Mesh Unified
This guide outlines how to install Mesh Unified for organizations on Microsoft 365.
Tip: If this is your first time setting up a customer in Mesh (or even if it’s not), it is worthwhile familiarizing yourself with this checklist ⟶ Before You Start Checklist
Tip
Installation Time: 10-15 minutes
Step 1: Create a Mail Flow for Rule for Mesh in Microsoft 365
In order to allow email filtered by Mesh to be delivered safely without any double filtering from Microsoft, you need to create a mail flow rule in Microsoft 365 for our IP ranges.
This video walks you through the process step by step:
https://youtu.be/JXiK0Ja1NXE?si=GiD2hRsSTE-Oe7Ld
Ensure that the IP ranges applicable to your region are used. You can find this here
View our step by step guide on creating a mail flow rule.
Visit Microsoft’s documentation on this here
Step 2: Populating Users via Azure Sync
In order to allow users to receive quarantine digests and to be able to create their own allow/block rules, users need to be populated in the users table.
Login as Customer and navigate to Users ⟶ Import & Sync ⟶ Azure Sync
Select "O365 Authorize" to permit Mesh to sync the users from Azure.
View more information on user population and role types.
The Azure sync will automatically run every hour. For any mailboxes synced that do not require an account in Mesh, please select and set to “disable”
Note
Important: API level filtering will be enabled after this authorization step has been completed.
Step 3: Import Allow & Block Rules (optional)
You can import a list of safe senders or domains using our CSV template.
Step 4: Update your MX records
Update your MX records with the values applicable to your service region.
MX records are region specific and there should be no other records present.
If you use MTA-STS, ensure you also update the MX entries there.
Note
Important: Please wait at least 15 minutes after creating your account in Mesh before updating your MX records to ensure there is no interruption to delivery while our system updates.
Step 5: Create A Connector in Microsoft 365
In order to prevent threats from bypassing Mesh filtering and ensuring emails from our MTAs can deliver to your mail environment, you should create a Connector for Mesh in Microsoft 365.
Note
Important:
Only complete this step after you point your MX records to Mesh. We recommend waiting 24 hours to allow for DNS propagation.
If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.
You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected.
This video walks you through the process step by step:
Ensure that the IP ranges applicable to your region are used. You can find this here.
View our step by step guide on creating a connector.
Step 6: Enable Outbound Email Scanning (Optional)
View our step-by-step guide on enabling our outbound email scanning.
Note
If your tenant uses an autoforward in some capacity, please ensure you read the above guide.
![]() |
Step 7: Configure Report Junk & Phishing Button (Optional)
The Outlook report button can be utilised to share potential false negatives / false positives with your helpdesk and the Mesh detection team. View our step-by-step guide.
![]() |
Tip
You’re all set. Your email is now protected by Mesh Unified.
Related articles
Page: Configure Outbound Filtering for Mesh in Office 365/Exchange Admin
Page: Help Center Stylesheet
Upgrade to Mesh Unified
Upgrading from Mesh Gateway
Upgrading to Mesh Unified will provide access to our full suite of features:
Auto & Manual Remediation. More info: Auto Remediate & Manual Remediate
Warning Banners: Verdict & Contextual. More Info: Banners
Flexible policy options: Utilise the junk folder in Microsoft 365/Outlook. More info: Policy Settings
Honor allow/block rules created in Microsoft 365/Outlook. More info: Safe/Blocked Senders
Insider Threat Protection via internal traffic scanning.
Note
Mesh Unified is only available if the tenant’s mail platform is Microsoft 365 / Office 365
Note
Important information before you upgrade:
Monitor Mode is NOT available on Mesh Unified.
This upgrade will override any existing policies.
You cannot swap between services once upgraded.
Step 1: Create a Mesh Unified Policy Template
Ensure that you have created a Mesh Unified policy template. More info: Policy Templates & Policies
Step 2: Click Upgrade
Click upgrade and select your policy template.
![]() |
![]() |
Step 3: Follow Our Mesh Unified Setup Guide
There is a lot of overlap between the setup of Mesh Gateway and Mesh Unified which means the configuration should be quite quick. To ensure all necessary steps are complete, follow our guide here: Mesh Unified
Upgrading from Mesh 365
Upgrading to Mesh Unified will provide access to our full suite of Gateway features:
Outbound scanning via our smarthost.
SPF/DKIM/DMARC validation.
Email spooling.
Remove/Bypass Microsoft’s spam filtering.
Note
Important information before you upgrade:
Monitor Mode is NOT available on Mesh Unified.
This upgrade will override any existing policies.
You cannot swap between services once upgraded.
Wait 15 minutes before updating your MX records.
Step 1: Create a Mesh Unified Policy Template
Ensure that you have created a Mesh Unified policy template. More info: Policy Templates & Policies
Step 2: Click Upgrade
Click upgrade and select your policy template.
![]() |
![]() |
Step 3: Follow Our Mesh Unified Setup Guide
For Mesh Unified to function as intended, you will need to complete all steps shown on our guide here: Mesh Unified
Related Articles
Page: Mesh Gateway for all other email platforms (Mesh Help Center)
inbound
Page: Mesh Gateway for Exchange (Mesh Help Center)
inbound
Page: Mesh Gateway for Google Workspace (Mesh Help Center)
inbound
Page: Mesh Gateway for Microsoft 365 (Mesh Help Center)
inbound
Page: Mesh Unified (Mesh Help Center)
inbound