M365 Overview - xorlab

Prerequisites

Complete Before You Begin

Your MX records stay with Microsoft: every step below is a connector, a mail flow rule or an app registration inside your own tenant. See Review What Changes in Your Environment for the full list, including what stays untouched and how to undo it.

Step	Description
Set Up Email Routing in xorlab	Mandatory. Configure xorlab to accept and forward emails with your M365 tenant.
Create Entra ID App	Mandatory. Create the xorlab app in Entra ID. This is required for the mandatory Entra ID SAML login and is also used by Case Isolation and Retrospective Email Scanning.
Enable SAML Login	Mandatory. Allow single sign-on (SSO) via Entra ID.
Import Past M365 Emails	Optional. Import historical emails during onboarding to speed up the learning phase.
Enable either M365 Monitoring or Inline mode	Mandatory. In Monitoring mode, M365 sends just copies of emails to xorlab. In Inline mode, M365 routes emails via xorlab for active protection. See Before you begin and below for more information.
Activate Case Isolation	Optional. Allow removing emails from mailboxes after they have been delivered.
Move M365 Quarantine to xorlab	Optional. Make sure that users only need to use the xorlab quarantine. This instructs M365 to send malicious emails to xorlab instead of quarantining them itself.
Integrate M365 Reported Emails	Optional. Integrate the Abuse Mailbox with xorlab such that reported emails are handled by xorlab.

Inline mode diagrams

In Inline mode, xorlab filters all emails and sends the benign ones back to M365 for final delivery.

M365 Inline mode

Open the M365 Inline mode guide

Monitoring mode diagrams

In Monitoring mode, xorlab receives only a copy of every email and discards it after processing.

M365 Monitoring mode

Open the M365 Monitoring mode guide

Multi-Tenancy

If you integrate more than one M365 tenant with the same xorlab instance, follow Add a Tenant instead of the table above. It uses the same guides, but adds the per-tenant configuration around them:

Configure the domains and routing of the tenant with the M365 topology.
Set up SAML per tenant, see Enable Tenant Login.
Assign reported emails to the right tenant, see Assign Reported Emails to Tenants.

⌘I

​Inline mode diagrams

M365 Inline mode

​Monitoring mode diagrams

M365 Monitoring mode

​Multi-Tenancy

Inline mode diagrams

Monitoring mode diagrams

Multi-Tenancy