This is the Microsoft 365 side setup referenced in How ExSign for M365 Works. Without it, ExSign never sees any outgoing mail, no matter how correctly everything on the ExSign side is configured. 

Before You Begin

• You'll need Microsoft 365 Global Administrator credentials to complete any of this. 
• Create a mail-enabled security group (or security-enabled distribution list) in Microsoft 365 first, containing only the email addresses that should receive ExSign stamping. This has to exist before you create Rule 2 below; it's a prerequisite, not something you set up as part of the rule itself.  
• Know where your Microsoft 365 Agent is installed: you'll need both the server address (for the Smart Host setting) and its IP address (for the return connector).  
• Do this in order: connectors first, then rules, Rule 2 references a connector by name, so it needs to exist already. 

Create the Connector from Microsoft 365 to the Agent 

1. Sign in to the Exchange Online Admin Portal ( https://admin.exchange.microsoft.com) as an administrator.  
2. Navigate to Mail Flow >> Connectors, then Add a New Connector.  
3. Set the mail flow direction so mail flows outward from Microsoft 365 toward your own mail server.  
4. Name it "From O365 to ExSign Agent."  
5. Configure it to be used when a Transport Rule redirects emails; this matters, since Rule 2 (below) is exactly that transport rule.  
6. Set the Smart Host to the on-premises server where the Microsoft 365 Agent is installed. 
7. Choose your security options, including whether to require a secure channel for this connection. 
8. Validate using a real, active mailbox address on your mail server.  

Create the Connector from the Agent Back to Microsoft 365 

1. Navigate to Mail Flow >> Connectors, then Add a New Connector.  
2. Set the mail flow direction from your organization's email server to Microsoft 365.  
3. Name it "From ExSign Agent to O365."  
4. Provide the IP address of the machine running the Microsoft 365 Agent.  
5. Review and click Create Connector. 

Create the Rule to Exclude Out-of-Office Replies 

1. Navigate to Mail Flow >> Rules, then Create a New Rule.  
2. Name it Prevent Out of Office Messages from Being Sent to ExSign Agent.
3. Under Apply this rule if, select Message Properties >> Automatic Reply.  
4. Under Do the following, select Modify the message properties, and set a header named x-exsignproceed with the value true.  
5. In the rule's settings, set its priority to High.  
6. Save and apply. 

Create the Rule to Route Eligible Messages to the Agent 

1. Navigate to Mail Flow >> Rules, then Create a New Rule. 
2. Name it Identify Messages to Send to ExSign Agent.
3. Under Apply this rule if, set all of:  
   • The sender is internal/external 
   • The sender is located InOrganization 
   • The sender is a member of your mail-enabled security group 
4. Under Do the following, select Redirect the message to the following connector, and specify the connector “From O365 to ExSign Agent”. 
5. Under Exceptions, add all four of the following: each one prevents a specific, legitimate category of mail from being incorrectly caught by this rule: 
   
   

   Exception	Why It's Needed
   Message type is Calendaring.	Meeting invites and updates can break if modified, this keeps calendar mail flowing untouched.
   Header X-MS-Exchange-UnifiedGroup-SubmittedViaGroupAddress includes /o=ExchangeLabs/ou=Exchange Administrative Group	Excludes mail sent via Microsoft 365 Groups, so group mail flow isn't disrupted.
   Header x-exsignprocessed matches HC or True	Prevents messages ExSign has already stamped from being processed and stamped a second time.
   Sender address matches <> (a null sender)	Excludes system-generated messages, bounces, NDRs, other automatic replies, that use a null sender and often lack proper authentication headers; routing these through ExSign can cause delivery delays or rejections.

   
   
6. Set this rule's priority lower than Rule 1's, so Rule 1 is evaluated first. 
7. Save and apply.