Organisation-Wide Email Signatures in Microsoft 365: Options

The simplest way to give every Microsoft 365 user the same signature is a mail flow rule that uses the Apply disclaimers action in the Exchange admin center. It adds your HTML signature to the bottom or top of messages as they pass through Exchange Online and can pull each sender's name, title and phone number from their directory properties. The trade-off is that the signature is added in transit, so it is not placed under the user's reply text and users do not see it while composing.

Who this is for and what you will have

This guide is for administrators of small and mid-sized Microsoft 365 tenants who want consistent signatures without manual setup on every device. By the end you will understand the options, have a working mail flow rule with sender tokens, know how to avoid duplicate signatures in threads, and know the alternatives when a rule is not enough.

The options at a glance

Microsoft's documentation describes the mail flow rule approach and notes that users can apply signatures to their own outgoing messages in Outlook or Outlook on the web. The per-mailbox settings come from the PowerShell references. The placement and Sent Items behaviour in the table follows from the rule running in transit, after the sender's client has finished with the message; it is a consequence of how the rule works rather than a documented limit. Third-party products are described only in general terms because their features differ.

Prerequisites

• A role that can manage mail flow rules (the "Mail flow" entry in the Exchange Online feature permissions).
• Exchange Online PowerShell if you want to script the rule. Connect with Connect-ExchangeOnline. If that fails, see /blog/connect-exchangeonline-errors-fix.
• Complete directory data. Sender tokens such as %%Title%% and %%Phone%% read values from each user's properties, so check them in the Microsoft 365 admin center before you roll out. A missing value produces a gap in the signature.
• A signature design in HTML, ideally simple. Disclaimer text can include HTML tags and inline CSS, and images can be added with the IMG tag, but email clients render complicated markup differently.

Create the mail flow rule in the admin center

1. Open the Exchange admin center at https://admin.exchange.microsoft.com and go to Mail flow > Rules.
2. Select Add a rule, then Apply disclaimers.
3. On Set rule conditions, enter a unique Name.
4. Under Apply this rule if, choose who gets the signature. To limit it to external mail, select The recipient > is external/internal, then Outside the organization. To apply it to everything that enters or leaves the organisation, choose Apply to all messages. By default, mail flow rules apply to incoming and outgoing messages, so add a condition if you only want outgoing mail signed.
5. Under Do the following, make sure Apply a disclaimer to the message and append a disclaimer are selected. Choose prepend a disclaimer instead to place the text at the top.
6. Select Enter text and paste your HTML signature.
7. Select Select one to set the fallback action (explained below).
8. Under Except if, add The subject or body > Subject or body matches these text patterns and enter a phrase that appears only in your signature. This stops the rule adding another copy on each reply.
9. On Set rule settings, leave Rule mode at Enforce or choose Test without Policy Tips first.
10. Review and select Finish.

Use sender tokens

The disclaimer text supports tokens that use values from the sender. Microsoft lists, among others, %%DisplayName%%, %%FirstName%%, %%LastName%%, %%Title%%, %%Department%%, %%Company%%, %%Office%%, %%Phone%%, %%MobilePhone%%, %%StreetAddress%%, %%City%%, %%PostalCode%%, %%UserPrincipalName%% and %%WindowsEmailAddress%%.

A sample signature body:

<p><strong>%%DisplayName%%</strong><br>
%%Title%%, %%Department%%<br>
Contoso Ltd<br>
T: %%Phone%% | M: %%MobilePhone%%<br>
<a href="https://www.contoso.com">www.contoso.com</a></p>

If a user has no value for a token, that part of the signature is blank, so a line such as M: %%MobilePhone%% may show an empty "M:". Keep optional fields on their own line or leave them out.

Create the same rule with PowerShell

New-TransportRule creates the rule. The Microsoft example adds an HTML disclaimer to messages sent outside the organisation:

New-TransportRule -Name "External Disclaimer" -SentToScope NotInOrganization -ApplyHtmlDisclaimerText "<h3>Disclaimer Title</h3><p>This is the disclaimer text.</p><img alt='Contoso logo' src='http://www.contoso.com/images/logo.gif'>"

To put the text at the top, add -ApplyHtmlDisclaimerLocation Prepend. To set the fallback, use -ApplyHtmlDisclaimerFallbackAction. Pointing the image at an address on your own website over HTTPS is safer than the plain HTTP address used in the sample, and gives recipients' mail clients a chance to load it.

A fuller version for outbound mail with the duplicate-prevention exception might look like this. The -ExceptIfSubjectOrBodyMatchesPatterns parameter is the PowerShell counterpart of the exception in the admin center. Test the rule on a few messages before enforcing it:

New-TransportRule -Name "Company signature" `
  -SentToScope NotInOrganization `
  -ApplyHtmlDisclaimerLocation Append `
  -ApplyHtmlDisclaimerFallbackAction Wrap `
  -ApplyHtmlDisclaimerText "<p><strong>%%DisplayName%%</strong><br>%%Title%%<br>Contoso Ltd</p>" `
  -ExceptIfSubjectOrBodyMatchesPatterns "Contoso Ltd"

Choose the fallback action

If the rule cannot modify a message, for example because it is encrypted, the fallback option decides what happens:

Microsoft warns not to use Wrap in rules that affect incoming messages from external senders, because it interferes with Safe Attachments scanning, and to use Reject instead. To find rules that already do this, run:

Get-TransportRule | where {$_.ApplyHTMLDisclaimerFallbackAction -eq 'Wrap' -and $_.FromScope -eq 'NotInOrganization'}

For an outbound-only signature, Ignore is often the least disruptive choice, since a missing signature on an encrypted message is usually acceptable. Decide this deliberately.

Also remember that when Wrap is used, later rules examine the new wrapper message rather than the original. Microsoft advises giving other rules a higher priority than the disclaimer rule so they run first.

Alternative: per-mailbox signatures for Outlook on the web

If you want signatures that appear in the normal position and in Sent Items, you can configure them per mailbox. This applies to Outlook on the web and the new Outlook for Windows only. The Set-MailboxMessageConfiguration reference states that these settings are applied in Outlook on the web and that some also apply to the new Outlook client, and are not used in Outlook (classic), Exchange ActiveSync or other clients.

Roaming signatures in Outlook on the web and the new Outlook must be switched off first. The PostponeRoamingSignaturesUntilLater parameter of Set-OrganizationConfig controls this, with $true disabling roaming signatures. Its reference notes that for Windows clients the registry setting to disable roaming signatures still works, and that when roaming signatures are disabled, admins can use the signature-related parameters on Set-MailboxMessageConfiguration, such as AutoAddSignature, AutoAddSignatureOnReply and SignatureHtml. It also says Microsoft has no plans to support roaming signature management in Microsoft Graph.

Set-OrganizationConfig -PostponeRoamingSignaturesUntilLater $true
 
Set-MailboxMessageConfiguration -Identity [email protected] `
  -SignatureHtml "<p><strong>Ayla Demir</strong><br>Operations Manager<br>Contoso Ltd</p>" `
  -AutoAddSignature $true `
  -AutoAddSignatureOnReply $true

Because this is per mailbox, you would loop over users and build the HTML from their directory properties yourself, and it affects only the web and new Outlook clients. Test with one pilot mailbox first before rolling it out.

Other approaches

Independent software vendors are encouraged by Microsoft to use the Outlook signature API with event-based add-in hooks, and third-party signature services exist that build on it or on mail flow. Evaluate any of these on their own documentation and pricing: whether they insert the signature under the reply text, support banners and campaigns, and handle mobile clients. This guide does not compare vendors.

Test the rule

Microsoft's verification steps are:

1. Send yourself both a plain text email and an HTML email that match the conditions and exceptions, and confirm the signature appears as intended.
2. Forward those messages to yourself to verify you do not get a second copy of the signature. Replying to them is a sensible extra check.
3. Send messages that should not match, such as internal messages if the rule is external only, and confirm they are untouched.

It is also worth opening the results in a few mail clients, including a phone, because HTML renders differently between them.

Use Get-MessageTraceV2 or the message trace feature if a message did not behave as expected. See /blog/message-trace-exchange-online-get-messagetracev2.

Troubleshooting

The signature appears more than once in a thread

The exception is missing or does not match. Add an exception on the subject or body with a distinctive phrase from the signature, such as the company line.

Users do not see the signature when composing

This is expected with a mail flow rule. The text is added after the message leaves the user's client, so it is not in the compose window or in the saved Sent Items copy. Recipients receive it.

Tokens show as blank

The user's directory attribute is empty. Fill in the properties for the user, then send a new test message.

Other rules do not act on messages that carry the signature

If the fallback action is Wrap, the original message may be wrapped as an attachment. Review rule priorities as described above, or choose a different fallback.

Messages are returned with a non-delivery report

The fallback is set to Reject and the rule could not modify the message, for example an encrypted one. Change the fallback to Ignore if you would rather deliver without the signature.

Signature settings on a mailbox do not stick

Check that roaming signatures are disabled for the organisation and wait for the setting to apply. Remember that the PowerShell signature settings do not drive classic Outlook.

Checklist

• Decide between a mail flow rule (central, appended or prepended) and per-mailbox settings (web and new Outlook only).
• Clean up user properties used by the sender tokens.
• Build a simple HTML signature and host any image on your own HTTPS site.
• Add a condition for outbound mail and an exception for duplicates.
• Choose the fallback action deliberately and review existing Wrap rules.
• Run the rule in test mode, then enforce it.
• Send test messages, replies and forwards from several clients.

For more on how rules are evaluated and ordered, see /blog/exchange-online-mail-flow-rules-guide.

References

• Organization-wide message disclaimers, signatures, footers, or headers in Exchange Online: https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/disclaimers-signatures-footers-or-headers
• Set-OrganizationConfig: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig
• Set-MailboxMessageConfiguration: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-mailboxmessageconfiguration
• New-TransportRule: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule