Conbool again — which would be a loop for released quarantine mails.
Done When
Back in the Setup Assistant at the Mail Server step. Enter the relay host of the Microsoft 365 tenant, typically yourcompany-com.mail.protection.outlook.com, then click Test Connection. Status "SMTP reachable" means the connection is established.
Continue with the connection test and completion.