Outbound Security setup for Microsoft 365: Segmented mail routing by group

This configuration can be used to direct email from a subset of users out via Paubox, rather than directing all email traffic from your organization out via Paubox. This is done in the Microsoft 365 Exchange Admin Center by creating a distribution list, outbound connector, and transport rule. 

If you are setting up traffic segmentation, you must notify support@paubox.com so we can make matching adjustments on the Paubox side.

Note: The complete setup instructions for Outbound Security setup for Microsoft 365 are here. The  configuration below can be used in place of Part II: Microsoft 365 - Create a Connector.

A Paubox subscription or trial subscription is required (don't have one? sign up here!)

Questions? Stuck? We’re here for you!  support@paubox.com

Step-by-step guide

Part I: Create a group

1. Log in to the Microsoft 365 Exchange Admin Center using admin-level credentials (https://admin.exchange.microsoft.com/) 
2. In the navigation pane on the left, click dashboard. Then click groups (under recipients).
3. Click the dropdown arrow that is just to the right of the "+ New Microsoft 365 group" button and select Distribution list.
4. On the resulting pop-up window, enter the following:

• Display name: routetopaubox
• Alias: routetopaubox
• Email address: routetopaubox (leave the domain name field unchanged)
• Skip the "Notes" field and scroll down 
• Under Owners, click the + button
• Highlight the users who should manage this group, click add ->, then click OK.
• Click Next
• Under Members, click the + button
• Highlight the users who will be sending email securely via Paubox, click add ->, then click OK.
• Click Next
• For group email address enter routetopaubox
• Below, select these 2 "closed" options by clicking the corresponding radio buttons:

• Closed: Only group owners can add members. All requests to join will be automatically declined. 
• Closed: Only group owners can remove members. All requests to leave will be automatically declined. 
• Click Save.

Part II: Create a connector     

1. in to the Microsoft 365 Exchange Admin Center using admin-level credentials (https://admin.exchange.microsoft.com/)
2. In the navigation pane on the left, click mail flow. Then click connectors.
3. Click +
4. On the pop-up window that follows, select From: Office 365 and To: Partner organization. Then click Next
5. Under *Name:, enter Paubox. Make sure the checkbox labeled Turn it on is checked, then click Next
6. On the next screen, under When do you want to use this connector?, select Only when I have a transport rule set up that redirects messages to this connector, then click Next
7. Choose Route email through these smart hosts then click +
8. During setup, you'll be provided with the value to enter in the In the "add smart host" box
9. Enter the provided smarthost, then click Save
10. Click Next
11. On the next screen, make sure Always use Transport Layer Security (TLS) to secure the connection (recommended) and Any digital certificate, including self-signed certificates are selected. Click Next.
12. Click Next again
13. On the next screen, click the + and enter a test email address as the validator email address: pauboxtesting@gmail.com
    ... and then click Next.
14. Click Validate
15. After the test is successful, click Close
16. Next click Save
17. The Paubox connector for Microsoft 365 is now live.

Part III: Create a new rule

1. In the navigation pane on the left, click mail flow. Then click rules
2. Click the + and select Create a new rule…
3. On the pop-up window that follows, in the Name field enter Route to Paubox.
4. Under the Apply this rule if… drop-down box, select The Sender is a member of this Group
5. On the pop-up window that follows, select routetopaubox and click OK
6. On the next screen, under the Do the following…. drop-down box, hover over Redirect the message to… then click the following connector
7. Make sure the Connector: drop-down box is set to Paubox. Then click OK
8. Under except if select The recipient... and then is external/internal
9. On the pop-up window that follows, under select recipient location, make sure Inside the organization is selected. Then click OK.
10. Click Next, on the following page click Next, followed by Finish. 
11. After saving, click on the newly created Transport Rule, and Enable the setting. (Wait 30 seconds for it to enable)

Congratulations! You have successfully used the Microsoft 365 Exchange Admin Panel to create a list of select users within your organization that will use Paubox encrypted email as their smart host gateway for outbound, HIPAA compliant email.