Office 365 Configuration Service

The Office 365 Configuration Service configures Exchange Online mail flow for mxHERO from the Admin Dashboard. It creates the connectors and mail flow rules for the architecture you choose, so you don't have to build them by hand. Use this page to run it, to see exactly what it changes in your tenant, and to finish the steps it does not do.

To make the same changes by hand instead, see Office 365 manual configuration.

Before you begin

• Choose your architecture: Inbound Loopback, Inbound Border, Outbound Standard or Outbound Loopback. See Routing architectures.
• You need a Microsoft 365 account with Exchange admin rights in the tenant. You sign in with it during setup.
• Your domains must be added in Settings › Organization and domains, each with its Server set to your tenant's MX host (for example example-com.mail.protection.outlook.com). See Domain Server and Relay settings.
• Settings › Gateway must show an Allowed transport agent value. If it is empty, click the refresh icon ("Generate new transport agent") first. The service writes this value into the mail flow rules.
• Plan a pilot. The service creates rules for the whole tenant, with no group condition. To start with a group, use the default Save as disabled option and add a group condition before you turn the rules on. See Selective routing.

Run the setup

1. In the Admin Dashboard, open Settings › Gateway.

2. In the Office 365 Connector section, click Add Connector. If the setup ran before, the button is Configure again .

   

3. In the dialog, select the flows to configure:

   • Inbound : sends inbound mail through mxHERO. Also select Loopback under it for Inbound Loopback. Leave Loopback clear for Inbound Border (your MX record or border gateway sends mail to mxHERO).
   • Outbound : sends outbound mail through mxHERO. Select Loopback under it for Outbound Loopback.

   You must select at least one of Inbound or Outbound.

4. Leave Save as disabled selected (the default). The mail flow rules are then created turned off, so no mail is rerouted until you turn them on.

5. Click the button to continue. A Microsoft sign-in window opens.

6. Sign in with your Exchange admin account and accept the permissions requested (Exchange.Manage, User.Read).

7. Wait while the dashboard shows each step and its result. It usually takes a few minutes.

When it finishes, the section shows the status (Enabled or Disabled), the flows configured and the date of the last configuration.

What the service creates

The service connects to Exchange Online with PowerShell and creates the objects below. If an object with the same name already exists, the service skips it and does not change it.

For Inbound without Loopback (Inbound Border), the service creates only steps 1–4. For Outbound with Loopback, it also checks that mxHERO Tenant Connector exists, because mxHERO returns processed mail to your tenant through it.

The 8 mxHERO IP addresses are 54.208.111.28, 54.236.184.32, 54.165.252.128, 54.165.253.193, 3.211.77.148, 52.22.51.97, 54.209.222.83 and 107.23.152.206.

Important: Connectors are always created enabled. Only the two mail flow rules follow Save as disabled. Because the outbound connectors are used only when a rule routes mail to them, enabled connectors with disabled rules do not change mail flow.

What the service does not do

Finish these steps yourself:

Turn on the mail flow rules

1. Create a test rule in mxHERO for a test user, for example a Copy Emails rule. See Testing mail flow.
2. In the Exchange admin center, go to Mail flow › Rules.
3. Optional: open mxHERO - Route Inbound and mxHERO - Route Outbound and add a group condition for your pilot users.
4. Select mxHERO - Route Inbound, and turn it on.
5. Select mxHERO - Route Outbound, and turn it on.

Or in Exchange Online PowerShell:

Enable-TransportRule -Identity "mxHERO - Route Inbound"
Enable-TransportRule -Identity "mxHERO - Route Outbound"

Changes to mail flow rules can take up to an hour to apply across Exchange Online.

Verify

1. In the Exchange admin center, check Mail flow › Connectors for mxHERO Tenant Connector and, depending on your flows, mxHERO Inbound Route and mxHERO Outbound Route.

2. Check Mail flow › Rules for the rules and their status.

3. Confirm the values in Exchange Online PowerShell:

   Get-InboundConnector "mxHERO Tenant Connector" | Format-List Name,ConnectorType,SenderIPAddresses,RequireTls,Enabled
   Get-OutboundConnector | Where-Object Name -like "mxHERO*" | Format-List Name,SmartHosts,IsTransportRuleScoped,TlsSettings,Enabled
   Get-TransportRule | Where-Object Name -like "mxHERO*" | Format-List Name,State,SetHeaderName,SetHeaderValue,ExceptIfHeaderMatchesMessageHeader,ExceptIfHeaderMatchesPatterns
   Get-ArcConfig | Format-List ArcTrustedSealers
   Get-RemoteDomain Default | Format-List TNEFEnabled

   SetHeaderValue and ExceptIfHeaderMatchesPatterns must both equal the Allowed transport agent value in Settings › Gateway.

4. Send test messages and check them in Reports › Email Flow Logs. See Testing mail flow.

Change or re-run the configuration

Configure again skips every object that already exists. It does not update existing rules or connectors, does not change a rule's on/off state, and does not remove objects for flows you clear.

• To add a flow (for example, add Outbound later): run Configure again with the new flow selected. Only the missing objects are created.

• To change an existing object: edit it in the Exchange admin center or with PowerShell, using the values on Office 365 manual configuration. Or delete it and run Configure again.

• After you generate a new Transport Agent value: update both rules by hand. Change the header value and the exception pattern to the new value, test, then remove the previous value in Settings › Gateway. Until you do, mxHERO accepts both values.

  $ta = "<new Transport Agent value>"
  Set-TransportRule -Identity "mxHERO - Route Inbound"  -SetHeaderValue $ta -ExceptIfHeaderMatchesPatterns $ta
  Set-TransportRule -Identity "mxHERO - Route Outbound" -SetHeaderValue $ta -ExceptIfHeaderMatchesPatterns $ta

The service runs one operation at a time per organization. The configuration covers the whole tenant: one inbound connector for all sender domains, rules with no domain condition, and one Transport Agent value for your mxHERO organization, however many domains you have.

Troubleshooting

Related pages

• Routing architectures
• Office 365 manual configuration
• Gateway settings
• Selective routing
• Removing mxHERO from mail flow