Onboarding Exclaimer for Server-Side (Microsoft 365)

To configure Server-Side signatures:

1. Select Connect. Sign in to Microsoft 365 as a Global Administrator.
    

2. In the Permissions requested window, select Accept. This allows Exclaimer to read your Entra ID (formerly Azure AD) data to sync your users with Exclaimer. 
   
   
   _{Permissions request for Exclaimer to read Azure AD data.}

   NOTE: For a detailed list of all applications used by Exclaimer, see Exclaimer Microsoft 365 application permissions. 
3. Select which members of your organization you wish to synchronize with Exclaimer: 
   
   EITHER:
   
   Select Full (Recommended) to synchronize the contact details of all members of your organization with Exclaimer.
   
   OR
   
   Select Limited to synchronize a mail-enabled security group from your existing mail-enabled security groups.
   
   
   _{Select which members of your organization you wish to synchronize with Exclaimer.}
    
4. Select Continue.
    

5. Select which users to configure the mail routing for:

   EITHER: 
   
   Select All users (Recommended) to configure the mail flow rule in Exchange Online with the condition "Sender is inside the organization".

   OR

   Select Group to configure the mail flow rule in Exchange Online with the condition "Sender is inside the organization" and "Sender is a member of the group".
   
   In the text box, enter a mail-enabled security group. The drop-down provides suggestions as you type - select the group from the suggestions to add it. You must select a group from this list for it to be recognised. 

   NOTE:
   Only mail-enabled security groups are supported. For more information on creating groups, see How to create a mail-enabled security group.

   
   
   _{Select which members of your organization you wish to alter the mail flow for.}
    

6. Select Authorize.
    

7. Log in as a Global Administrator. This opens the Permissions requested window. Select Accept.
   
   
   _{Permissions request for Exclaimer to connect to Microsoft 365.}
    

   NOTE: For a detailed list of all applications used by Exclaimer, see Exclaimer Microsoft 365 application permissions. 

8. Wait for the configuration process to complete. The dashboard status displays In progress.
   
   
   _{Mail routing in progress.}
   
   Once the configuration has been completed, a confirmation window is displayed. The dashboard status of the Server-Side configuration changes to Connected. Select Re-connect to make changes to the onboarding settings.
   
   
   _{Confirmation window showing successful connection to your email service.}
    

   Next Steps: Select Create signature to start creating your first email signature. 

If your Microsoft 365 Global Administrator account has the Global Administrator role assigned through a group or PIM (Product Information Management), your configuration may fail. The role must be assigned as Direct. You can check how the role is assigned in Entra ID (formerly Azure AD) and reassign it correctly if necessary. 

To check and reassign the role in Entra ID:

1. Log in to Entra ID (formerly Azure AD) at https://entra.microsoft.com/
    
2. Navigate to the account and select the account name. 
    
3. From the menu sidebar, select Assigned roles. 
    
   
   _{Select Assigned roles.}
    
4. In the Active assignments list, locate the Global Administrator role and check the value in the Membership column. This must show Direct. If it shows Group, you need to reassign the role. 
   
   
   _{An example of the Membership value showing Group.}
    
5. To reassign the role, remove the current assignment by selecting Remove in the Action column.
    
   
   _{Select Remove to delete the Group assignment.}
    
6. Select +Add assignments from the header row. 
    
   
   _{Select Add assignments.}
    
7. Select the Setting tab.
    
   
   _{Open the Setting tab.}
    
8. Under Assignment type, select the Active radio button.
    
9. In the Enter justification text field, enter a reason for assigning.
    
10. Select Assign.  
     
11. Cancel any previous Microsoft 365 processes and attempt to connect to Exclaimer again. 

If the problem persists, query Microsoft Graph Explorer to see if the role has assigned correctly.

To query Microsoft Graph Explorer:

1. Sign in to Microsoft Graph Explorer using Global Administrator credentials. 
    

2. If prompted, accept the permissions request.

   NOTE: You do not need to select the Consent on behalf of your organization checkbox.
3. In the main Graph Explorer pane, select the Modify Permissions tab.
   
   
   _{Open the Modify Permissions tab.}
    
4. Locate the row for Directory.Read.All and select Consent. 
   
   
   _{Select Consent on the Directory.Read.All row.}
    

5. When prompted, accept the permissions request.

   NOTE: You do not need to select the Consent on behalf of your organization checkbox.

6. In the query entry field, enter the following text:

   https://graph.microsoft.com/v1.0/directoryRoles(roleTemplateId='62e90394- 69f5-4237-9190- 012177145e10')/members/microsoft.graph.user?$select=displayName,mail

   
   _{Enter the text in the field.}
    

7. Select Run query.
    
8. Check the Response preview window for the account you created in the previous process. If it is not present, re-check that the role assignment is Direct and not Group. If the problem persists, raise a Support ticket.