CRM and other apps

Microsoft Dynamics 365 Sales

Use server-side synchronization with Exchange Online so the email your people send from Dynamics 365 goes through their own mailbox and is signed, the approval Dynamics asks for, what sequences and "send as another user" need, and why Customer Insights - Journeys email is not signed.

Last checked against Footer365 on 23 October 2026

Dynamics 365 sends a person's email through their own Exchange Online mailbox when the mailbox is set up for server-side synchronization, and Footer365 signs mail that passes through your Microsoft 365. Choose how your CRM or app sends its mail explains the two ways to send, and this guide follows the first. Dynamics 365 is Microsoft's own product, so there is no third-party app to approve in Microsoft Entra, but Dynamics asks an administrator to approve each mailbox.

At a glance

  • Can be signed: email sent from Dynamics 365 apps through a mailbox set up for server-side synchronization with Exchange Online. Microsoft says outgoing email is "submitted ... to the configured email service provider", and that such email "will be visible in the Sent Items folder in the Exchange sender's mailbox."
  • Cannot be signed: Dynamics 365 Customer Insights - Journeys marketing email, which Microsoft's service sends.
  • How it connects: an Exchange Online server profile, with the authentication type Server-to-Server Authentication (Same Tenant) when Exchange is in the same tenant as Dynamics, or Oauth (Cross Tenant) when it is not. Microsoft's pages read do not name the protocol the same-tenant profile uses.
  • Status: from Microsoft's documentation as read on 23 October 2026, not tested by Footer365.

Before you start

  • Footer365 mail flow is set up. With the Outlook add-in only, no mail Dynamics 365 sends is signed. Using the Outlook add-in only
  • Every person who sends from Dynamics has a Footer365 signature rule that covers them.
  • You need the System Administrator security role in Dynamics 365 to create the server profile. Approving mailboxes needs more: see step 1.

Step 1: Approve the app in Microsoft 365

Within one tenant, nothing is approved in Microsoft Entra. Dynamics asks for each mailbox to be approved in Dynamics itself. Microsoft says the roles that can approve email for customer engagement apps with Exchange Online are:

  • a Global administrator who is also a Dynamics 365 System administrator;
  • an Exchange administrator who is also a Dynamics 365 System administrator;
  • a user with the Dynamics 365 Delegated Mailbox Approver security role, who is also a System administrator. A Global or Exchange administrator assigns that role.

You can approve a mailbox in the Power Platform admin center: select the mailbox in the Active Mailboxes view and select Approve Email. Microsoft says you can instead turn off Process emails only for approved users and Process emails only for approved queues in the environment's email settings, but that makes every mailbox processable without approval.

For the cross-tenant profile Microsoft says a global tenant admin or Exchange admin of the primary tenant must approve the mailbox records, and that the Microsoft Entra app registration needs the Office 365 Exchange Online application permission full_access_to_app, which an Exchange administrator can limit to chosen mailboxes with an Application Access Policy. Limit which mailboxes an app can send as describes the newer way to do that.

Step 2: Choose the mailbox

  • Each person's own mailbox is the normal case. Microsoft says a user maps to a single Exchange mailbox, and a mailbox to a single user. The mail is signed with the signature your rules give that person.
  • Send as another user or queue. Microsoft says that to send from another person's or a queue's address, the sender needs the Send Email as Another User privilege, and the setting EnableMailboxDelegationForOutgoingEmail must be on for the mail to show as sent on behalf in Outlook. The sender then needs Full Access, Send As or Send on Behalf on the Exchange mailbox in the From field, or sending fails with errors such as ErrorSendAsDenied. Which signature Footer365 then uses depends on how it is sent for the other person. The wrong signature is used for a shared mailbox or delegate
  • A Microsoft 365 shared mailbox as a queue mailbox: the pages read do not say. Do not assume it works.

Step 3: Connect it in Dynamics 365

An administrator does this in the Power Platform admin center, following Microsoft's steps:

  1. Select Manage, then Environments, choose the environment, and select Settings.
  2. Expand Email, then select Server profiles, then New server profile.
  3. Set Email Server Type to Exchange Online, give the profile a name, and choose the Authentication Type above.
  4. Under Email settings, set Server Profile to the Exchange Online profile, and Incoming Email, Outgoing Email to Server-Side Synchronization.
  5. Under Mailboxes, select the mailboxes in Active Mailboxes, select Approve Email, then Test & Enable Mailbox.

If your Exchange Online is in the same tenant as your subscription, Dynamics creates a default profile named Microsoft Exchange Online. Microsoft's own steps: Connect to Exchange Online.

Step 4: Check one message

  1. Send an email from Dynamics 365 to an address outside your organisation that you can read. Microsoft says outgoing email is picked up every five minutes, so allow for that.
  2. Open the headers of the copy you receive.
  3. Return-Path should be the sender's own address, and X-Footer365-Relay-Id should be there.
  4. Look in the sender's Sent Items. Microsoft says it is saved there from server version 9.1.0000.16819, unless the organisation setting SSSSaveOutgoingEmailToExchangeSentFolder is false.

What other results mean: Mail from our CRM is not signed.

Where the signature goes

Dynamics email templates and the email composer have their own content, and Microsoft's pages read do not describe a signature setting that Dynamics adds to outgoing email. If you see two signatures, remove Dynamics's. To place Footer365's signature in a template, use a marker, and check one message, because the pages read do not say what Dynamics does with text in double braces. Place the signature with a marker

What is not signed

  • Customer Insights - Journeys email. Microsoft says domain authentication "confirms that your organization has approved Dynamics 365 Customer Insights - Journeys to send messages on its behalf", with a CNAME record "for Envelope-From (Return-Path) domain alignment". Microsoft's service sends this email with its own return path, not through your Exchange Online mailboxes, so Footer365 never sees it. Microsoft adds that the From address can be changed to an authenticated domain of the service. Microsoft: authenticate your domains
  • Email from a POP3 server profile. This guide does not cover it. The pages read do not say what envelope sender it uses.

What stops working

  • Cross-tenant profile and Exchange Web Services. Microsoft says: "Exchange Online is retiring EWS service in phases. Starting October 2026, only traffic from allowlisted tenants is allowed. EWS service is completely retired by April 2027. Power Platform is transitioning support for cross-tenant email sync functionality from EWS to Graph by April 2027." A cross-tenant profile needs the allow-list step and Graph application permissions that Microsoft lists on its page. Exchange Web Services is being switched off
  • The same-tenant profile: the pages read do not say whether it uses Exchange Web Services.
  • Sequences. Microsoft says an automated email step "is sent automatically without seller intervention", and that if Send Email as Another User is not enabled in the Power Platform admin center, "the automated email step fails and the sequence pauses."

Limits

Microsoft says: "Before creating bulk outgoing email messages, review your email service throttling limits", and that generating more outgoing email than your email service can take "can cause a backlog and a delay of new email messages from the same mailbox." For Exchange Online that is 10,000 recipients a day and 30 messages a minute for a mailbox. Microsoft also says that when several automated workflows owned by one user send as other users or queues, "just the one mailbox (the workflow owner's) will be used to send all these emails", so throttling can follow. Microsoft: Exchange Online limits

Last resort: a connector to Exchange Online

Dynamics 365 sends through its server-side synchronization, not through a connector you create, and the pages read describe no connector route. The pages read describe no connector for Customer Insights - Journeys, and Microsoft says SMTP relay cannot be used for a service hosted by someone else. So mail Dynamics sends from its own service cannot be signed. Last resort: a connector to Exchange Online

If it does not work

  1. The mailbox shows an error in the Power Platform admin center. Open the mailbox and read its Alerts, then select Test & Enable Mailbox again. Microsoft says the test shows the incoming and outgoing status on the mailbox record.
  2. Email does not leave. Check the mailbox is approved, and that outgoing email is set to Server-Side Synchronization.
  3. The message has no X-Footer365-Relay-Id. It did not pass through Microsoft 365. It may be Customer Insights - Journeys email.
  4. It passed through Footer365 but is unsigned. The signature was not added
  5. Still not clear. Mail from our CRM is not signed

Sources

Read on 23 October 2026:

Still stuck?

Tell us what you were trying to do and what you saw. Include the sender, a recipient and roughly when a message was sent, and we can trace it.

Contact support Service status