GUARD HQ by Code13 Inc.

MailGuard for Microsoft 365

Tenant administrator runbook

A clean-tenant path from organization setup to a controlled pilot. Do not use this page to change production hosting, credentials, certificates, or Microsoft tenant settings outside your organization’s approved change process.

1. Create and bind the organization

  1. Open Start MailGuard for Microsoft 365.
  2. Use the organization’s Microsoft 365 work or school account and complete MailGuard activation.
  3. Confirm the resulting dashboard identifies the intended organization. Stop if Microsoft presents a personal account or another organization.

A Microsoft sign-in alone does not enroll users. MailGuard binds identities to the organization and requires controlled administrator provisioning.

2. Provision the pilot users

  1. In the tenant-scoped dashboard, use Provision pilot users.
  2. Create one pending invitation per work or school mailbox, with the intended MailGuard role.
  3. Verify each invitation matches the user’s Microsoft UPN. Do not use aliases, personal Microsoft accounts, or a tenant domain as a substitute for a user identity.

3. Deploy the approved manifest

  1. Open Deploy MailGuard to Microsoft 365, download the manifest and checksum, and record the checksum.
  2. In Microsoft 365 Integrated apps, upload that manifest and assign only the selected pilot users or a non-nested pilot group.
  3. Allow Microsoft 365 propagation. Do not sideload a local manifest for a customer pilot.

4. Activate one user and validate supported clients

  1. Open a message in Classic Outlook for Windows, New Outlook, Outlook on the web, or Outlook for Mac. MailGuard has been used successfully in each of those clients.
  2. Sign in with the invited Microsoft identity. Record the client, version, time, and result for this organization. Current production Microsoft sign-in and a Trusted verdict have been successfully validated in Classic Outlook for Windows.
  3. Outlook mobile is not part of that validation yet.

5. Verify the Security Coach and support path

  1. Capture sanitized evidence for Trusted, Verify Before Action, and Do Not Trust guidance; do not include email content, tokens, or passwords.
  2. Confirm the user can use the documented escalation path and the administrator can distinguish deployment, task-pane, sign-in, and scan failures.
  3. If Outlook cannot load the add-in, collect the exact error, client/version, assignment, time, and task-pane URL. Do not change tenant settings, certificates, credentials, or the manifest while collecting evidence.

6. Pilot entry gate

Complete the tenant’s pilot evidence record with Code13 before adding users beyond the controlled group. Pilot entry also requires the approved hosted cold-reboot recovery gate; a previous successful Outlook session is not proof that the hosted stack will recover after reboot.