> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Enable M365 Inline Mode
> Put xorlab in the Microsoft 365 delivery path so it can block and quarantine. Your MX records stay untouched.
The integration is done via mail flow rules and connectors.
**Prerequisites**
* Complete [Before You Begin](/latest/before-begin-integration) and [Set Up Email Routing in xorlab](/latest/m365-smtp)
* Have access to [Exchange Admin Center](https://admin.exchange.microsoft.com/)
* Know your customer ID `xyz`, e.g. `xyz.activeguard.cloud`
## Create xorlab to M365 connector
This connector makes sure that M365 will accept emails from xorlab.
1. Go to [Exchange Admin Center](https://admin.exchange.microsoft.com/) → **Connectors** → add a connector:
2. **Connection from** → **Your organization’s email server**:
3. Set the name to `xorlabToMicrosoft365` and enable **Retain internal Exchange email headers**:
4. Choose **By verifying that the subject name…** and add `*.xyz.activeguard.cloud` where `xyz` is your customer ID:
5. **Create connector**.
## Create M365 to xorlab connector
This connector makes sure that all emails are routed through xorlab.
1. Create a new connector.
2. **Connection from** → **Office 365**, and **Connection to** → **Your organization’s email server**:
3. Set the name to `Microsoft365Toxorlab` and enable **Retain internal Exchange email headers**:
4. Select **Only when I have a transport rule set up…**:
5. Add a new smart host with the value `mx.xyz.activeguard.cloud`, where `xyz` is your customer ID:
6. Activate **Always use Transport Layer Security…** and select **Issued by a trusted certificate authority (CA)**:
7. Enter a company mailbox where a validation email should be sent to:
**Unsuccessful validation**
The connector validation might fail at this point. If this happens, save the connector without validation, create the mail flow rule in the next section and then validate the connector again.
8. Review the connector and click **Create** when it’s OK.
## Create mail flow rules
Here we create mail flow rules that use the connector from above. The mail flow rules make sure that there is no loop between xorlab and M365.
1. Go to [Exchange Admin Center](https://admin.exchange.microsoft.com/) → **Mail flow** → **Rules** and create a new rule:
2. Configure the rule like this:
* **Name:** `IncomingToxorlab`
* **Apply this rule if** → **The sender** → **is external/internal** → **Outside the organization**
* Click the plus icon (`+`) to add another condition
* **And** → **The recipient** → **is external/internal** → **Inside the organization**
* **Do the following** → **Redirect the message to** → **the following connector** → choose **Microsoft365Toxorlab**
* **Except if** → **The sender** → **IP address is in any of these ranges...** → add all IPs of the xorlab MTAs (find them in the DNS A records of `mx.xyz.activeguard.cloud`)
3. Click through **Next** → **Finish** and leave all settings at their defaults.
4. Repeat steps #2-3 to add another rule but this time set:
* **Name:** ` OutgoingToxorlab`
* **The sender** → **Inside the organization**
* **The recipient** → **Outside the organization**
* **Except if** → **The message properties** → **Automatic Reply**
**Exclude automatic replies**
In the outgoing rule we exclude automatic replies because M365 does not always accept them when sending them back.
5. Enable both rules in the **Rules** page.
6. It can take several minutes until the rule is active. Test it by sending an incoming and outgoing email.
## Troubleshooting
Apply the following measures only if you experience deliverability issues between M365 and xorlab. Normally, they are not necessary.
### M365 rejects emails from xorlab
If M365 rejects some legitimate emails from xorlab, there are multiple measures. Apply them in order written below until the problem is fixed.
First, add your xorlab domain as an “[accepted domain](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)”.
1. Go to [Microsoft 365 Admin Center](https://admin.microsoft.com/) → **Settings** → **Domains** and add a domain:
2. Enter `xyz.activeguard.cloud`, where `xyz` is your customer ID:
3. Select the first option **Add a text record…**:
4. Send the TXT value to [support@xorlab.com](mailto:support@xorlab.com) so that we can add it to the DNS record of your domain. After this has been done, **verify**:
5. After a successful verification, click **More options** and select **Skip and do this later**:
If that does not help, you can add xorlab to your SPF records.
You can add the xorlab MTAs to your SPF records. For this, include `a:mx.xyz.activeguard.cloud` to all your domains that route emails via xorlab:
```shell theme={null}
dig +short TXT customer.tld
"v=spf1 a:mx.xyz.activeguard.cloud include:spf.protection.outlook.com -all"
```
Afterward, check that your SPF records are still valid, for example with DMARCanalyzer’s [SPF checker](https://www.dmarcanalyzer.com/spf/checker/).
If adding xorlab to your SPF record did also not help, you can add xorlab to the anti-spam policy of M365.
1. Go to [**Anti-spam policies**](https://security.microsoft.com/antispam) and select **Connection filter policy (Default)**:
2. Click **Edit connection filter policy**:
3. Enter the xorlab MTA IPs to the first field:
4. Check if the addresses are correct under **IP Allow list** and click **Close**.
### M365 puts emails from xorlab into Junk
The following mail flow rule will bypass the M365 spam filtering for emails coming from xorlab. Note that this will mostly disable the Junk folder mechanism for your mailboxes.
1. Go to [Exchange Admin Center](https://admin.exchange.microsoft.com/) → **Mail flow** → **Rules** and create a new rule:
2. Configure the rule like this:
* **Name:** `SpamBypassxorlab`.
* **Apply this rule if** → **The sender** → **IP address is in any of these ranges...** → add all IPs of the xorlab MTAs
* Click the plus icon (`+`) to add another condition
* **And** → **The message properties** → **include an SCL greater than or equal to** → **Bypass spam filtering**
* **Do the following** → **Modify the message properties** → **set the spam confidence level (SCL)** → **Bypass spam filtering**
3. Click through **Next** → **Finish** and leave all settings at their defaults.
4. Enable the rule in the **Rules** page.
## Next steps
Optionally continue with:
* [Activate Case Isolation](/latest/m365-case-isolation)
* [Move M365 Quarantine to xorlab](/latest/m365-move-quarantine)
* [Integrate M365 Reported Emails](/latest/m365-reporting-integration)
Once the integration is complete, continue with [What to Configure Next](/latest/integration-next-steps).