Dave is a marketing expert with 15 years experience in the tech and SaaS world. He specializes in educating IT and channel audiences, with a focus on security, privacy, compliance, and marketing technology. With a talent for storytelling and a deep understanding of the industry, Dave transforms complex IT topics into clear, engaging, and impactful narratives.
Microsoft 365 email signature management: What the tenant controls and where it stops
TL;DR
A mail flow rule adds the same text to the top or bottom of email messages that enter or leave a Microsoft 365 organization.
Exclaimer's Graph guide says neither mail flow rules nor mailbox PowerShell deliver a consistent email signature that updates itself from the directory.
Roaming signatures switch off the mailbox email signature setting, and IT can postpone them with one parameter in Exchange Online PowerShell.
Exclaimer's cloud solution for Microsoft 365 adds an email signature designer and delegated permissions in one portal, and IT still sets who can change what.
Marketing wants a new banner live today. Legal wants a disclaimer reworded. In Microsoft 365, both requests land on whoever holds the Exchange "Mail flow" permissions.
In Exclaimer's State of Business Email 2025 research, a Censuswide survey of 4,009 IT professionals in the UK, US, Germany, and Australia, 35% of IT teams named email signature management one of their top two most time-consuming tasks.
What can Microsoft 365 do natively about email signatures?
Microsoft 365 splits its email signature controls between the Exchange admin center and Exchange Online PowerShell, plus a Windows registry setting for Windows clients. Five settings are involved.
Setting | What the setting does | Where IT makes the change | Source |
|---|---|---|---|
Mail flow rule | Adds text to the top or bottom of messages that enter or leave the organization | Exchange admin center (Mail flow > Rules) or | Microsoft Learn, disclaimers page |
Outlook on the web mailbox policy | Removes the built-in email signature options from Outlook on the web and the new Outlook | Exchange admin center (Roles > Outlook web app policies) | Exclaimer support article |
Roaming signatures setting | Disables roaming signatures in Outlook on the web and the new Outlook for Windows | Exchange Online PowerShell ( | Microsoft Learn, Set-OrganizationConfig |
Mailbox email signature setting | Sets the email signature Outlook on the web uses for one mailbox, and doesn't work while roaming signatures are enabled | Exchange Online PowerShell ( | Microsoft Learn, Set-MailboxMessageConfiguration |
Registry setting | Disables roaming signatures on Windows clients | Windows registry | Microsoft Learn, Set-OrganizationConfig |
What can a mail flow rule add?
A mail flow rule, also called a transport rule, adds an HTML or plain text legal disclaimer, email signature, or other information to the top or bottom of messages that enter or leave the organization, according to Microsoft Learn's disclaimers page. The disclaimer text can use 23 tokens that take their values from the sender, including:
%%DisplayName%%%%Title%%%%Department%%%%Company%%
Creating the rule requires the "Mail flow" permissions in Exchange Online, which Microsoft lists in its feature permissions article.
Tip
Microsoft 365 gives IT a step up from Outlook for organization-wide enforcement, but it still lacks the design flexibility, preview capability, and conditional logic that IT teams need once the environment gets complex.
What do roaming signatures change?
Roaming signatures store a user's email signature in the user's mailbox, according to Microsoft Support. While they are enabled in a cloud-based organization, the email signature parameters of Set-MailboxMessageConfiguration don't work, according to Microsoft Learn's reference for that cmdlet. Microsoft Learn's Set-OrganizationConfig reference adds three points:
Setting the PostponeRoamingSignaturesUntilLater parameter to $true disables roaming signatures in Outlook on the web and the new Outlook for Windows.
For Windows clients, the registry setting to disable roaming signatures still works.
Microsoft has no plans to support roaming signature management in the Microsoft Graph API.
Exclaimer's Graph guide says Microsoft Graph has no public API for creating or setting Outlook email signatures, so moving scripts to Microsoft Graph doesn't restore that capability.
Where does native control stop?
What does a mail flow rule leave out?
Exclaimer's Graph guide says an Exchange transport rule appends an HTML disclaimer to outgoing mail at the server, so the disclaimer reaches every user at once. The guide says the disclaimer:
lands at the bottom of the entire thread instead of under the latest reply
does not appear in the sender's Sent Items
cannot reliably pull per-user details or inline photos into a designed layout
The guide adds that neither this method nor Set-MailboxMessageConfiguration delivers a consistent, on-brand email signature that renders the same everywhere and updates itself from the directory.
Why do variations and edits pile up on IT?
Microsoft Learn's best practices page says mail flow rules are processed in order, so more than one rule can apply to the same message. A disclaimer that should apply only to the first message in a thread needs an exception for messages that already include the disclaimer text. Each variation is another rule, and every rule change needs the Exchange permissions above.
"The way I think about it, IT sets the plumbing: the platform, the rules, the governance, the framework. What goes into the signature, the content, the data, the design, should sit with whoever owns those things naturally. HR owns employee data, so HR maintains job titles. Role-based access lets you delegate that without giving up governance."
How many organizations centralize email signatures?
In Exclaimer's press release of 30 September 2025 on its U.S. Business Email Report 2025, only 18% of U.S. organizations used a centralized email signature management solution, and 41% still relied on employees to manage their own.
What changes when a platform manages email signatures?
Central email signature management means one system applies branding, legal disclaimers, and campaign banners to employee email signatures, instead of leaving every employee to build their own, according to Exclaimer's guide to email signature management.
Exclaimer's cloud solution manages email signatures for over 80,000 organizations, and the feature-by-feature comparison with native tools sits on its own page.
How does a platform compare with scripts?
Exclaimer's Graph guide compares a scripted approach, meaning PowerShell scripts that read and write email signatures, with Exclaimer's cloud solution across four Microsoft platform changes. The table shows three of the four.
Microsoft platform change | Scripted approach | Exclaimer's cloud solution |
|---|---|---|
EWS retirement in 2026 | Lose the programmatic route for reading and writing email signatures | Doesn't depend on EWS |
Outlook roaming signatures enabled | Set-MailboxMessageConfiguration stops applying | Not affected by the cmdlet's behavior |
New Outlook and other clients | Test and adjust for each client | Rendering managed centrally and kept consistent |
How does Exclaimer connect to a Microsoft 365 tenant?
An administrator signs in with Microsoft 365 Global Administrator credentials and runs the connector setup, according to Exclaimer's Mail Flow support article.
The same article says a group controls which user emails get routed from Microsoft 365 to Exclaimer, and the Mail Routing Domain option sets how Exclaimer routes email back to Microsoft 365 after processing. Only an Exclaimer Admin can view those settings. Mail Flow also holds switches for email sent on behalf of a user, group, or shared mailbox and for email sent from alias addresses.
How does a platform handle design and directory data?
Brand Kits hold approved logos, fonts, colors, banners, meeting backgrounds, and disclaimers, so a change applies everywhere a kit is linked, according to Exclaimer's Brand Kits page and rebrand guide. A template that isn't linked doesn't pick up the change.
Directory Sync pulls the data fields from Microsoft Entra ID automatically. It reads the directory in read-only mode and syncs Microsoft 365 data twice a day, at 00:00 and 12:00 UTC, so a job title changed in Microsoft Entra ID reaches the email signature at the next sync, according to Exclaimer's Graph guide. Employees can add details such as pronouns or working hours themselves.
Meritus Gas Partners treats Microsoft Entra ID as its single source of employee details and manages email signatures for 20+ Microsoft 365 tenants from one platform, without merging the tenants.
How does Exclaimer decide who gets which email signature?
Signature Rules assign the right email signature by department, region, device, audience, or recipient. Server-side deployment applies the email signature as mail routes through Exclaimer, regardless of which device sent the email.
The Outlook Add-in shows users their email signature as they write in Outlook for Windows, macOS, and the web, and Exclaimer's blog on the mobile Add-in says it's now available on iOS and Android. On Outlook mobile, users can't manually choose an email signature, and Quick Reply doesn't get one, according to Exclaimer's support article.
Who can change what?
IT keeps platform control while marketing edits banners and legal updates disclaimers, according to Exclaimer's rollout playbook. Exclaimer's User Management support article lists eight user roles:
Role | What the role can do |
|---|---|
Owner | Can access all features and functionalities |
Admin | Can access and use most features except purchasing or canceling subscriptions, changing user numbers or roles, or viewing Diagnostics |
Editor | Can access and use a selection of features, with some read-only permissions |
Analytics | Can view and manage analytics reports, including usage, engagement and feedback data |
Designer | Can create and edit email signatures, Brand Kits, Meeting Branding, Disclaimers and Campaigns |
Auditor | Can use the User Activity Log feature only |
User Manager | Can use the User Management screen only: add a user, remove a user, and set roles |
Finance | Can download Exclaimer invoices; available only to direct customers of Exclaimer |
What does IT check once it is running?
Exclaimer applies the email signature as mail routes through Exclaimer, so the email signature doesn't show in the sender's Sent Items folder unless an admin turns on Sent Items Update. That feature works for Microsoft 365 mailboxes only, and the service isn't guaranteed.
Sent Items Update moved from Exchange Web Services to Microsoft Graph. Anyone who used it before 17 August 2026 has to reauthorize the service, or it stops updating sent items. Recipients still get the email signature, and the core deployment is unaffected.
Diagnostics Logs show why an email signature was or wasn't applied and which Signature Rules affect deployment, and Exclaimer keeps only seven days of log information. The Admin role can't view Diagnostics.
How do you manage Microsoft 365 email signatures from one place?
Exclaimer for Microsoft 365 moves banner and disclaimer changes into a portal where Marketing and Legal can make them. IT keeps control of the permissions, and brand and disclaimer standards stay consistent across the email channel.
The steps for the native setup are in our guide to creating Microsoft 365 email signatures.
Book a demo to see how Exclaimer works with your Microsoft 365 tenant.
