Connect an on-premises Exchange Server

The connector reads folders, recent message summaries and selected message text through IMAP4. Header search covers a bounded recent window. Sending one plain-text email through SMTP always requires your approval. Calendar, contacts, attachments, HTML composition and mailbox changes are outside this connector; those would need a separate Exchange integration.

Identify the Exchange version, patch level and mailbox first. Microsoft documents these procedures for Exchange Server 2016, 2019 and Subscription Edition; support for 2016 and 2019 ended in October 2025. The mailbox needs permitted IMAP and authenticated SMTP sign-in using a username and password. This connector does not implement NTLM or ADFS/OAuth. Use IMAP port 993 with TLS and SMTP port 587 with mandatory STARTTLS. The certificate must match each entered DNS name and be trusted by the anymize runtime.

Direct connection requires both DNS names to resolve to allowed public IP addresses and both ports to be reachable from the anymize server. Access from a laptop inside the company network is not sufficient. If Exchange is reachable only on a private LAN or VPN, direct connection is not currently supported; arrange a customer-specific restricted network path with the anymize team. Do not expose internal addresses by disabling the public-host guard.

In the Exchange Management Shell, inspect the IMAP services and settings. Start MSExchangeIMAP4 and MSExchangeIMAP4BE and set both services to automatic if they are stopped. Configure the external FQDN for port 993 with Set-ImapSettings, then restart both services. Substitute your real DNS name in the command and verify the result with Get-ImapSettings. Exchange's SSL setting here means immediate TLS, not an instruction to enable obsolete SSL protocol versions.

Get-Service MSExchangeIMAP4,MSExchangeIMAP4BE | Format-Table Name,Status,StartType
Get-ImapSettings | Format-List Server,LoginType,*ConnectionSettings,*Bindings,X509CertificateName

Start-Service MSExchangeIMAP4; Start-Service MSExchangeIMAP4BE
Set-Service MSExchangeIMAP4 -StartupType Automatic; Set-Service MSExchangeIMAP4BE -StartupType Automatic

Set-ImapSettings -ExternalConnectionSettings "mail.example.org:993:SSL" -X509CertificateName mail.example.org
Restart-Service MSExchangeIMAP4; Restart-Service MSExchangeIMAP4BE
Get-ImapSettings | Format-List *ConnectionSettings,*Bindings,X509CertificateName

Check the intended mailbox with Get-CASMailbox and its IMAP sign-in policy. In the Exchange Admin Center, go to Recipients > Mailboxes > select mailbox > Edit > Mailbox Features > Email Connectivity to enable IMAP for that mailbox after internal approval. An administrator can also use Set-CASMailbox, then restart the IMAP services as Microsoft describes. Confirm the user format and password with a test mailbox. A deployment that permits only NTLM or OAuth cannot use this connector in its present form.

Get-CASMailbox -Identity "mailbox@example.org" | Format-List PrimarySmtpAddress,ImapEnabled
Get-ImapSettings | Format-List LoginType

Set-CASMailbox -Identity "mailbox@example.org" -ImapEnabled $true
Restart-Service MSExchangeIMAP4; Restart-Service MSExchangeIMAP4BE

Inspect Exchange certificates and their assigned services. The certificate must contain the exact public IMAP or SMTP hostname, be valid, and present a trusted chain. In the Exchange Admin Center, go to Servers > Certificates > select server and certificate > Edit > Services to assign a suitable named or SAN certificate to IMAP or SMTP. A service assignment is replaced with another certificate rather than simply removed. Microsoft documents a different IMAP procedure for wildcard certificates using X509CertificateName; do not assign a wildcard certificate directly to IMAP without reviewing that procedure.

Get-ExchangeCertificate | Format-List Thumbprint,Subject,CertificateDomains,Services,NotAfter

The default Client Frontend Receive Connector accepts authenticated client submission on port 587 with STARTTLS. In the Exchange Admin Center, go to Mail flow > Receive connectors > Client Frontend <ServerName> > Edit > Scoping to inspect its FQDN. Review its bindings, authentication mechanisms and TLS certificate before changing a shared connector; TlsCertificateName is set in the Exchange Management Shell. Port 25 is for mail transport, not this client connection, and port 465 is not the default for Exchange's Client Frontend connector. anymize also uses the SMTP username as the sender address, so enter an email address the mailbox may send from. A server that only accepts DOMAIN\user for SMTP sign-in cannot send through this connector version.

Get-ReceiveConnector -Identity "EX01\Client Frontend EX01" | Format-List Name,Bindings,Fqdn,AuthMechanism,PermissionGroups,TlsCertificateName

Get-ReceiveConnector -Identity "Client Frontend*" | Format-List Name,Fqdn,TlsCertificateName
Get-ExchangeCertificate | Format-List Thumbprint,Issuer,Subject,CertificateDomains,Services

Open Apps, Connectors, Exchange Server (On-Premises). Enter the public IMAP DNS name, port 993 and mailbox credentials. Enter the SMTP DNS name, port 587 and its credentials, then select Connect. anymize checks both target names, tests encrypted IMAP and verifies SMTP without sending a message. Both protocols must pass, even if you initially only want to read. Enable the connector's mail permission in chat; every actual send still asks for approval.

Check that both IMAP services run and Get-ImapSettings reports the intended hostname and port. Test DNS and ports 993 and 587 from the anymize network perspective. In chat, list folders and recent Inbox messages, then read one returned UID; reading does not mark the message as read. If sending is needed, approve a plain-text test message to an address you control and inspect delivery plus Exchange logs. Microsoft documents Test-ImapConnectivity and Client Frontend protocol logging for diagnosis.

A forbidden/private host means the address is not an allowed public target. A timeout points to DNS, NAT, firewall or the specified port. A TLS error calls for checking hostname, certificate chain, expiry and the 993 TLS or 587 STARTTLS mode. IMAP authentication failures require checks of both services, ImapEnabled and sign-in policy; SMTP failures require checks of the Client Frontend connector and sender rights. Do not put passwords or complete mail content in support tickets.

Reviewed on 24 September 2026 against Microsoft Learn and the current anymize connector implementation. Exchange versions, security policy and admin screens can change. Confirm each command against the actual server before applying it.

• Microsoft Learn: configure-imap4
• Microsoft Learn: configure-authenticated-smtp
• Microsoft Learn: configure-mailbox-access
• Microsoft Learn: assign-certificates-to-services
• Microsoft Learn: exchange-2019-2016-end-of-support
• Microsoft Learn: enable-modern-auth-in-exchange-server-on-premises