How to add a legal disclaimer to every email in Microsoft 365

By Chris Greenacre·Published ·6 min read

There are two ways to put a legal disclaimer on every email your organisation sends from Microsoft 365. You can stamp it on the server with an Exchange Online mail flow rule (also called a transport rule), or you can insert it in Outlook as the email is written, using an add-in.

The mail flow rule is built in and free. It also has some well-known quirks: the disclaimer lands at the very bottom of long reply threads, it never appears in the sender's Sent Items, and it needs a fallback plan for encrypted mail.

This guide walks through the built-in method step by step, explains those quirks so you can decide if they matter to you, and covers the add-in alternative.

Method 1: a mail flow rule in the Exchange admin centre

This adds the disclaimer on Microsoft's servers after the email leaves Outlook, so it applies whatever device or app the user sent from. You need an admin role with mail flow permissions. Microsoft estimates about seven minutes.

  1. Sign in to the Exchange admin centre at admin.exchange.microsoft.com and go to Mail flow > Rules.
  2. Select Add a rule, then Apply disclaimers.
  3. Give the rule a clear name, such as "External disclaimer".
  4. Under Apply this rule if, choose The recipient > is external/internal, then Outside the organisation. Without this condition, the rule also applies to internal and incoming mail.
  5. Under Do the following, keep Apply a disclaimer to the message > append a disclaimer. Choose prepend instead if you want it at the top.
  6. Select Enter text and paste your disclaimer. HTML and inline CSS work, up to 5,000 characters. You can personalise it with tokens such as %%DisplayName%%, %%Title%% and %%Company%%.
  7. Select Select one to set the fallback action for messages the rule can't modify (more on this below). For outgoing mail, Ignore is usually the safest choice.
  8. Under Except if, add The subject or body > Subject or body matches these text patterns and enter a distinctive phrase from your disclaimer. This stops a new copy being added on every reply in a thread.
  9. On Set rule settings, choose Test without Policy Tips first. Check the message trace, then switch the rule to Enforce.

Prefer PowerShell? The same rule is New-TransportRule with the -ApplyHtmlDisclaimerText, -ApplyHtmlDisclaimerLocation and -ApplyHtmlDisclaimerFallbackAction parameters.

Source: Organization-wide message disclaimers, signatures, footers, or headers in Exchange Online (Microsoft Learn).

The catches with mail flow rule disclaimers

The rule works, but it behaves differently from a signature the user can see. These are the points that usually generate helpdesk tickets.

  • It goes at the end of the whole message. "Append" means the bottom of the message body. In a reply, that is below the quoted thread, so on a long conversation the disclaimer sits under every earlier email rather than under the latest one.
  • The sender never sees it. The rule runs in transit, after the message has left the mailbox. The copy in Sent Items has no disclaimer, which surprises users and can confuse anyone auditing what was sent.
  • Encrypted and signed mail can't be modified. That is what the fallback action is for. Wrap (the default) sends a new message with the original attached, which recipients often find odd. Ignore sends the original without the disclaimer. Reject bounces it back to the sender. Microsoft also warns against using Wrap on rules that touch incoming external mail, because it interferes with Safe Attachments scanning.
  • One rule, one condition set. Conditions in a rule are combined with AND. If different brands, domains or departments need different wording, you need one rule each, plus exceptions so they don't overlap.
  • Testing is all-or-nothing. There is no preview in Outlook. You find out what recipients see by sending test emails and checking message trace.

Source: Mail flow rule actions in Exchange Online (Microsoft Learn).

Method 2: insert it in Outlook with an add-in

The alternative is to add the disclaimer at the point of writing. An Outlook add-in, deployed centrally to everyone, inserts the signature and disclaimer into the message body as the user composes. Because it is part of the email before it is sent:

  • it sits under the user's new reply, not at the bottom of the thread
  • it is in the Sent Items copy, so what was sent is what is on record
  • encrypted and signed messages get it too, because it was added before encryption
  • mail flow is untouched: no rules, connectors or rerouting to maintain

The trade-off is coverage. An add-in only runs in Outlook. Mail sent from Apple Mail, a scanner, a line-of-business app over SMTP or another client won't get it.

Where Sigil fits. Sigil is a Microsoft 365 signature tool built on this add-in approach. Its compliance footers attach a mandatory legal block to each email domain and append it beneath every signature at render time, so no template can leave it out. It costs £0.70 per mailbox per month with a 14-day free trial.

You can also combine both. Keep a mail flow rule as a safety net, with an exception that skips any message already containing your disclaimer text. Outlook users get the add-in's version in the right place; anything sent from elsewhere still gets stamped on the way out.

What a UK disclaimer actually needs to say

For UK limited companies and LLPs, the legal requirement is about company particulars, not confidentiality wording. Under the Companies Act 2006 and the 2015 trading disclosure regulations, business emails must show:

  • Registered company name, including “Limited” or “Ltd”
    • On all business emails
  • Registered number
    • Emails that count as business letters
  • Parts of the UK where registered (England and Wales, Scotland or Northern Ireland
    • Emails that count as business letters
  • Registered office address
    • Emails that count as business letters

Confidentiality notices, "views are my own" lines and VAT numbers are habit rather than law. Keep them if you like, but put the required particulars first. Sole traders and partnerships have their own, lighter rules.

The full breakdown, including per-domain disclaimers for multi-brand tenants, is in our guide to UK email signature requirements.

This is general information, not legal advice. Check your own obligations with a solicitor or accountant.