Accounts and Directory Overview

mxHERO keeps a list of your organization's email accounts and groups in Settings › Accounts and Groups. Rules use this list to decide whose mail to process, where to save it, and who can approve or release held mail. This page explains what accounts and groups are, how they get into mxHERO, and why it matters whether an address is "managed".

Accounts, groups and tags

• Email account: one email address in your organization, usually one person's mailbox. An account can have aliases, tags, approval groups and storage accounts assigned to it. Accounts are not dashboard users; dashboard users are in Settings › Users.
• Group account: a set of email accounts, such as a department. Groups can contain other groups. Groups come from a directory source; you can't create them by hand.
• Tag: a label you add to accounts in mxHERO, for example finance-team. Tags are kept only in mxHERO and are never synchronized from your directory. Use them to target accounts that don't share a group.

The page has two tabs, Email accounts (with a count) and Group accounts, and a Directory Sources panel on the right. S/MIME certificates for accounts are not managed here; see Settings › S/MIME Certificates.

How accounts get into mxHERO

Use directory sync where you can. It keeps accounts, aliases and group membership current, and it removes accounts that leave the directory.

What a directory sync does

• Accounts: imports each user's primary address and aliases. Aliases outside your organization's domains are dropped. Accounts that came from a source and no longer exist there are deleted at the next sync.
• Groups: imports groups and their members. See Groups.
• Domains: Office 365 and Google Workspace sources also add your directory's domains to Settings › Organization and domains. A domain that already belongs to another mxHERO organization is skipped with a warning.
• Tags are not touched. Tags you add in mxHERO stay on the account.

A source runs once a day. Turn on Schedule Daily Synchronization to pick the hour and time zone. Without a schedule, each run starts 24 hours after the previous one.

Each directory type has its own page:

• Office 365 directory and mailbox access
• Google Workspace directory and mailbox access
• LDAP: see Connect an LDAP directory below.

Managed and unmanaged addresses

An address is managed when it is an email account, or an alias of one, in Accounts and Groups. Any other address, including your own employees who are missing from the list, is unmanaged. This affects rules:

• Process only managed accounts (a rule filter) processes a message only when its sender or a recipient is a managed account.
• Short codes in the subject, such as #nomxhero, work only for managed senders.
• Group and Tag in a rule's sender or recipient match only managed accounts.
• Mailbox rules (User Mailboxes target) can process only accounts in this list, selected by organization, domain, account, group or tag.
• When a rule picks the storage account automatically, it uses the managed sender's storage account, or else the managed recipient's. If neither side is managed, the rule fails with no_storage_account.
• The End User App, Temporary Hold and Request Approval use accounts and groups to decide who sees and approves held mail. The Approval groups field on an account lets every member of that group approve the account's held mail.

Important: Keep the list complete before you rely on these options. An employee missing from the list is treated as external.

Connect an LDAP directory

Use LDAP for a directory that is not Microsoft 365 or Google Workspace, such as on-premises Active Directory.

Before you begin

• The directory server must be reachable from the internet on its LDAP port (389 by default, or the port you use for LDAPS).
• You need a directory account that can read users and groups, and the search base (for example dc=example,dc=com).

Steps

1. Open Settings › Accounts and Groups.

2. In Directory Sources, click Add Source › LDAP.

3. Fill in the connection:

   • Label: a name for this source.
   • Server Host Address and Server Port Number (default 389).
   • Use SSL to connect with Directory Server: turn on for LDAPS, and set the port your server uses for it.
   • Admin User Name and Admin User Password: the reading account, usually as a distinguished name.

4. Review the filters. The defaults work for most Active Directory and OpenLDAP servers:

   • Users filter: (&(|(objectclass=user)(objectclass=person)(objectclass=inetOrgPerson) (objectclass=organizationalPerson))(!(objectclass=computer))(|(mail=*)(userPrincipalName=*)))
   • Groups filter: (|(objectclass=group)(objectclass=groupofnames)(objectclass=groupofuniquenames))
   • Base filter: the search base.
   • Additional mail attributes: attributes read as aliases. Defaults: mailAlternateAddress, zimbraMailAlias, proxyAddresses.

   

5. Optional: turn on Schedule Daily Synchronization and set the hour and Timezone (default (GMT+00:00) UTC).

   

6. Click Save.

Verify

1. In Directory Sources, check that the source shows a last synchronization time and no errors.

2. On the Email accounts tab, search for a few known addresses. Expand a row to check its aliases.

3. On the Group accounts tab, check that your groups are listed.

The first sync of a large directory can take some time.

Troubleshooting

Related pages

• Managing accounts
• Groups
• IMAP and individual mailboxes
• Senders and recipients
• Filters and exclusions
• Notification error codes