First-device rollout

Move one sender. Prove the path. Then repeat.

Keep the first change reversible. Prepare Windows and Microsoft 365 first; repoint one sender only after both sides are proven.

Before you start

Have these five things ready.

Windowsx64 host on the private network
Microsoft 365normal user mailbox for relay
Negative proofdistinct out-of-scope mailbox
AdministrationWindows + appropriate Microsoft 365 admin access
Networkexplicit private IPv4 address for the listener

Runbook

The order matters.

Each step ends with something you can verify. If you cannot verify it, stop there.

01
Install the signed x64 MSI.
```
msiexec /i .\smtpready-<version>-win-x64.msi /l*v .\smtpready-install.log
```
The installer creates the service, the protected ProgramData directory, SMTP firewall rules, and the local admin endpoint.
ProofService installedNo sender changed yet.
02
Bind only the private address you intend.
```
smtpready setup --listen-address 10.0.0.12
```
SMTPReady never chooses 0.0.0.0 automatically.
ProofListener + host certsStill no sender changed.
03
Provision Microsoft 365 and prove scope.
```
smtpready setup microsoft365
```
Use the relay mailbox and a distinct mailbox that must be denied. Authorization can take time to propagate; observe it with smtpready doctor, then rerun setup to activate readiness.
ProofRelay allowed · unrelated deniedDo not recreate the app while propagation is pending.
04
Add exactly one sender.
```
smtpready device add
```
Then point that one printer, scanner or application to the SMTPReady host. Keep the previous SMTP target recorded so rollback is immediate.
ChangeOne device onlyRollback: restore its previous SMTP target.
05
Test the path before rollout.
```
smtpready status
smtpready doctor
smtpready test --to recipient@example.com
```
Do not add more senders until the service, listener, certificate, scope and Microsoft reachability checks are all understood.
ExitAll checks passThen repeat for the next sender.

Rollback

Keep failure local.

If the first sender fails, point it back to the previous SMTP target. Accepted messages already queued in SMTPReady remain visible to the operator; do not delete spool files manually.

Troubleshoot with smtpready doctor →

Move one sender. Prove the path. Then repeat.

Have these five things ready.

The order matters.

Install the signed x64 MSI.

Bind only the private address you intend.

Provision Microsoft 365 and prove scope.

Add exactly one sender.

Test the path before rollout.

Keep failure local.

Did your first message arrive?