Follow the released sequence
Complete first run from the RelayBridge machine in one locally interactive Windows session. The management UI remains loopback-only; do not expose it to the LAN.
- Configure Microsoft 365.Create or verify the customer-owned Entra application, local certificate, Exchange service-principal reference, sender group, management scope, and scoped SMTP role. Activate only the verified candidate.
- Prepare printer connectivity.Open Settings, select the private LAN interface that devices can reach, review the generated configuration, and apply it through the UAC-elevated helper.
- Handle Windows Firewall manually.If a rule is required, use the generated narrow guidance for the Host executable, exact local address and port, Private profile, and device address or subnet.
- Add a device.Prefer Authenticated mode when the client supports AUTH LOGIN or AUTH PLAIN. Use Legacy mode only for a device that cannot authenticate and can be tightly isolated by source and sender.
- Configure the device.Use the displayed private server address, normally port 2525, connection security None, the exact authorized sender, and the one-time credentials when applicable.
- Send synthetic test mail.Use non-sensitive content. Confirm the device receives local SMTP acceptance, then separately confirm queue processing and the Exchange delivery result.
Understand the two success boundaries
| Observed result | What it means | What it does not mean |
|---|---|---|
Local SMTP 250 | RelayBridge durably stored the MIME payload and committed queue metadata on this host. | Exchange Online or the recipient inbox has accepted the message. |
Final Exchange 250 | Exchange Online accepted the upstream SMTP transaction. | Inbox placement, downstream delivery, or absence of later Microsoft policy handling is guaranteed. |
If first run stops
An existing active configuration remains in place while a replacement candidate is incomplete. Canceling Microsoft setup does not delete the active configuration or certificates. Resume only the exact unchanged candidate, and use the displayed safe stage, substage, category, and code as diagnostic evidence.
If printer Apply saved the configuration but did not confirm restart readiness, start or restart the RelayBridge Windows service and verify the selected listener and queue state. Do not repeatedly overwrite the production JSON.