> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Enable M365 Monitoring Mode
> Set up out-of-band observation in Microsoft 365. In this mode xorlab analyzes traffic but cannot block or quarantine.
M365 sends a copy of every incoming and outgoing email to xorlab.
**Prerequisites**
* Complete [Before You Begin](/latest/before-begin-integration) and [Set Up Email Routing in xorlab](/latest/m365-smtp)
* Have access to [Exchange Admin Center](https://admin.exchange.microsoft.com/)
* Know your customer ID `xyz`, e.g. `xyz.activeguard.cloud`
* Using BCC monitoring sends an additional copy of each email to xorlab, which can lead to hitting the external recipients rate limit (tenant ERRL) of Microsoft Exchange.
* You can monitor how close you are to the limit under: **Reports → Mail flow → Outbound external recipients**
## Create mail flow rule
1. Go to [Exchange Admin Center](https://admin.exchange.microsoft.com/) → **Mail flow** → **Rules** and create a new rule:
2. Configure the rule like this:
* **Name:** `IncomingBCCxorlab`
* **Apply this rule if** → **The sender** → **is external/internal** → **Outside the organization**
* Click the plus icon (`+`) to add another condition
* **And** → **The recipient** → **is external/internal** → **Inside the organization**
* **Do the following** → **Add Recipients** → **to the Bcc box** → enter `monitor@mx.xyz.activeguard.cloud`, where `xyz` is your customer ID
3. Click through **Next** → **Finish** and leave all settings at their defaults.
4. Repeat steps #2-3 to add another rule but this time set:
* **Name:** `OutgoingBCCxorlab`
* **The sender** → **Inside the organization**
* **The recipient** → **Outside the organization**
5. Enable both rules in the **Rules** page.
Now, a copy of every incoming and outgoing email will be sent to xorlab.
## Create a connector
In addition to the mail flow rule above, we need to create a connector to make sure the emails are sent directly to xorlab.
We recommend to always create a connector to ensure proper email delivery. However, you can omit the connector if the following two conditions are met:
* You do not have any other connectors that might interfere with the BCC emails sent to xorlab.
* You do not have a hybrid MS setup with an on-prem-only email delivery (*Centralized Mail Transport*).
1. Go to [Exchange Admin Center](https://admin.exchange.microsoft.com/) → **Connectors** → add a connector:
2. **Connection from** → **Office 365**, and **Connection to** → **Your organization’s email server**:
3. Set the name to `Microsoft365Toxorlab` and enable **Retain internal Exchange email headers**:
4. Choose the third option and enter `mx.xyz.activeguard.cloud`, where `xyz` is your customer ID. Click the plus (`+`) icon:
5. Add a new smart host with the value `mx.xyz.activeguard.cloud`, where `xyz` is your customer ID:
6. Activate **Always use Transport Layer Security…** and select **Issued by a trusted certificate authority (CA)**:
*Security restrictions*
7. Enter a company mailbox where a validation email should be sent to:
**Unsuccessful validation**
The connector validation might fail at this point. If this happens, save the connector without validation, and then validate the connector again.
8. Review the connector and click **Create** when it’s OK.
## Optional: Include internal emails
Per default, xorlab only processes incoming and outgoing emails. However, if you want to include also internal emails, do the following:
* Remove one of the two mail flow rules from above
* Rename the existing one to `BCCxorlab`
* Change **Apply this rule if** to **Apply to all messages** and remove the **And** condition
Now, a copy of every email will be sent to xorlab.
## Next steps
Optionally continue with:
* [Activate Case Isolation](/latest/m365-case-isolation)
* [Move M365 Quarantine to xorlab](/latest/m365-move-quarantine)
* [Integrate M365 Reported Emails](/latest/m365-reporting-integration)
Once the integration is complete, continue with [What to Configure Next](/latest/integration-next-steps).