Use this guide to connect your Microsoft 365 tenant and centrally deploy Tapt email signatures to Outlook. Complete a pilot before making the add-in available to everyone in your organisation.
What the integration does
Tapt uses a compose-time Outlook add-in. When an eligible user starts a new online message, the add-in retrieves that user's current Tapt signature and inserts it into the draft.
The integration does not replace Outlook's native signature settings, modify existing drafts or send email.
Before you begin
Arrange a short setup session between your Tapt organisation administrator and Microsoft 365 IT administrator. You need:
A Microsoft 365 work or school tenant that uses Exchange Online.
A Microsoft 365 Global Administrator to complete the consent flow.
A Tapt organisation administrator who can open Settings > Integrations.
A pilot user or group whose primary email address matches an active Tapt profile.
Access to Microsoft 365 Integrated Apps.
Tip: Start with a dedicated pilot group. Microsoft recommends a phased rollout before assigning an Office add-in to your whole organisation. Adding or removing a group member updates their add-in access automatically.
Permissions requested
During setup, the Microsoft 365 administrator approves two Microsoft applications. Check the tenant name, application name and application ID before accepting.
1. Tapt Email Signatures API
Application ID: `b80a4aa2-38f7-4eae-bc77-888c94ff45e6`
Permission | Type | Purpose |
`Organization.Read.All` | Microsoft Graph application | Read the tenant ID, display name and verified domains. |
`User.Read.All` | Microsoft Graph application | Read user IDs, names, primary email addresses, user principal names and enabled status for profile matching. |
`User.Read` | Microsoft Graph delegated | Identify the administrator during Microsoft sign-in. |
Application permissions allow Tapt to refresh directory matches without an administrator remaining signed in. Requests are limited to the approved tenant. Tapt does not store an administrator or user refresh token.
2. Tapt Outlook Signature Add-in
Application ID: `076d10ba-47f7-40f5-b009-faf15f799eeb`
Permission | Type | Purpose |
`Signature.Read` | Tapt API delegated | Allow the signed-in Outlook user to retrieve their matched current Tapt signature. |
The deployment manifest declares Outlook's `ReadWriteItem` permission. This lets the add-in check the current compose sender and insert the signature into the message body. It does not read inbox messages, recipients, attachments, calendars or contacts, and it does not send email.
Connect Microsoft 365 to Tapt
Complete these steps in the Tapt Dashboard.
Sign in as a Tapt organisation administrator.
Go to Settings > Integrations and select Outlook under Email signatures.
Select Connect Microsoft 365.
In the Microsoft pop-up, sign in with a Global Administrator account for the customer tenant.
Review and approve directory access for Tapt Email Signatures API.
Review and approve `Signature.Read` for Tapt Outlook Signature Add-in.
Return to Tapt and confirm the integration shows Connected, the expected Entra tenant ID and authorised Microsoft permissions.
Important: Both approvals must complete in the same protected setup flow. If the pop-up closes or consent is declined, start Connect Microsoft 365 again. Tapt does not mark the tenant ready until both approvals are validated for the same tenant.
Deploy the Outlook add-in
Complete these steps in the Microsoft 365 admin centre. Use the manifest shown in the production Tapt environment.
Important: Open the manifest URL and confirm it returns XML beginning with <?xml. If it opens the Tapt Dashboard instead, stop and contact Tapt Support.
In Tapt, copy the production manifest URL: `https://platform.tapt.io/outlook/manifest.xml`. Alternatively, select Download XML manifest and provide the file to your Microsoft 365 administrator.
In the Microsoft 365 admin centre, go to Show all > Settings > Integrated apps.
Open Add-ins, select Deploy Add-in and continue through the wizard.
Select the custom add-in option.
Select Provide link to manifest file and paste the URL, or select Upload manifest file and choose the XML file from Tapt.
Assign the add-in to Specific users/groups and select the pilot group.
Review the deployment and select Deploy.
Wait for Microsoft provisioning to complete, then ask pilot users to restart Outlook.
Note: Microsoft advises that centrally deployed add-ins can take 24–72 hours to appear. The manifest contains public add-in configuration only; it does not contain a client secret.
Match users and enable signature delivery
Return to the Tapt Dashboard.
Go to Settings > Integrations > Outlook.
Check that Compose-time updates is turned on, then save any change.
Select Rescan directory.
Confirm Matched profiles includes the pilot users.
Tapt matches active Microsoft 365 users to active Tapt profiles by exact primary email address. Email matching is case-insensitive. A user without a match does not receive a signature.
Validate the pilot
For each pilot user:
Sign in to a supported Outlook client with the assigned Microsoft 365 work account.
Restart Outlook after the add-in is provisioned.
Start a new online email. Do not reuse an existing draft.
Confirm the selected From address is the signed-in user's primary mailbox.
Confirm the current Tapt signature appears in the compose body.
Send a message to an internal test recipient and check its rendering.
Note: The add-in fails open. Authentication, network or insertion errors skip the signature rather than blocking the draft.
The add-in intentionally skips existing drafts, offline compose and messages whose selected From address differs from the signed-in mailbox. Shared and delegated mailbox scenarios are not modified.
Roll out to the organisation
After the pilot is approved:
In Microsoft 365 admin centre > Settings > Integrated apps, select Tapt Email Signatures.
Open Users, add the approved production group and select Update.
In Tapt, run Rescan directory and check the matched-profile count.
Tell users that provisioning can take 24–72 hours and that they may need to restart Outlook.
Security controls
At compose time, Outlook silently obtains a short-lived Microsoft access token for the signed-in user. Tapt verifies the token's Microsoft signature, issuer, tenant, audience, authorised add-in client, expiry and `Signature.Read` scope.
Tapt then verifies that:
The Microsoft tenant is connected to the Tapt organisation.
Compose-time updates is turned on.
The Microsoft user and email in the token match an active mapped Tapt profile.
The requested signature belongs to that user.
Only then does Tapt return rendered signature HTML. The add-in checks the From address again before inserting it. No Tapt or Microsoft client secret is placed in the browser or deployment manifest.
Disable or remove the integration
For a staged pause, remove users or groups from the add-in assignment in Microsoft 365 admin centre > Settings > Integrated apps > Tapt Email Signatures > Users.
To remove the integration completely:
In Tapt, go to Settings > Integrations > Outlook and select Disconnect. This stops directory reconciliation and future signature retrieval.
In Microsoft 365 Integrated Apps, select Tapt Email Signatures and remove the app, or remove every assigned user and group.
If required by your security policy, revoke the enterprise application grants for Tapt Email Signatures API and Tapt Outlook Signature Add-in in Microsoft Entra.
Important: Disconnecting or removing the add-in does not alter signatures already inserted into drafts or sent messages. It also does not change users' native Outlook signature settings.
Troubleshooting
Symptom | What to check |
Microsoft authorisation fails | Use a Global Administrator from the customer tenant, allow pop-ups and run the complete connection flow again. |
Custom add-in upload is unavailable | Confirm the account can access Microsoft 365 Integrated Apps and that centralised deployment is supported. |
Add-in does not appear | Confirm the assignment to the user or group, wait up to 72 hours, then restart Outlook. |
Add-in appears but no signature is inserted | Confirm Compose-time updates is turned on, rescan the directory, and check for an active Tapt profile with the same primary email address. |
A shared mailbox or different From address is used | Retest from the signed-in user's primary mailbox. These scenarios are intentionally skipped. |
An existing draft is unchanged | Start a new online message. The add-in does not modify existing drafts. |
Permissions were changed or revoked | In Tapt, select Refresh Microsoft permissions, complete both approvals and rescan the directory. |
Contact Tapt Support
When you contact Tapt Support, include your Tapt organisation name, the Microsoft tenant ID shown in the integration, the affected user's email address, their Outlook client and the test time.
Important: Do not send access tokens, passwords or client secrets to Tapt Support.
Still need help?
We’ll help you find the answer. Contact the Tapt Support team at support@tapt.io.