Setup guide

Set up Outlook auto-forwarding

Add a server-side rule in Outlook so project email flows into Shield automatically, even when your laptop is closed. Five minutes per project. Works on Microsoft 365 (Office 365), Exchange Online and Exchange 2019.

Server-side vs client-side — why this matters

Outlook has two kinds of rules:

Client-side rules only run when the desktop Outlook app is open on your laptop. Close the lid on Friday and any email arriving over the weekend never forwards. Your evidence chain has gaps.
Server-side rules run on Microsoft's mail servers regardless of whether any device is online. The rule we configure below is a server-side rule — this is essential for evidence integrity.

The instructions below use Outlook on the web (outlook.office.com), which always produces server-side rules. If you set the rule from the Outlook desktop app, it may default to client-side.

Before you start

You'll need:

Your Shield project forwarding address (looks like riverside-tower-a8c2@shieldindex.ai).
The contractor's email domain (for example @hexagon.com).
Sign-in to outlook.office.com with your work account.

If your IT team has blocked external auto-forwarding at the tenant level (some Microsoft 365 tenants do this for anti-phishing reasons), see Troubleshooting below.

Step 1 — Open rules in Outlook on the web

Go to outlook.office.com and sign in.

Click the gear icon (top right) → View all Outlook settings → Mail → Rules.

Click Add new rule.

Step 2 — Name the rule

Give the rule a clear name so future-you knows what it does. Suggested format:

Shield — Riverside Tower — Hexagon

Step 3 — Set the condition

Under Add a condition, pick From. Enter the contractor's domain in the format Outlook accepts:

hexagon.com

If you want to narrow the rule to specific senders (e.g. just the QS, not the wider project team), use individual email addresses instead, separated by clicking Add another.

For multi-project tenants, you can stack a second condition — Subject includes — with your project name or reference (e.g. "Riverside" or "R-2025"). This stops mail about other projects routing to the wrong Shield inbox.

Step 4 — Set the action

Under Add an action, pick Redirect to. (Don't pick Forward to — redirect preserves the original sender headers, which matters for evidence integrity.)

Enter your Shield project forwarding address:

riverside-tower-a8c2@shieldindex.ai

You can optionally add a second action: Mark as read, or Move to a folder. We recommend leaving the message in your inbox unread so you stay in the loop on what your team is seeing.

Step 5 — Save and test

Click Save. Outlook applies the rule to all new mail immediately.

Send a test from a colleague at @hexagon.com (or ask the contractor for a quick "received, thanks" reply on any thread). Within 60 seconds you should see the email appear in the project email list inside Shield, classified and severity-tagged.

Step 6 — Repeat per project

For each additional project, repeat steps 1–5 with that project's Shield address. We recommend one rule per project per contractor domain.

If you have several main contractors on one project (rare but possible), one rule per contractor — all routing to the same project Shield address.

Troubleshooting

"This rule has been disabled" message. Some Microsoft 365 tenants block external auto-forwarding by default. Your IT admin needs to add Shield's inbound domain to the tenant allow-list. The technical name is the Anti-spam outbound policy in Microsoft Defender for Office 365. Send your IT contact this email address to allow:

*@shieldindex.ai

Once allow-listed, re-enable the rule from the same Rules page.

Rule fires only sometimes. You likely set the rule from the desktop Outlook app, which defaulted to client-side. Re-create it via outlook.office.com following the steps above.

Test emails forward but don't classify. Make sure your Shield subscription is active — classifications pause if a trial expires without conversion.

What about Phase 2 OAuth? The Outlook server-side rule is the current best option. Phase 2 of the Shield roadmap is a "Connect Outlook" OAuth button — one consent in Entra ID and Shield reads project email natively with DKIM signatures intact. That ships post-demo. Until then, the rule above is the right setup.

Tenant restrictions or IT-policy questions? We'll talk to your admin.

Email support