# Create an Encryption Gateway Rule in Exchange Online for a Sensitivity Label

Do these steps to create a rule in Microsoft Exchange Online:

1. Go to the [Exchange Admin Center](https://admin.exchange.microsoft.com/).
2. Click on _mail_ **Mail flow** in the menu on the left.
3. Click on **Rules**.
4. Click on _add_ **Add a rule**.
5. Click on **Create a new rule**.
6. Enter `Zivver: Secure email based on classification + Outbound DLP` as the name of the rule.
7. Follow the instructions in this [manual](https://docs.microsoft.com/en-us/powershell/exchange/connect-to-scc-powershell?view=exchange-ps) from Microsoft to connect to Security & Compliance PowerShell.
8. Run the following [cmdlet](https://docs.microsoft.com/en-us/powershell/module/exchange/get-label?view=exchange-ps) to get the GUID of the sensitivity label you want to use.

_Replace `"Name"` with the name of the sensitivity label you want to use in the rule._

```powershell
Get-Label -Identity "Name" | Select-Object Guid
```

9. Go back to the Mail Flow Rule in the Exchange Admin Center.
10. Under **Apply this rule if \***, select **The sender**.
11. Under **Select one**, select **is external/internal**.

_A pop-up will appear asking you to select the type of recipient._
12. Select **Inside the organization**.
13. Click Save.
14. Click the _add_ button under the **Apply this rule if \*** section.
15. Under **And**, select **The sender**.
16. Under **Select one**, select **domain is**.
17. Enter every sending domain and click Add.
18. After all domains are added, click Save.
19. Click the _add_ button under the **Apply this rule if \*** section.
20. Under **And**, select **The message headers…**.
21. Under **Select one**, select **includes any of these words**.
22. Click **Enter text**.
23. Enter `msip_labels`.
24. Click Save.
25. Click **Enter words**.
26. Enter `MSIP_Label_<Guid>_Enabled=True`.

_Replace `<Guid>` with the GUID you retrieved from the PowerShell cmdlet._
27. Click Add.
28. Click Save.
29. Under **Do the following \***, select **Modify the message properties**.
30. Under **Select one**, select **set a message header**.
31. Click the first **Enter text** field.
32. Enter `zivver-relay`.
33. Click Save.
34. Click the second **Enter text** field.
35. Enter `smart-org`.
36. Click Save.
37. Click the _add_ button under the **Do the following \*** section.
38. Under **And**, select **Redirect the message to**.
39. Under **Select one**, select **the following connector**.
40. Select `Zivver Send Connector`.
41. Click Save.
42. Under **Except if**, select **The message headers…**.
43. Under **Select one**, select **matches these text patterns**.
44. Click **Enter text**.
45. Enter `skip-zivver-relay`.
46. Click Save.
47. Click **Enter words**.
48. Enter `true`.
49. Click Add.
50. Click Save.
51. Click Next.
52. Enable the option **Stop processing more rules**.
53. Enable the option **Defer the message if rule processing doesn’t complete**.
54. Set **Match sender address in message** to **Envelope**.
55. Enter the following text in the **Comments** section:

```plain
Send secure messages via Zivver based on your own information classification within Microsoft Exchange (e.g. a mail flow rule that looks for specific content in an email or attachments), Microsoft Purview (e.g. using sensitivity labels applied to attachments) or another application.
```

56. Click Next.
57. Click Finish.
58. Click Done.

The rule is created but not enabled yet. Please make sure that the priority of all existing rules is correct. If the sent message needs to be processed by other rules first, ensure that the rule created for the Encryption Gateway has a lower priority.

As the rule is not enabled yet, no outbound message that matches the filter will be submitted to the Zivver SMTP Server. Please enable the rule when you are sure all priorities are correct.

Updated on 2026-06-18