RelayBridge

Microsoft 365

Microsoft 365 setup

Use the released RelayBridge wizard to create or verify a customer-owned Entra application, certificate identity, Exchange RBAC scope, and one authorized sender.

v1.0.0-rc.1 · PreviewUnsigned public release candidate for evaluation and community testing. A signed stable release is not yet available.Release status

Open setup locally

Use the RelayBridge desktop shortcut on the installed machine. The wizard is served from the loopback management interface; the usual setup route is http://localhost:5080/setup/microsoft, but administrators should let the installed opener resolve the published endpoint rather than construct URLs manually.

Administrator authentication is not the runtime credential

Microsoft administration uses interactive Microsoft authentication in a short-lived setup chain. RelayBridge does not ask for or persist the administrator password or delegated administrator token. The Windows service later authenticates as the customer-owned application with the local certificate.

Complete the new-application flow

  1. Review the welcome and current state.Confirm whether you are creating the first configuration or preparing a replacement candidate.
  2. Create or select the local certificate.Only the public certificate is exported for Entra registration.
  3. Enter one authorized sender.Choose a real Exchange Online mailbox that RelayBridge will be allowed to send as.
  4. Approve the candidate summary.Start the native setup experience only after reviewing the fixed tenant, application, certificate, and sender candidate.
  5. Authenticate for Entra.Use interactive Windows Web Account Manager authentication when prompted.
  6. Let RelayBridge create or verify the application identity.The wizard handles the customer-owned single-tenant application and tenant-local service principal.
  7. Authenticate for Exchange when required.The Exchange administration stage is separate and can present its own Microsoft authentication UI.
  8. Create or verify sender-scoped authorization.The wizard manages the Exchange service-principal reference, sender group, management scope, and scoped Application SMTP.SendAsApp assignment.
  9. Verify the complete path.RelayBridge validates the certificate, application token, TLS, XOAUTH2, sender authorization, and final SMTP acceptance.
  10. Activate only after success.The successfully verified candidate becomes active atomically.

Candidate and resume safety

A working active configuration remains active while a replacement or repair candidate is incomplete. Canceling setup does not delete the active configuration or its certificates.

A completed Entra result can be reused only for the exact unchanged candidate. Exchange remains a separate stage. Setup validates object identity and RelayBridge ownership markers before reuse, and conflicting or unexpectedly broadened objects fail instead of being silently overwritten.

After a normal service restart, persisted Microsoft configuration remains, but current-process verification evidence resets. If the UI reports Verification required, use the direct verification path for the active configuration.

Related explanations

Identity and certificateUnderstand the Entra application, service principal, certificate, and runtime boundary.Exchange RBACSee how RelayBridge scopes SMTP authorization to the selected sender.Step 5 verificationUse the bounded automatic session when the exact eligible SMTP 535 condition occurs.Security Defaults and SMTP AUTHUnderstand tenant policy independently from OAuth and RelayBridge setup.