Get started with Ascripto on Microsoft 365

Last reviewed 19 October 2026

On Microsoft 365, Ascripto adds each person’s signature as their mail leaves: your mail goes out through Exchange Online as it does today, passes through the Ascripto relay, which inserts the signature, and comes straight back to Exchange Online, which delivers it. Nothing is installed on anyone’s computer or phone, incoming mail is untouched, and your MX records do not change.

Time: about fifteen minutes, in two parts: connecting (needs a Microsoft 365 administrator) and routing mail (needs whoever set up your Microsoft 365, or a Global Administrator).

You need:

• A work Microsoft 365 account at your company’s domain.
• A Global Administrator or Privileged Role Administrator in Microsoft 365 to connect the directory.
• A Global Administrator or Exchange Administrator to set up mail flow in Exchange Online. Often the same person.

The whole journey

1. Sign in and create your workspace.
2. Connect Microsoft 365, so Ascripto knows who works at your company and which domains are yours.
3. Decide what everyone’s signature should be, and choose a plan.
4. Add your domains in Settings → Delivery.
5. Set up Exchange Online: let Ascripto do it, or run a script.
6. Check the setup and send a test message.

Step 3 is listed before 4 on purpose: on Microsoft 365 the relay is the only way a signature is deployed, and the free plan deploys nothing. Mail routed through Ascripto on the free plan passes through unsigned. Build the signatures first, start the trial, then route mail.

Step 1 — Sign in and create your workspace

1. Go to app.ascripto.com and click Continue with Microsoft.
2. Sign in with your work account.
3. You will see Set up Ascripto for yourcompany.com with two steps listed: connect Microsoft 365, and route your mail through Ascripto. Tick the box accepting the Terms of Service and Data Processing Agreement on behalf of your company, and click Create workspace.

You are the workspace’s owner. If you see yourcompany.com is already on Ascripto, a colleague got there first: ask them to invite you in Settings → Team.

Step 2 — Connect Microsoft 365

On the Welcome to Ascripto page, step 2 is Connect Microsoft 365.

1. Click it. A page on auth.ascripto.com says what will be read: your people (names, job titles, departments, phone numbers) and your company’s verified domains. Read-only.
2. Microsoft’s consent screen asks a Global Administrator or Privileged Role Administrator to accept for the organisation. Click Accept.
3. Back in Ascripto, the step shows Reading your directory… with names arriving, then the count.

Ascripto reads changes every minute and the whole directory once a day. People without a Microsoft 365 licence appear too; nobody is counted or charged for being in the directory.

If Microsoft refuses: Allowing Ascripto for your organisation needs a Microsoft 365 Global Administrator or Privileged Role Administrator. Sign in to Microsoft as one, or click Not a Microsoft 365 administrator? Invite one and send them the link; it works for seven days, for a Microsoft 365 account in your organisation.

Step 3 — Build the signatures and choose a plan

This is the same as on Google Workspace, so it is written once: Get started: Google Workspace, step 5 and step 6. In short: upload your logo and colours in Assets, give your company name and build signatures in Signatures, and the owner starts the 14-day Business trial (no card) in Settings → Billing.

Two differences on Microsoft 365:

• There is no audit yet. Microsoft gives no way for an app to read the signature someone set in Outlook, so Home on a Microsoft workspace shows the state of mail routing instead of an off-brand count. An Outlook add-in that reads them is planned.
• Import from Gmail is a Google feature. To start from an existing Outlook signature, copy its HTML and use Start from HTML (Business), or rebuild it from the gallery.

A seat on Microsoft 365 is anyone the relay signed at least one message for in the month.

Step 4 — Add your domains

Open Settings → Delivery. Under Domains through Ascripto you see every domain Microsoft 365 lists as verified for your company. Click Add beside each domain whose mail should carry signatures. A domain verified in Microsoft 365 after you connected can be typed in and added.

Adding a domain here tells the relay to expect its mail and where to hand it back. Nothing moves yet; Exchange Online only sends mail to Ascripto once step 5 is done.

Step 5 — Set up Exchange Online

The setup makes three things in Exchange Online: an inbound connector (accept mail back from Ascripto, identified by its certificate), an outbound connector (send mail to Ascripto), and one mail flow rule (send your domains' mail through Ascripto, once). Both ways below make exactly the same three things from the same description, and both are safe to run again.

Let Ascripto do it

1. On the Delivery page, click Set it up for me.
2. A page on auth.ascripto.com says exactly what will be made (the three objects, by name, with your domains), what will not (nothing else is read or changed, no mail is read), and that the permission lasts about an hour and is never stored. Click Continue to Microsoft.
3. Sign in as a Global Administrator or Exchange Administrator and accept Manage Exchange As Signed-in User for this one occasion.
4. Back on the page: each step and its outcome (inbound connector, outbound connector, rule, rule switched on, read back), then whether what Exchange now has matches the setup. Back to Ascripto returns to Delivery.

If consent is declined, nothing is changed. If your account is not an administrator of the right kind, the page says who in your organisation can do it. Either way the script below is always available.

Or run the script yourself

On a Windows computer, in about five minutes, with nothing to install:

1. On the Delivery page, click Copy the whole script.
2. Open the Start menu, type PowerShell, and open Windows PowerShell. A window with a blinking cursor opens.
3. Right-click inside the window to paste, then press Enter. The first time, it installs Microsoft’s Exchange tool, which takes a minute or two. If it asks a question, type Y and press Enter.
4. A Microsoft sign-in window opens. Sign in with your Microsoft 365 administrator account.
5. Wait until it says Done. Run it again whenever you add or remove a domain in Ascripto.

On a Mac, PowerShell is not built in: install it from Microsoft, open Terminal, type pwsh, and paste there; or ask someone with a Windows computer.

What the script does, step by step on the Delivery page shows each step’s commands with its own Copy, and offers the script and its description as files, for whoever in IT wants to read before running.

Step 6 — Check the setup and send a test

Check the setup, under the script on the Delivery page: Ascripto cannot see inside Exchange, so a second script reads what is there and changes nothing.

1. Copy the check script and paste it into the same PowerShell window (sign in again if asked).
2. It saves ascripto-check.json and says where, usually your user folder.
3. Upload that file on the Delivery page. You get Exchange has everything the setup sets, or a list of what differs and the advice to run the setup again, which sets each item back. The file is not kept.

Send a test message from a mailbox at a routed domain to any outside address, for example your personal one. Within a few minutes:

• Beside the domain under Domains through Ascripto: Last mail 2 minutes ago · 1 in the last 24 hours.
• In the Message log further down the page: the message, ✓ signed, ✓ sent on. Click it for each recipient’s outcome. The log keeps the last 10 days by sender, recipient and Message-ID; it never stores the subject or content of your mail.
• In the recipient’s inbox: the signature, under what you wrote.

If the domain row says No mail from it has reached Ascripto in N days, the rule is not sending mail to Ascripto yet: run the setup again, or check the setup to see what differs.

What your people will notice

• Nothing while composing. The signature is added after they press Send, so it is not in the compose window and not in their Sent Items copy. This is true of every server-side signature product; tell your people once and the support questions stop.
• Every client is covered: Outlook on Windows and Mac, Outlook on the web, the Outlook app on phones, Apple Mail, anything that sends through Exchange Online.
• Replies and forwards too. The signature is placed under what they wrote, above the quoted earlier messages, with each image embedded once rather than piling up down a thread.
• Some mail is left exactly as it was: encrypted or digitally signed messages, calendar invitations, bounces, and mail from senders who are not people in your directory with a signature (a distribution list, say). The Message log says Not signed and why.

Afterwards

• Settings → Delivery shows each domain’s recent mail flow and holds the Message log, which is where to look when someone asks “what happened to the email I sent at 14:32?”.
• Settings → Connections shows the directory connection and Read it now.
• The signature a person gets follows your rules and their directory record; a title change in Microsoft 365 reaches their signature within the next directory read.

To stop routing one domain: Delivery → Remove beside it. The relay stops accepting that domain’s mail the moment you confirm, so the page tells you what to do in Exchange before the button: run the setup again (which rewrites the rule without that domain), or, if it is your last domain, switch the rule off first with the one-line command shown.

To leave entirely: switch the rule Ascripto signatures off in Exchange Online, cancel the plan in Settings → Billing → Manage billing, then delete the rule and the two connectors and revoke the Ascripto app in the Microsoft Entra admin center (Entra ID → Enterprise apps → Ascripto). Your data is exportable for 30 days and then deleted, as the DPA sets out.

Questions: hello@ascripto.com. Plans and quotes, including a dedicated deployment in the Azure region of your choice: sales@ascripto.com.