WiseStamp for IT › Exchange › Step 2 of 12 — Prerequisites Checklist
Audience: IT manager / system administrator. Complete this before Identity & Employee Sync.
1. Administrative access
Requirement | Applies to | Notes |
Microsoft 365 Global Administrator | All | Required for Entra ID integration, Add-In central deployment, and server-side connector authorization. Sign into Microsoft in a separate tab before starting. |
Exchange admin access to Mail flow > Connectors and Rules | Server-side | Required to create/verify connectors and transport rules in the Exchange admin center. |
WiseStamp Owner or Admin role | All | Access the Integrations page. See Permissions Reference. |
2. WiseStamp plan
Method | Minimum plan |
Outlook Add-In + Entra ID employee sync | Basic |
Server-side routing + signature rules | Platform |
SSO (SAML) | Platform |
Security Group sync | Enterprise (or trial) |
3. Topology & mailbox requirements
Requirement | Applies to | Notes |
Exchange Online with active mailboxes | Add-In | The Add-In requires Exchange Online mailboxes. |
Directory in or federated to Entra ID | All | Required for directory sync and Add-In identity. An environment with no Microsoft 365 tenant is not supported on any plan. |
Outbound mail egress via Exchange Online | Hybrid | Server-side routing is documented at the Exchange Online egress point. |
Supported Outlook clients (Add-In)
Microsoft 365 Business (Standard/Premium) v1701+
Office 365 Enterprise (E1/E3/E5/F3) v1701+
Microsoft 365 Enterprise (E3/E5/F3) v1701+
Office for Mac 16.0.9318.1000+
Outlook mobile iOS 2.75.0+ / Android 2.2.145+
Outlook on the web
Note: build minimums are from the help center and undated. WiseStamp could not confirm a specific verification date but believes these floors are still correct.
4. Email authentication (DNS) — server-side
Requirement | Notes |
SPF | Add include:outbound.smtp.wisestamp.net to your sending domains' SPF before routing through WiseStamp. |
DKIM | Routing through WiseStamp can break existing DKIM. WiseStamp issues a unique DKIM record per account — request it from support, add as TXT, then have support enable signing. Verify dkim=pass. |
5. Network / firewall allowlist — server-side
Server-side routing references these WiseStamp hostnames:
Outbound target: ms.smtp.wisestamp.net (prefixed with your tenant routing code, e.g. <routing-code>.ms.smtp.wisestamp.net)
Inbound authenticating domain: outbound.smtp.wisestamp.net
IP ranges (Exchange Online and hybrid):
104.198.34.229
34.133.172.126
35.224.156.40
34.173.9.51
35.225.126.165
34.173.64.165
Normally clients don’t need to add these IPs anywhere — hostname-based connectors/rules are sufficient — unless you run a spam-filtering service (e.g., Barracuda) in front of Exchange, in which case allowlist your domain or these IPs on that service.
6. Pre-flight checklist
☐ Topology identified (Exchange Online / hybrid).
☐ WiseStamp plan supports the intended method.
☐ Microsoft 365 Global Admin confirmed.
☐ Exchange admin access to Mail flow (server-side).
☐ WiseStamp Owner/Admin access confirmed.
☐ (Add-In) Exchange Online mailboxes; Outlook builds meet minimums.
☐ (Server-side) SPF updated; DKIM record requested/added; signing enabled.
☐ (Server-side) Allowlist hostnames in place; IP list added if required (see IP ranges above).