Add a New Tenant

Prerequisites (only for first tenant)

Make sure your xorlab is in the correct mode: Inline vs Monitoring, follow Choose between Inline and Monitoring mode.

Configure guarded domains and routing

The first step is to add all domains of the tenant and configure their routing (where should their emails be sent to).

Follow the guide below that matches the topology where your new tenant will be integrated. On top are the two most common ones.

Topology	Description
Default	xorlab is located between your gateway and your internal Exchange server.
M365	xorlab integrates directly with M365.
Front MTA	xorlab is your gateway/front MTA.
Star	Your gateway integrates xorlab in a Star layout.
Full Chain (Rare)	Same as Default, but inter-tenant emails pass through xorlab twice.

Optional: If you need a special mode (like toothless or Monitoring) specifically for that tenant, contact support@xorlab.com.

Activate mail flow

The next step is outside of xorlab and involves activating the mail flow. Choose the matching guide, depending on:

Topology: M365 vs. all others
Mode: Inline vs Monitoring

M365
Others

Inline

Emails pass from M365 through xorlab and then back to M365.

Monitoring

xorlab receives only a copy of every email from M365, and discards it after processing.

Now xorlab should be receiving emails for that tenant.

Reduce reputation complexity for small tenants

For tenants below 50 seats, we recommend to reduce the complexityFactor in the guarded_tenants.yml file. This helps xorlab to learn faster from processed emails. Otherwise, learning can take quite a while to stabilize for small tenants, since fewer emails are available. We recommend the following values:

Number of seats	Value
Above 50	Keep the default (100)
Between 25 and 50	50
Below 25	25

/shared/guarded_tenants.yml

tenants:
  - name: tenantA
    domains:
      - tenantA.com
    reputation:
      complexityFactor: 50

After updating shared/guarded_tenants.yml, click Publish. The new configuration becomes active within about one minute.

Configure detection for the tenant

Detection is configured per tenant, so a new tenant starts without the manual inputs that xorlab needs for optimal protection.

Open the Admin view in the upper right and select the new tenant in the dropdown on top.
Configure the built-in lists for that tenant, in particular the VIP names and high value targets.
Review the default actions for that tenant.

Both steps use the same screens as in a single-tenant deployment and apply only to the tenant selected in the dropdown. You can give the tenant access to xorlab:

End-user access to the Self-Service Quarantine (SSQ)
Analyst access to the analyst portal, to manage various tasks like releasing emails from quarantine or adding senders to the blacklist

Follow the instructions here: Enable Tenant Login.

Optional: Enable SSQ

You can enable the SSQ for the tenant, such that their end-users can release their own emails from the quarantine. You can find the full instructions for setting up and customizing the SSQ here: Set Up the SSQ. For convenience, we summarize here the mandatory steps to enable SSQ for a tenant:

Complete the previous chapter, to Enable Tenant Login such that they can login to the SSQ.

Enable notifications for that tenant in guarded_tenants.yml:

shared/guarded_tenants.yml

tenants:
  - name: xorlab
    quarantine:
      notifications:
        enabled: true
        frequency: DAILY
        ## - NEVER: Sending of a quarantine notification is disabled for the user.
        ## - IMMEDIATELY: Sending of a quarantine notification happens immediately if a message for the user is quarantined.
        ## - DAILY: Sending the quarantine notification every day at the time specified in the dailyCron option.
        ## - WEEKLY: Sending the quarantine notification once a week at the time specified in the weeklyCron option.

Click Publish. The notification settings become active within about one minute.
This is not strictly mandatory, but recommended: Customize the quarantine notifications for that tenant to for example add their logo: Customize Tenant Notifications.

Optional: Integrate Abuse Mailbox

You can enable the Abuse Mailbox for the tenant, such that their reported emails are managed in xorlab.

Follow the integration guide below that matches the tenant setup. You can ignore their Prerequisites as they are already covered by this page.
M365
Use the built-in M365 reporting button to send emails to xorlab.
On-premises
Use a custom reporting button integrated via on-premises Exchange.
Follow Assign Reported Emails to Tenants to make sure xorlab assigns the reported emails to the correct tenant.

​Configure guarded domains and routing

​Activate mail flow

Inline

Monitoring

Inline

Monitoring

​Reduce reputation complexity for small tenants

​Configure detection for the tenant

​Optional: Enable Tenant Login

​Optional: Enable SSQ

​Optional: Integrate Abuse Mailbox

M365

On-premises

Configure guarded domains and routing

Activate mail flow

Reduce reputation complexity for small tenants

Configure detection for the tenant

Optional: Enable Tenant Login

Optional: Enable SSQ

Optional: Integrate Abuse Mailbox